Intrusion Detection For Your PC Case

Anonymous Coward writes "Ryan du Bois, from genbukan security (aka red0x), has created a chassis intrusion detection system for your computer box: the actual physical case. He also wrote a paper describing three separate implementations of this CIDS system: Contacts, Pressure switchs, and a PLA (programmable microchip). Included in his paper are complete designs for the first two and a promise for the last to come soon. Definitely worth a read. The paper is available in many formats including OpenOffice 1.0, HTML , TEXT and a Tarball of them all. You can also obtain the signatures as well as his Automated Security Tools Project, of which this is a member."

Comments

This is news?

[No-op]

Pretty much all standard business desktops have intrusion detection devices, as well as bios hooks to inform higher level software apps that it has been tripped. Most server cases have this as well- a whole slew of my compaq racks here have them, and they tie into our management system. Mind you, they lock as well, so I'm not as worried- they have solenoids! *THUNK*

I can't imagine someone cobbling together something that has existed forever is news...

Compaq has had this...

[peterdaly]

Compaq has had something like this for years. Not only that, they have an internal case lock which can be activated/deactivated remotely, or in the password protected bios.

A special tool from compaq is required to defeat the lock...or a drill. But anyway, it can keep track of when the case is opened I believe.

I have seen, but never used the feature, so I don't know the specifics.

-Pete

What a bunch of Rubes!... Goldberg, that is

[L. VeGas]

All you need is tamper-evident tape.

what I learned from the movies

[Marco_polo]

is that we need lasers set up in an inefficient pattern surrounding the box itself.

Classified Processing

[delphin42]

I used to work for a defense contractor where many of our computers were used to process classified information. Besides controlling access to the room in which the computers were located, stickers were placed over all the access points to the internals of the machine. The stickers were signed and dated by the security officer when they were placed and if one was broken, the computer had to be carefullly inspected before it would be returned to operation. Needless to say, employees were enouraged to report wear on stickers before they were completely broken, to avoid having to throughly inspect the innards of the device for bugs.

My IDS...

[Bonker]

Gracie, the gray tabby cat sleeps atop my PC case. If her bed is disturbed... and I do mean in any way... she cries for days on end. She can't be consoled. I have no choice but to hunt down the man what tried to jack my HDD and present his head to the cat like she does when she brings me mice.

Great intrusion detection

[wowbagger]

Leave a fake grenade, with the pin pulled and the spoon held down by the outside of the case in the computer.

Identify intrusion by the stain on the floor.

For bonus points, replace the fake grenade with a real one.

Useless, useless, useless

[marxmarv]

This "design" is completely obvious to anyone the least bit skilled in the state of the art, and frankly doesn't add much information at all. There's ZERO reason you would need a PLA for this project when 7400 series TTL has many available multi-input OR gate functions. What's worst, none of this works anyway because all you need to do is unplug the PC or otherwise disrupt the power to the gate or PLA to break into it (the normal state is, after all, active low).

So what we have here is some fourteen year old with his own "security" organization, a metric buttload of super glue and an utter lack of clue who writes a frankly useless article so that he can pretend he's important whilst slinging around big acronyms like "PLA" and "VHDL" when the tools they represent are useless to the task at hand. In other words, a snake-oil salesman.

-jhp, smacking down dim-bulbs everywhere

Re:Air pressure

[Graspee_Leemoor]

"Sounds interesting, but incredibly impractical."

Ah! You have issued the rallying cry of the /. case-modder...

"It sounds interesting yet totally impractical! To arms, my brothers! Let us mod this case!"

graspee

Another option

[RadioTV]

I work at a large public university and I admin an unmonitored lab. This is what we came up with.

We used a home security alarm system modified to connect to the computers. We mounted a switch inside the case that would open when the case was opened. We put the correct resistor in series with the switch (home security alarms don't just measure continuity, the also measure resistance) and connected it to a RJ45 jack on a blank slot cover. We mounted a plate to the monitors either by replacing a screw with a security screw kit (you can't remove the screw without removing the cable run through it) or using industrial super glue. Loop the security alarm cable through the monitor plate and the lock hole on the back of most computers, connect it the RJ45 jack and arm the alarm. If someone disconnects the cable or opens the case, a 125db alarm sounds in the room and an automatic call is placed to the campus police.