The Trouble With Bringing Your Business Laptop To China

snydeq writes "A growing trend faces business executives traveling to China: government or industry spooks stealing data from their laptops and installing spyware. 'While you were out to dinner that first night, someone entered your room (often a nominal hotel staffer), carefully examined the contents of your laptop, and installed spyware on the computer — without your having a clue. The result? Exposure of information, including customer data, product development documentation, countless emails, and other proprietary information of value to competitors and foreign governments. Perhaps even, thanks to the spyware, there's an ongoing infection in your corporate network that continually phones home key secrets for months or years afterward.'"

Comments

That's only one of the problems

[dtmos]

The other -- and, I would submit, more important -- reason for not taking your business laptop to China (if you're from the US) is US export control laws. The definitions of "export" and "controlled technology" have been so generalized that it is an even-money bet that the laptop of a given technologist contains information that, were he to travel to China, would result in at least a technical violation of the law -- and the penalties are severe.

Re:That's only one of the problems

[ZorinLynx]

Considering these laptops are for the most part manufactured in China anyway, how does bringing them back there in anyway give China access to any "controlled technology" they don't already have?

Re:That's only one of the problems

[DragonWriter]

Considering these laptops are for the most part manufactured in China anyway, how does bringing them back there in anyway give China access to any "controlled technology" they don't already have?

Controlled technology includes software as well as hardware.

Re:That's only one of the problems

[dtmos]

how does bringing them back there in anyway give China access to any "controlled technology" they don't already have?

It's the information the technologist has stored on it that is the problem. The export control laws are enforced by the Bureau of Industry and Security, and they are arcane, complex, and woefully out of date. Just to give one example, if you're a microprocessor designer, and have a design that operates at temperatures exceeding 125C, that design is controlled; carrying that design in your laptop when you go to China is a violation of the law -- whether or not it is even accessed while in China. (It's also illegal to show that design to any person of Chinese citizenship, even if you both are in the US at the time; that, too, is considered export under the law.)

Re:That's only one of the problems

[viperidaenz]

So its illegal for me to buy this if I'm from China? http://www.ti.com/product/sm320f28335-ht It's a processor that runs at 210C. (You can buy this from TI's Asia distributor by the way)

Re:That's only one of the problems

[MichaelSmith]

It's also illegal to show that design to any person of Chinese citizenship

And perfectly legal if they have changed their citizenship, regardless of who they might be feeding information to.

Re:That's only one of the problems

[zerro]

hrmm. When I buy certain chips/kits from TI's websites, it made me go through an export control interview and application.
What if you are buying from a non-US distributor in a non-US country. Do US trade/export laws still apply?

Re:That's only one of the problems

[RabidReindeer]

It's a processor that runs at 210C.

So can you brew tea with it, too?

Re:That's only one of the problems

[RabidReindeer]

It wasn't that long ago that encryption was classified as a munition by the US Government. Meaning that merely having a secure browser on your laptop would likely put you in violation.

Re:That's only one of the problems

[deodiaus2]

Yes, I think they have to learn about warez or some other site. Maybe even fund the development and maintenance of servers so that "pirates" can post on.
Unfortunately, a lot of commercial software sucks royally. I have seen better SW on slashdot.org than most places.

Re:That's only one of the problems

[__aaltlg1547]

Software, design specifications, design documents.

Re:That's only one of the problems

[neyla]

True !

Fun Fact

encryption*SOFTWARE* was classified as munitions and restricted, meanwhile free speech laws meant that printed words could very seldom be stopped.

I was part of exporting PGP from USA legally, by way of printing the (zipped, uuencoded + checksums) source-code, mailing it physically to norway, scanning it, OCRing it and manually proofreading all lines where the checksum failed.

Re:That's only one of the problems

[chthon]

Even better, heat a samovar with it.

Re:That's only one of the problems

[sjames]

You say that as if the laws actually make any sense!

Re:That's only one of the problems

[rioki]

I bow before you for your great achievement! I have heard of that epic tale, but have never the option to thank anybody about it.

Re:That's only one of the problems

[i]

Law and reason are not the same.

Re:That's only one of the problems

[neyla]

I still have the envelope, containing the 50 pages of source-code that I proofread. (it was spread over a few dozen volunteers)

Re:That's only one of the problems

[bkr1_2k]

And the solution, as any good technology pro that actually travels to foreign countries for business should know, is to file export paperwork. It's a simple solution, takes about 10 minutes to file relevant papers and then you're covered.

It won't stop any actual spying, which is being blown way out of proportion by this article in my opinion, but it will protect you the "exporter" from prosecution.

Re:That's only one of the problems

[halcyon1234]

Considering these laptops are for the most part manufactured in China anyway, how does bringing them back there in anyway give China access to any "controlled technology" they don't already have?

I think by referring to "controlled technology" with airquotes, he meant porn.

Re:That's only one of the problems

[Max_W]

Wait a minute... My laptop WAS made in China.

Fix 'em good.

[ackthpt]

Take a TRS-80 and watch them try to figure it out.

Re:Fix 'em good.

[jfdavis668]

A good old model 100 would do wonders. Do they make powerpoint and outlook for one?

Re:Fix 'em good.

[Dr_Barnowl]

Even more vulnerable - your compromised host machine could be screen-scraping the virtual image for all it's worth and sending the snapshots to Uncle Chang (side note - what is the Chinese equivalent of "Uncle Sam"?).

The guest machine also needs an unencrypted bootloader - because it's a virtual computer with the same BIOS implementation, which could be compromised in exactly the same way as the host.

UEFI Secure Boot? Not a defence. If you can get access to the machine, you can swap the BIOS out with one that trusts the signing key of Chinese Intelligence, and will load their signed bootloader. Or they'll just filch the Microsoft signing key and use that.

Boot from a USB that you keep on your person? Doesn't preclude your compromised laptop running some kind of hypervisor that captures all your keystrokes and again, mails them to Uncle Chang.

At the basic level they could just insert a traditional hardwired keylogger between your keyboard and motherboard, and you'd never detect it unless you were around when it decided to phone home (some models will run commands to send their logs out).

The only defence is not to leave your hardware unattended. Maybe this is a good use case for a Raspberry Pi in a physically secure case - powerful enough for basic productivity computing but portable enough to keep on your person. For maximum security you'd also have to carry the display and any input devices, so a visor display (like Google Glass), and a roll-up USB keyboard and mini-mouse would be reasonable.

Re:Fix 'em good.

[Electricity Likes Me]

This is also unreasonable.

While it is technically possible to do most of these things, for low-grade espionage it's way too expensive to do and requires a well-defined target (i.e. building up a stock of compromised ROMs, of every laptop you're likely to hit, would be expensive as hell and even then you might end up tripping something or damaging the hardware doing it).

The BIOS swap for example would be particularly troublesome - you'd need to pull apart the laptop, desolder the BIOS chips and solder new ones. No matter how good you are, that's not going to be done in anything less then a few hours, presuming you had all the tools, the chips, and it went flawlessly. And it would require knowing the exact make and model of the target machine.

Re:Fix 'em good.

[Magada]

Given that this is the country where such toys are manufactured in the first place, it may be as easy as swapping out one board for another one which is identical in all aspects - except software.

Re:Fix 'em good.

[romons]

For many of the companies I've worked for, any stolen secrets could be considered 'disinformation', and would probably cost them more to unwind than it would pay them to analyze.

I suspect that most people are like this, unless they work for the state department.

Also, my last job in the Bay Area had enough Chinese and Indian nationals working there to ensure that anything of note that happened would be transmitted back to the appropriate uncle Chang/Samudragupta well before some hapless engineer got it lifted off their laptop.

encryption

[Anonymous Coward]

Why doesn't your business mandate HDD encryption?

China isn't the only place this goes on...

Re:encryption

[Qzukk]

Why doesn't your business mandate HDD encryption?

Not that it would matter, some person would decide its too much trouble entering the password all the time and just leave the laptop on.

Re:encryption

[able1234au]

Encryption but to be extra paranoid, don't bring a laptop. You need to assume that there will be spies on your own payroll. Someone supplementing their pay and being patriotic at the same time. Paranoia is a good thing. Encryption is critical but don't assume it is a magic bullet. If they video or capture you typing in your password then you will have a false sense of security.

Re:encryption

[arbiter1]

if its business you probably need it. Personally if you are international traveler for business, i would use true encrypt and encrypt the entire drive, maybe throw in like usb drive/SD card that needs to be inserted with a password to access the laptop.

Re:encryption

[dnaumov]

Mandatory and automatic lock-up of a computer after a period of inactivity is neither new nor hard to enforce.

Re:encryption

[lister king of smeg]

better yet live cd let them try installing malaware on there then, encrypt the whole drive and only use it for data storage, when chinless agents tries booting and no OS is found so he simply images you drive for later analysis let him stew for a few billion years trying to decrypt it.

Re:encryption

[homer_ca]

A hardware keylogger inline with the keyboard cable takes care of that. It only means they'll have to break in twice instead of once.

Re:encryption

[blueg3]

If you're really paranoid, you should keep in mind that encryption doesn't really provide data integrity, it only provides confidentiality. That is, if someone steals your laptop and looks at your hard drive, they should get no information, provided your passphrase is sufficiently unguessable. It does not necessarily protect you against someone changing the data on your hard drive, though that might be rather inconvenient. Do not treat an encrypted hard drive as protection against physical attacks!

You should also keep in mind that naturally an encrypted hard drive protects against no lower-level threat. A BIOS-level keylogger or malware will work just fine.

Re:encryption

[hobarrera]

If you're really paranoid, you should keep in mind that encryption doesn't really provide data integrity, it only provides confidentiality. That is, if someone steals your laptop and looks at your hard drive, they should get no information, provided your passphrase is sufficiently unguessable. It does not necessarily protect you against someone changing the data on your hard drive, though that might be rather inconvenient. Do not treat an encrypted hard drive as protection against physical attacks!

It's protected in the sense that information cannot be stolen.
Also, it does offer some level of integrity protection - if someone alters encrypted data, it's very likely that I will be able to tell, since it would mean that parts of my disk now contain rubbish.

Re:encryption

[mjwx]

Why doesn't your business mandate HDD encryption?

China isn't the only place this goes on...

What good is HDD encryption when they have/had physical access to the device? If you get physical access tot he HW all you have to do is take a copy of the HDD (erm, DD will do this for you) and crack it at your leisure.

If you're that worried about corporate/govt espionage, there is only one defence... Don't keep the data on a mobile device. Yep it's a PITA doing everything via VPN, but it's the only secure way.

Besides this, the article is bollocks made up by people who have had too much pot/coffee and not enough exposure to the real world. China's govt doesn't give a shit about your crappy companies secrets. They don't bother stealing technology when it's cheaper and easier to buy it from the Russians. As for corporate espionage, once again not a big problem as it's cheaper to buy it than steal it and it's easier to steal it from the factory (where there are lots of low paid workers to bribe) than sneaking into some gwailo's room and rifling through his shit (also, people capable of stealing secrets from you are typically quite smart).

Re:encryption

[besalope]

And USB Switchblade still gets around it with ease depending on the Operating System.

Re:encryption

[Anonymous Coward]

What good is HDD encryption when they have/had physical access to the device? If you get physical access tot he HW all you have to do is take a copy of the HDD (erm, DD will do this for you) and crack it at your leisure.

There was a story from a few years back where a fellow had his laptop confiscated. It was encrypted with TrueCrypt and the US govt tried, and failed, to break the encryption for months. So no, it's not an easy thing

Besides this, the article is bollocks made up by people who have had too much pot/coffee and not enough exposure to the real world. China's govt doesn't give a shit about your crappy companies secrets

China most certainly does care about your companies secrets if the company is involved in military contracts. Even if you don't travel, they are trying to get at the data that is here. Some of the recent fighter aircraft programs have had problems in particular with data theft.

Re:encryption

[Qzukk]

And if the laptop has a firewire port, i'm fairly certain RAM can be dumped on ANY operating system.

Re:encryption

[blueg3]

Doh. I broke my italics.

Confidentiality is the property you're talking about. It's what encryption, in general, provides. You are quite correct that it makes it so the information can't be stolen.

You should be careful about assuming things about integrity protection. For some encryption modes and for most simple attacks, yes, it will render blocks of your plaintext illegible, which is detectable. But consider the problem with encrypting data of a known structure (but unknown content) with a stream cipher (or something like a block cipher's CTR mode), for example. A stream cipher produces a high-entropy stream of bits that's XORed with the plaintext to produce the ciphertext (and vice versa). So a bit-flip in the ciphertext is a bit-flip in the plaintext. If you know the structure of the plaintext, you may be able to make a properly-selected bit flip very bad indeed.

Re:encryption

[war4peace]

Keyboard cable... on a LAPTOP? Or do you mean they will take the laptop apart, insert a hardware keylogger INSIDE the laptop and then break in again, take the laptop apart AGAIN, read the password, etc.? That sounds a bit far-fetched, TBH.

Re:encryption

[homer_ca]

Sure, not feasible on a glued-together Macbook, but most business-class laptops have easily removed keyboards attached by a ribbon cable. On something like a Dell Latitude, it's easily a 1 minute job. The keylogger hardware isn't isn't exactly off the shelf, but not out of the question for a state-sponsored attack. Still, you have a point. Any target that's worth attacking with such sophisticated equipment is probably paranoid enough not to be traveling around a foreign country with the digital crown jewels, encrypted HDD or not.

Re:encryption

[sydneyfong]

Paranoia is a good thing.

I don't know, but I don't think so...

For the more normal people (as in, people considered normal outside of Slashdot), there's usually an implicit calculation of effort vs risk.

Paranoia is what they call people who spend excessive effort trying to minimize far fetched risks.

Re:encryption

[drkim]

Encryption but to be extra paranoid, don't bring a laptop.

Turn this to your advantage... bring two netbooks, the 'real' one you keep in your possession, the other you leave lying around.

You seed the fake one with all the disinformation you want them to have, and let them steal it!

Re:encryption

[ColdWetDog]

And if the laptop has a firewire port, i'm fairly certain RAM can be dumped on ANY operating system.

Ah, this must be the reason that Apple is dropping Firewire in it's laptops. Always looking out for us. Thanks Steve! (wherever you are)

Re:encryption

[Anonymous Coward]

It says that we need 500g more of cream cheese in this microprocessor substrate!? Where the hell do we even buy that here!

Re:encryption

[mikeiver1]

The wise money would go a couple of steps further. Install nothing more than a plain jane out of the box live Linux CD image. Boot the thing and store/work out of a fast USB thumb drive on which all data is encrypted with the latest and greatest super kick ass encryption and a key that is very strong. You take the USB key with you around your neck. For extra points you could have the OS start the camera and record upon boot as well as screen capture every few seconds to the HDD unless a special key combo is used to shut it down.

Re:encryption

[plover]

Besides this, the article is bollocks made up by people who have had too much pot/coffee and not enough exposure to the real world. China's govt doesn't give a shit about your crappy companies secrets. They don't bother stealing technology when it's cheaper and easier to buy it from the Russians. As for corporate espionage, once again not a big problem as it's cheaper to buy it than steal it and it's easier to steal it from the factory (where there are lots of low paid workers to bribe) than sneaking into some gwailo's room and rifling through his shit (also, people capable of stealing secrets from you are typically quite smart).

Oh, really? China has been caught stealing from all kinds of crappy little companies. http://www.defensenews.com/article/20111106/DEFSECT04/111060302/Chinese-Cyber-Espionage-Growing-U-S-Report

Re:encryption

[Jeremi]

You take the USB key with you around your neck.

Still insecure, someone could grab it and run. For enterprise-level security, swallow the USB key. That will keep the USB key well and truly secure, while still giving you access to your data every 48 hours.

Re:encryption

[Jeremi]

What good is HDD encryption when they have/had physical access to the device? [...] If you're that worried about corporate/govt espionage, there is only one defence... Don't keep the data on a mobile device. Yep it's a PITA doing everything via VPN, but it's the only secure way.

If your nemeses can defeat your HDD encryption, won't they be likely able to defeat your VPN encryption as well? The only difference is that they won't have to sneak into your hotel room to do it.

Re:encryption

[ramsun]

when chinless agents tries booting and ...

Oh, I say, don't mix up your countries, old boy. We chinless agents are proud to serve in Her Majesty's Secret Service. The agents of the country you're thinking of have other distinctive facial features.

Re:encryption

[drkim]

> You seed the fake one with all the disinformation you want them to have, and let them steal it!

Please don't. The "Taiwanese capacitor factory" incident happened more than a decade ago, and we're STILL getting new electronic goods with bad electrolytic capacitors.

That was a copy error, not deliberate disinformation.

I'm thinking you could seed stuff like:
"Our top bid can be no higher than $xxx,xxx, then we'll have to go to their competitor."
"Our labor costs in Vietnam will only be $xxx,xxx. Let's see if they can beat that."

They are more likely to believe it if they steal it for themselves...

Re:encryption

[Vegan Cyclist]

As a vegan it's probably more like every 16hrs. ;)

Re:encryption

[carnivore302]

Truly wise money would go yet another step further. Instead of using a regular laptop, bring a commodore 64 and put sensitive data in the $E000-$F000 region. Mark the machine with a sticker 'confusius'.

Re:encryption

[Lincolnshire Poacher]

Why doesn't your business mandate HDD encryption?

Unfortunately the bootloader or boot partition is the weak link in disk encryption. For example, a malicious kernel can be inserted into an unencrypted boot partition. The user will merrily decrypt their data partition on boot and then Bad Things occur.

This is one reason that Secure Boot is a good thing, despite all the hand-wringing and wailing.

Re:encryption

[TheLink]

1) In many cases it doesn't take long to take a laptop apart and reassemble it. The Dell technician who did that to my laptop claims he could do it in the dark/blindfolded (go figure the implications - Dell quality etc ;) ).

There are also alternative ways of keylogging. Most keyboard keys make a distinct sound when you type them. Typing q would sound different from typing w. For those that are too similar you could guess by heuristics. You can make calibration/ easier by pre-typing qwerty on it, but it is not necessary given enough text and correct guessing: https://freedom-to-tinker.com/blog/felten/acoustic-snooping-typed-information/

2) Alternatively plug a sneakier version of this in: http://hakshop.myshopify.com/products/usb-rubber-ducky
Or trick the person to do it.
See also: http://www.irongeek.com/i.php?page=security/plug-and-prey-malicious-usb-devices

Basically a usb device can install stuff and even "click through" the UAC/confirmation stuff, etc - because it can look like a usb keyboard and mouse. What it could do is nudge/jiggle the "mouse" by 1 pixel once a minute or so to make sure the screensaver never triggers. Then at a suitable time, launch the payload- which could be launching notepad/cmd, creating and saving a script and then running it.

If one of the usb ports was actually replaced with a malicious usb device that looks like a failed usb port you might not make a big issue about it. It might even be a working usb port - most large companies have standard issue laptops, so making a custom hardware USB shim for those laptops might be possible.

Re:encryption

[aztracker1]

easy.. backup before you go.. wipe and install a clean linux boot.. then use a USB distro you keep on you while you are there... when you get back, wipe and re-install.. if you don't want to wipe, swap the drive out before you go.

Re:encryption

[homer_ca]

How many times can you run the payload of Keylogger In The Corner Of The Chip before your customers stop trusting your chips. At least this way they can blame the data loss on the Mission Impossible shit.

Re:encryption

[Dr_Barnowl]

Nope ; if they compromise your plain-jane Linux instance they can still get your data - you have to mount it for it to become useful. So you have to trust the machine you mount it on. And because you left your laptop unattended, it's been pwned by Uncle Chang. It's especially watching out for any interesting mounted volumes because your home folder was virtually empty.

Re:encryption

[Dr_Barnowl]

This one says you have to eat the cream cheese, and then chase it with shots of lemon-flavoured vodka..

Curse our intolerance to lactose and inadequate P450 enzyme pathway!

Re:encryption

[Dr_Barnowl]

Nope, a physically compromised machine...

* Could have a hardware keylogger. As soon as they have your encryption password, they arrange for someone to steal your laptop in a plausible manner.
* Could be running a hypervisor that looks totally normal but sends all your data to Uncle Chang.

Re:encryption

[Dr_Barnowl]

They defeat your HDD encryption by attacking the weak spot - the non-encrypted bits on your laptop.

The same physical attack pattern would work for VPN - keylogger, hypervisor, whatever, because it's still a compromised machine with access to the sensitive data.

The only defence is not to be separated from your hardware - which means carrying your laptop on your person at all times. They can still arrange to have it stolen by a "mugger", but it was all encrypted, right? But if the police conveniently "find" the culprit and give it back, you can't use it.

Re:encryption

[gsslay]

China isn't the only place this goes on...

Uh uh! Western countries would never ever commit such underhand tricks! No way! We are morally incapable, not like those sneaky foreign types. They just don't have a moral compass like what we do. Some of them just don't care What Jesus Would Do neither!

Re:encryption

[rioki]

Mister Bond, your plane is waiting.

Re:encryption

[Inda]

Have you guys never had a Madras, on a Friday night, just before midnight?

Re:encryption

[war4peace]

I don't know, man, it seems easier to just throw a cheap hooker their way, snap photos and then blackmail them 'till Kingdom Come.

Re:encryption

[AmiMoJo]

Not just Firewire, PC-Card slots are basically hot-plug PCI/PCI-E and thus give full memory access.

Re:encryption

[phoenix_orb]

China has a law prohibiting the importation of encrypted devices. They want you to boot up latptops at the airport to verify that TrueCrypt or something similar isn't running.

Re:encryption

[Captain_Chaos]

The hooker's name is Kingdom?

Re:encryption

[war4peace]

No, but the blackmailed dude's is.

Re:encryption

[lister king of smeg]

A liveCD is not a form of encryption

Re:encryption

[lister king of smeg]

*Chinese agents

(damn you auto/spell correct)

Re:encryption

[Wolfrider]

Vmware Workstation will let you very easily create a VM that is encrypted. Laptop OS notwithstanding (you could use Linux) even if they find and copy the entire VM, as long as you use a good strong password it might suffice.

Re:encryption

[cpaglee]

That is so ridiculous. I live in China and am sitting in Beijing as I write this post. In the last 25 years I have passed through Chinese customs literally 100s of times. I have been asked to turn on my laptop exactly ZERO times. Mod the parent down (to zero)!

Corporate espionage happens in China, but largely it is a result of stupidity. Executives with experience in China will give the victim advice (don't put blind faith in your Chinese partner) and they immediately ignore it. This is just one of the challenges of doing business in China (or anywhere else).

Re:encryption

[wwphx]

I was just thinking that it would be interesting to see them install a key logger on my MacBook Air. Malware would still be a possibility. The problem with Mac's is that they found a flaw with their included disk encryption in that the boot volume has a master password that is recoverable, additional volumes do not have this recoverable key. And if the person must have Windows, give them Parallels on the encrypted volume.

The solution for data theft?

[Anonymous Coward]

Hardcore gay porn as the only contents of the laptop. not even an OS. just a drive full of pronotron of the rankest variety. compute on an sd card that you keep in your person...or on your person. depends how paranoid you are :)

Re:The solution for data theft?

[lister king of smeg]

one terabyte drive filled with goatcx, lemon party, and two girls one cup, in the highest resolution you can find, next use stenography to hide encrypted data in. they will notice a difference in each copies checksum and spend years analyzing the worst porn on the planet. you have now made some poor chinese persons life miserable.

Re:The solution for data theft?

[war4peace]

...or happy. You never know!

Re:The solution for data theft?

[Nefarious Wheel]

...next use stenography to hide encrypted data in. they will notice a difference in each copies checksum ...

Please, people, it's Steganography, not Stenography. Stenography is a manual transcription process that was practiced in the days of Shorthand.

(Please show some consideration for the CDO sufferers among us!)

Re:The solution for data theft?

[lister king of smeg]

...next use stenography to hide encrypted data in. they will notice a difference in each copies checksum ...

Please, people, it's Steganography, not Stenography. Stenography is a manual transcription process that was practiced in the days of Shorthand.

(Please show some consideration for the CDO sufferers among us!)

Sorry I used mistakenly listened to spell check.

Re:The solution for data theft?

[drkim]

...you have now made some poor chinese persons life miserable.

Yeah, 'cause his life working for Chinese State security spying on his friends and family was a big party up 'till now.

Re:The solution for data theft?

[retchdog]

and the grammar checker too, apparently.

That's what encryption is for.

[stevenh2]

Who leaves their business secrets in the open. Especially laptops, they get lost stolen, or as the article says people examining it. Really you can use a truecrypt container and hide it somewhere.

Re:That's what encryption is for.

[illestov]

Who leaves their business secrets in the open. Especially laptops, they get lost stolen, or as the article says people examining it. Really you can use a truecrypt container and hide it somewhere.

As far as i know, encryption doesn't prevent a keylogger or a trojan ,planted on your computer, from stealing your data/passwords/whatever is on your screen, or even worse, gaining access to your company's computers through yours when you go back to the states..

Re:That's what encryption is for.

[sconeu]

If your boot partition is encrypted, and you can't boot without entering the password, it's harder to put a trojan or a keylogger on the system.

Re:That's what encryption is for.

[marcushnk]

because its a jail-able offence.

If they think you are trading in state secrets (like Stern Hu http://en.wikipedia.org/wiki/Stern_Hu ) they will take and detain you and your equipment.
At that point they'll ask for you encryption key, if you refuse then you'll be jailed indefinitely and possibly executed.

best thing to do is to not take any data with you, or "burn" / wipe / replace your equipment after visiting.

Re:That's what encryption is for.

[dtmos]

It's not just trading in state secrets ("espionage"). In the US it's also the trading in controlled technologies. The difference is, a controlled technology can be transferred to any US citizen with no legal issue at all, but cannot be transferred to (certain) foreign citizens. A state secret, on the other hand, may not be transferred even to another US citizen without authorization.

Re:That's what encryption is for.

[dslbrian]

This exactly. Encrypt the laptop but don't actually keep anything important on it. Instead use Truecrypt and a USB thumb drive. Have the thumb drive keyed to a different password than the laptop.

Further, as far as customs, drop a live CD of any variety in the CD drive, and have the laptop default to booting the CD. Now when custom guys asks to inspect your laptop, say sure, and let it boot the live CD. You can be amused while they laugh at how slow your laptop boots. In the end let em clone the HD, whatever, even if the NSA cracks it there is nothing on it. Everything important is on the thumb drive that you have "hidden" away (usually in plain sight on a keychain).

As far as the article, carrying your corporate secrets encrypted in your pocket will make any thieves job harder, and having the laptop encrypted will force them to install keylogger hardware, a more time consuming and harder thing to get away with. If I were such an executive and had real concerns I would just get a throwaway laptop, or better yet have some fun and epoxy all the case screws in. There are possibilities.

Re:That's what encryption is for.

[blueg3]

If your boot software is encrypted, how does your system boot at all?

Oh, I see, you're thinking of something like Truecrypt. So, when you boot, where does the code that knows how to decrypt your hard drive live? Why can't the attacker put the keylogger there?

Re:That's what encryption is for.

[hobarrera]

You can encrypt your disk with a password AND a physical USB token - requiring both to be present.
Hence, a theif would need to install a keylogger, AND steal your USB token, AND then have access to your PC again, to retrieve the keyloggers results - unless a pre-OS keylogger can somehow survive the entire boot (meaning it can survive a new kernel being loaded into memory).

Re:That's what encryption is for.

[realityimpaired]

If your boot software is encrypted, how does your system boot at all?

Dunno what kind of hardware you have, but I'm typing this on a Dell business laptop. Coupled with an Intel SSD, it's capable of encrypting the hard drive in its entirety, at the hardware level. The BIOS is smart enough that it won't boot at all, even to the BIOS, without entering the passkey to decrypt the hard drive, and it's smart enough that you can't circumvent it temporarily by removing the hard drive.

Dell's far from the only company that's able to use a TPM in that way. Put tamper-resistant stickers over the screws so you can't get at the motherboard without making it obvious it's been done, and you should be safe.

Why does everybody think that crypto has to be done in software?

Re:That's what encryption is for.

[Anubis IV]

Why does everybody think that crypto has to be done in software?

Better question: why does everyone forget that keyloggers don't need to exist in software? As someone pointed out up above, a hardware keylogger spliced into the keyboard cabling could easily recover your boot password, allowing them to turn around and use that password to access the rest of your "secure" system. It does add an extra inconvenience for them, since they'll need to get access to your computer twice, but if you're there for a business trip, it's likely that they can part you from your laptop during a meal, some socializing, or even if they convince you it's easier to just leave things set up where they are while you go to a different part of the building for another meeting.

Re:That's what encryption is for.

[RabidReindeer]

Who leaves their business secrets in the open. Especially laptops, they get lost stolen, or as the article says people examining it.

Like US Customs.

Re:That's what encryption is for.

[FrankSchwab]

I have a very nice HP enterprise laptop with a fingerprint sensor. The hard disk is fully encrypted, and doesn't even spin up until my fingerprint is verified. No passphrase needed. I'd love to put a camera in the room and watch the operative try to install anything on that machine. /frank
n.b. I also happen to work for the company that designed and built the fingerprint sensor.

Re:That's what encryption is for.

[realityimpaired]

Why does everybody think that crypto has to be done in software?

Better question: why does everyone forget that keyloggers don't need to exist in software? As someone pointed out up above, a hardware keylogger spliced into the keyboard cabling could easily recover your boot password, allowing them to turn around and use that password to access the rest of your "secure" system. It does add an extra inconvenience for them, since they'll need to get access to your computer twice, but if you're there for a business trip, it's likely that they can part you from your laptop during a meal, some socializing, or even if they convince you it's easier to just leave things set up where they are while you go to a different part of the building for another meeting.

Put tamper-resistant stickers over the screws so you can't get at the motherboard without making it obvious it's been done, and you should be safe.

I shouldn't have to quote myself one reply down from the original post... -.-

Re:That's what encryption is for.

[Anubis IV]

I'll grant I skimmed over that line and missed it. Mea culpa. I should have been more thorough in my reading. Doing something like that would indeed work in most cases.

Even so, however, I've seen laptop models with access to the keyboard cabling that didn't require unscrewing anything (e.g. the Titanium PowerBook line used to have two latches at the top of the keyboard that could be disengaged, allowing the user to flip the keyboard up so that RAM could be installed). And if we're talking about this sort of industrial espionage, I wouldn't put it past them to have stock on hand for all of the major brands of those sorts of stickers, allowing them to simply replace your tamper resistant sticker.

Re:That's what encryption is for.

[Chewbacon]

While it isn't for everyone, this sounds like the case to use Truecrypt the whole drive with a plausible deniability scheme. Have fun with that one, boys. I use it at work on a thumbdrive full of proxy circumvention tools my IT department wouldn't approve of.

Re:That's what encryption is for.

[FrankSchwab]

Well, we didn't design in any features to deal with hookers and blow, but your TAP isn't going to get you anywhere considering the fingerprint sensor establishes an SSL session with the laptop.

Re:That's what encryption is for.

[FrankSchwab]

So, you watched Mythbusters once, and believe that it applies to all fingerprint sensors, everywhere, and that the state of the art never advances?

Re:That's what encryption is for.

[Yvanhoe]

This is why they install a keylogger. Unless you keep your laptop 24/24 with you, and sleep over it, you are vulnerable to this. Palladium leaks indicated that they loved the unused PCMCIA slots on many laptops that allowed to install a device without anyone noticing for a very long period of time.

Re:That's what encryption is for.

[Miamicanes]

How, pray tell, can a keylogger flashed "to the BIOS" do ANYTHING meaningful once you've booted into an OS for which the BIOS is (AFAIK) completely irrelevant, like 64-bit Windows 7 or Linux? I mean, I can see how trojan BIOS code might... MIGHT... be able to rewrite the boot sector or something, but the last time I checked, the code in the BIOS is utterly and completely vestigial, irrelevant, and ignored once the Windows logo or 1/2/4 penguins appear and the PC has transitioned to Ring 0 of 386enh mode.

Re:That's what encryption is for.

[RatherBeAnonymous]

n.b. I also happen to work for the company that designed and built the fingerprint sensor.

So is that fingerprint scanner optical only, or is it really fancy and measure fingerprint depth? 'Cause if it's just optical, well, you leave your fingerprints all over the place. Lifting a print and defeating most scanners isn't all that difficult. I treat most biometrics as being about as secure as a username.

Of course, if I were a totalitarian government and you really had data I wanted, I'd have someone mug you and cut your fucking finger off.

Re:That's what encryption is for.

[TheLink]

You really think they don't make tamper resistant stickers in China?

There are other ways of doing keylogging too: https://freedom-to-tinker.com/blog/felten/acoustic-snooping-typed-information/

There are so many ways to get the info if you have physical access to the laptop and/or room. So if you're that paranoid (or they really are out to get the data) make sure the laptop is never left unguarded and it can self destruct.

Re:That's what encryption is for.

[bWareiWare.co.uk]

Hardware key-loggers can phone-home the next time the user is on-line, negating the need to access the computer twice.

However you can still defeat hardware key-loggers in software. Just ask for the characters in a random order, ideally with a extra characters that are ignored.

The problem always remains how do you know the software presenting the prompt is yours?

Re:That's what encryption is for.

[AmiMoJo]

Truecrypt allows you to display a custom message when the laptop boots, e.g. "Operating System not found" (the standard message when the Windows bootloader is there but ntldr is missing). You can still type in your password and let it boot, but to the casual observer there is no indication that the laptop is anything but broken. Just claim you are planning to get it fixed later.

Re:That's what encryption is for.

[oreaq]

It's trivial to fake fingerprints and fool fingerprint sensors.

Re:That's what encryption is for.

[FrankSchwab]

Why, thank you, as a professional in the field of biometrics it has never occurred to us that someone might try to create a spoofed fingerprint. And it has never occurred to us to attempt to detect those, and reject them.
By the way, do you happen to know the dielectric constant of common wood glue? Because I do. As well as gelatin (http://cryptome.org/gummy.htm), amongst other materials.

/frank

Always encryption

[rbprbp]

If you are travelling anywhere without HDD encryption, then you kinda deserve this. By the way, let's see them trying to put spyware on a PowerPC Linux laptop. :)

Re:Always encryption

[Anonymous Coward]

Keyloggers for linux are trivial to write without needing root access. Same with installing a trojan and the person not knowing.

Re:Always encryption

[mark-t]

References please. Specifically, show how it is possible to install a keylogger on a Linux workstation without the administrator knowing something was up if they had left their computer with a password-locked screensaver on.

Re:Always encryption

[WhitePanther5000]

The nice thing about PowerPC is that nothing runs on it.
The crappy thing about PowerPC is that... nothing runs on it.
Old iBook/PowerBook? The one in my basement can't do much more than power on anymore.

Re:Always encryption

[mark-t]

If you shut off the computer, then there's going to be indication that the computer has been tampered with, since it was left on a password-locked screensaver.

Re:Always encryption

[mark-t]

That only appeared to confirm the existence of such a trojan... it gave no indication how such a trojan could be installed by somebody else, without having a valid login on the machine, and without turning the computer off (since turning it off would leave indication that it had been tampered with, had it been left on and at a password-locked screensaver).

Re:Always encryption

[mark-t]

My point is that I'm pretty sure it's not possible to do without leaving evidence behind that some activity (not necessarily what) has occurred on the system that the owner (in absentia) wouldn't be able to account for.

I was assuming a situation where the person leaves their laptop on, logged in, but at a password-locked screen saver. Simply turning it off and rebooting from a usb disk or some such thing would always leave evidence that the computer had been rebooted (since they will no longer be logged in when they return).

They might not leave behind evidence of exactly what they did... but they'd *DEFINITELY* leave behind evidence that something happened.

Take the hard drive with you...

[stewartwb]

I keep the mounting screws out of my laptop hard drive's carrier, so I can easily swap in multiple drives. If I ever visit China, I'll make sure to carry the drive with me at all times in my coat pocket unless I'm actually using my laptop! (Plus, I encrypt the entire drive with TrueCrypt.)

Re:Take the hard drive with you...

[dreadlord76]

Can't they just install something in EPROM, so when you plug your HD in, it @#%@#*())___

Re:Take the hard drive with you...

[arbiter1]

that is not a bad idea, have 2 drives, 1 with a ton of dummy data on it that you put in the laptop when you going out.

Re:Take the hard drive with you...

[Threni]

Probably easier to have the laptop installed with a dual boot windows/linux (or even have 7 boot options - different versions of linux, 1 windows etc) just for show (and to waste their time) but carry a 16gig usb key which you boot into whenever you want to use your computer, accessing a large truecrypt file on one of the partitions if you need more storage. Having said that, if you're only there for a few days/weeks, you probably don't need more storage, and if you did you could just use a second/third usb key, again with a truecrypt file on it. Such a system, especially if all your surfing is done via vpn, should be rather safe.

If I were involved in trying to detect/defeat this sort of tampering, and I worked for (say) the American security services, I'd be offering to supply travelling westerners with clean partitions on the laptops and requesting a copy of them upon return to see what sort of crap gets installed.

Re:Take the hard drive with you...

[Kittenman]

I keep the mounting screws out of my laptop hard drive's carrier, so I can easily swap in multiple drives. If I ever visit China, I'll make sure to carry the drive with me at all times in my coat pocket unless I'm actually using my laptop! (Plus, I encrypt the entire drive with TrueCrypt.)

(intercepted, decrypted message follows)
Voice 1: Comrade - we must steal the coat of stewartwb!
Voice 2: Indeed Comrade. And I will break into his hotel room and steal one of his socks
Voice 1: And don't forget the biro, comrade. We must always take a biro

Re:Take the hard drive with you...

[couchslug]

Use a Thinkpad with an Ultrabay and you can leave a "bait" drive in the main drive space while carrying your real drive in a caddy on your person. Eject whatever accessory you filled the Ultrabay with, pop your real drive caddy in, and for a few second work you are good to go.

Ultrabay make such "dual booting" very convenient. Select your drive of choice on boot.

Source

[Anonymous Coward]

Find me one case of this happening. The article can't find one and I sure as hell don't think it's as common as they want you to think.

Re:Source

[Anonymous Coward]

Yeah, totally racist to point out the fact that industrial espionage is rampant in China.

Unfounded charges of racism is the mark of intellectual cowards.

Re:Source

[AK Marc]

"Go to China, get robbed" sounds racist to me, especially when the outlandish claims of this being a common occurrence aren't backed up by a single actual report of it happening. Ever. Sounds more like lies. The simplest explanation for xenophobic lies is racism.

Booby trap time

[magarity]

I see a great market opportunity here; a system whereby if your keychain dongle isn't inserted into the usb port, the laptop battery goes critical on bootup.

Re:Booby trap time

[cheros]

the laptop battery goes critical on bootup

Nah. Dell tried that already..

Re:Booby trap time

[PaulBu]

Good idea!

Now, let's try to implement it... I suggest to start with Lenovo laptops, and we only need to outsource USB dongle and exploding battery production somewhere, I suggest China, they have experience mass-producing thing!

Wait! All your matching parts (laptop, dongle, battery) are made where? In... China? ;-)

Paul B.

some reading

[zerro]

http://www.schneier.com/blog/archives/2009/07/laptop_security.html

https://www.eff.org/wp/defending-privacy-us-border-guide-travelers-carrying-digital-devices

Hah, I had this problem...

[DDLKermit007]

I had this problem when I was doing work with associates in China when I was working to develop some software to use there. After going out one night I noticed the next day my laptop had been gotten into. Sure they poked around, but I didn't care. Not stupid enough to actually bring any data physically there with me. Checked the machine for anything funky, but seemed he was poking around to copy any interesting data. In the end they ended up trying to screw us & do the job we were doing which was they found really hard without our actual software in their hands. We just ran pointers that always pushed data from China back to the US where we churned through the data because I was a paranoid maniac. Sucks the company went under due to them, but felt a sort of sick satisfaction they ended up looking really dumb when everything ground to a halt suddenly.

EVIL MAID!

[Jeremiah Cornelius]

She's REAL!

Re:EVIL MAID!

[fustakrakich]

Yeah, just ask this guy

Re:EVIL MAID!

[FatdogHaiku]

Well... that explains why the HOT HORNY MAID never showed up... she got canned so they could insert their perfidious data thief in her place! Damn. Someone should update the Asian Porn section of the internet so travelers aren't disappointed...

Re:EVIL MAID!

[Dr_Barnowl]

A hot, horny, evil maid would be even better... she's not just hot and horny... she's NAUGHTY too...

Re:EVIL MAID!

[Megane]

And she love your laptop long time sucky sucky.

Re:EVIL MAID!

[FatdogHaiku]

Oh Yeah Baby, just like that!
Now, touch my boot sector!!!!

throw away laptops

[lophophore]

Any serious exec is going to use a throw-away laptop for travelling to China. A $400 special will keep you online abroad, and then it can be destroyed as a business expense. Cheap insurance against hacking.

Re:throw away laptops

[Anonymous Coward]

Yup, that's how we deal with it. We're frequently in China to do software and hardware testing at our facilities (I work for a large US transportation company), and we have "China laptops". These are encrypted machines that are specifically loaded with the bare minimum stuff we need when we leave and immediately blown away when we get back. Installation of anything beyond the bare minimum (which is pretty much Win7 and VS2005) is strictly disallowed. Source is kept on a separate, encrypted sd card which is not to be kept in the machine, but even then it's just not that interesting. It's all internal source for package sort controllers and such, and we don't even have the ability to check code back in from these machines. It's purely for debugging and sending problem reports back home.

There's a big sticker on them that even says "China laptop, do not connect to corporate network"

Re:throw away laptops

[AHuxley]

Same for entry into the USA or any country. The software needed on brand new storage media, replace when returning home.
The option to inspect any laptop that enters a country is getting to be a reality rather than having to be a 'suspect'.
When a state views your laptop as a "container" - you have no legal protection.
Diplomats and travellers to the Soviet Union knew what they faced at any hotel - why would Communist China be any different?

Re:throw away laptops

[Anonymous Coward]

Getting a sales exec or small company president to replace their laptop is impossible. Been there, done that, watched the company president on a sales call *ACTUALLY COMPLAIN ABOUT HIS OWN IT* being unable to back up his laptop becuase he'd never turn loose of it for long enough to make space and install the backup tools.

I left there really fast.

Re:throw away laptops

[Frosty Piss]

What about sealing your technology in a plastic envelope with tamper seals front and center?

Re:throw away laptops

[Minupla]

I have in the past provided the following instructions to an exec:

1) Go to local computer store
2) Purchase off the shelf hard drive with this model:xxx-xxxx-xxx - pay with local cash
3) Purchase philips screw driver
4) Remove HDD (more details here on how to remove a HDD) and replace with local drive.
5) Drive over old HDD with rental SUV. Repeat until fragments. Ensure HDD platters are fragments.
6) drop into at least 3 random trash bins in tourist areas
7) If questioned during exit, inform them that the computer crashed and that IT had you take it to a local repair shop but it's not working still.

Such is life in the odd world we live in.

Min

Re:throw away laptops

[swillden]

Any serious exec is going to use a throw-away laptop for travelling to China. A $400 special will keep you online abroad, and then it can be destroyed as a business expense. Cheap insurance against hacking.

Nah. Take a $200 Chromebook. Factory reset it when you get back and you don't have to destroy it.

Re:throw away laptops

[swillden]

ChromeOS encrypts all user data by default, automatically verifies the integrity of all software during startup, and reverts to a known-good version in the event any compromise is discovered. Boot verification is based on code and data stored in ROM, so subverting it requires modifying the hardware. Run-time compromise must be done by leveraging web-style attacks (cross-site scripting, etc.) and can normally only achieve what web-style attacks can achieve which is access to data from other sites, etc. In the event deeper compromise is achieved, it's lost as soon as the device is restarted, until the user visits the malicious web site again.

Use a Chromebook, connect only to trusted sites and only over SSL, and you become an extremely hard target for compromise. Little if any of your data is actually stored on the device, what is cached on it is encrypted. When you get home, reboot and you're very, very likely to have a trustworthy system again. Do a factory reset and it's guaranteed to be clean (barring hardware hacks), since all data will be gone, and any modified code will be detected by the verified boot process. And, as a last resort, you only paid $200 for the thing, so if you fear hardware hacks, just chuck it and buy a new one. It's unlikely to add more than about 5% to the cost of your trip.

http://www.chromium.org/chromium-os/chromiumos-design-docs/security-overview

Re:throw away laptops

[inglorion_on_the_net]

What about extra hardware? Instead of checking for everything that might have been done and running the risk of missing something, it may be more cost-effective to destroy the machine and move on.

Re:throw away laptops

[Anonymous Coward]

Driving over an HDD with an SUV doesn't sound very effective.

Re:throw away laptops

[sabt-pestnu]

You may have heard tell of the 1979 american embassy invasion in Iran, where many shredded documents were pieced back together.

Re the direction you give above, either the disks are still readable after the demolition of the hard drive, or they are not. If they are not readable, then further dividing them in trash bins is pointless. If they are readable, your instructions might prevent industrial spies, but may well prove insufficient against a determined government (or a really determined industry).

Re:throw away laptops

[drinkypoo]

Driving over an HDD with an SUV doesn't sound very effective.

Only if your drive has glass platters :) Otherwise, it will need to go into the fire. In a forge.

Re:throw away laptops

[coofercat]

+ throw away phone + throw away tablet.

Re:throw away laptops

[mbourgon]

Given some of the other comments in the thread, I'd be worried about keyloggers, unless (maybe "even if") you've got two-factor authentication going for your VPN.

Re:throw away laptops

[mbourgon]

HARDWARE keyloggers (someone mentioned replacement keyboards with them built in, too)

Re:throw away laptops

[lophophore]

relying on ssl is not a good idea at all. All it takes is a man-in-the-middle attack with a fake cert and game over. Apparently the Iranians have done this to spy on people using gmail.

Re:throw away laptops

[lophophore]

This is an interesting article: http://www.schneier.com/blog/archives/2012/02/computer_securi_2.html and highly relevant to this discussion... Read the linked article ( http://www.nytimes.com/2012/02/11/technology/electronic-security-a-worry-in-an-age-of-digital-espionage.html?_r=0 ) and all the comments.

Re:throw away laptops

[swillden]

relying on ssl is not a good idea at all. All it takes is a man-in-the-middle attack with a fake cert and game over. Apparently the Iranians have done this to spy on people using gmail.

Which is why Chrome (and ChromeOS) now know what the valid Google root CAs are. I seem to recall and article that said Chrome also recently started notifying the user when certificates change "unexpectedly" (old cert is unexpired, new one is from a different CA, etc. -- I don't recall what the heuristics were), so there's also some protection for non-Google certs. You can also manually check the identify of the CA that issued the cert being used and verify that it hasn't changed. If you want to be really sure, write down the fingerprints of the certs of the sites you're going to visit before you go, and then check them yourself. You could also pare down the list of accepted CAs.

Re:throw away laptops

[kaatochacha]

Even better, have the SSL site you connect to at the homesite only be accessible for the time you're in China, and have someone back there push/pull data from it while you're travelling, and only when you need it.
That way, even if they get your VPN password, there's nothing to find.

Re:throw away laptops

[Minupla]

Well it was a rather belts and suspenders plan. The platters were also encrypted, but we preferred to have as much plausible deniability as possible to avoid the 5$ wrench attack against crypto. (http://xkcd.com/538/) The exec REALLY wanted to avoid the 5$ wrench attack. :)

Min

solutions:

[wierd_w]

There are several ways around this, with increasing levels of overhead.

0) don't bring the laptop to begin with. (Hehe.. har.. yeah, who am I kidding?)

1) yank the HDD completely, boot the laptop using a custom knoppix DVD, with an RDP client. Save your work in the cloud/at the enterprise, behind a strong enterprise password. Malware magically vanishes when the laptop powers down. No local data to collect.

2) use something like black ice defender.

3) use whole disk encryption with almost reigious zeal.

Personally, I prefer the live dvd approach. It has fringe benefts of always being a fresh, clean environment, and a complete black hole for forensic data recovery. Only the rubber hose method to get you to reveal the RDP account password remains as a reliable method of intrusion, though this assumes you aren't an idiot, and weren't so stupid as to package a keyring on the live DVD. (The whole idea is to keep sensitive data OFF the system!) If you absolutey NEED a keyring, find some way to use an actual usb keyfob to store it, and always carry your keys.

Regardless of the method used, remember that allowing unauthorized persons access to the physical system is practically synonymous with being pwned. The live dvd method only gives them physical access to a terminal.

Re:solutions:

[couchslug]

I'd leave a "bait" hard disk so nothing looks amiss. It won't affect the live DVD or CD.

Your idea is a good one.

http://www.spi.dod.mil/lipose.htm

Re:solutions:

[gman003]

I was going to suggest something similar to #1, but there is one flaw: hardware attacks. If they can plant an actual keylogger in the keyboard, even this won't help. Although you might be able to obfuscate a bit - use a Dvorak layout, perhaps?

Re:solutions:

[Jeremi]

If they can plant an actual keylogger in the keyboard, even this won't help.

The trick is to bring a scale with you. Weigh your laptop before using it; if it's a bit heavier than usual, either you left a DVD in the drive or someone has added "special hardware" to it for you. ;)

Re:solutions:

[wierd_w]

Agreed. Ideally, the RDP server would be in an "untrusted" network segment, with write permissions ONLY to that untrusted remote user account, on a seperate physical volume and server from normal corporate data storage.

Hardware keylogger could be frustrated by using a pocketed keyring. That way the attacker only gets the keyring password, and not the enterprise password. Keyring needs to be on an encrypted volume, that is always physically on your person at all times. (Literally on your keychain, or in your wallet.)

The idea is compartmentalization, and barriers to entry. Your traveling businessman needs to be aware that he won't have access to all of his data, only to his email (dangerous enough as is), and a crippled remote user account on an "unloved" server set aside exclusively for that purpose.

The remote enterprise account would have your typical office suites he needs to build powerpoint presentations, make excel spreadsheets, send and receive emails, and any special purpose enterprise aps he may need access to on a case by case basis. Otherwise it is barren wasteland. Control access to data by requiring him to request files be placed into the user's private share as needed by IT on a request only basis.

When the business trip is over, policy should dictate that the remote access server be restored from an image backup, and the password changed. A virtual server would be ideal here.

Granted, the businessman will *HATE* it, and chafe miserably under the restrictions, but angry businessmen are better than the consequences of a compromised security situation.

The RDP equipped live DVD option presumes a sanely set up enterprise backend to connect to. The backend should be presumed untrustworthy, and segregated accordingly.

Re:solutions:

[Inda]

Your method wont work. The ones on the drive weigh more than the zeros.

And for that reason alone, I'm out.

Re:solutions:

[izzo nizzo]

I would suggest using an iPad (not jailbroken). You won't get access to the same software as a laptop would, but at least nothing can be stolen or installed. If you take the time to learn how to use one expertly, you can accomplish a lot with an iPad.

I wonder if this will work?

[roc97007]

You take a laptop to China. In your coat pocket is a "live" thumbdrive, which remains on you at all times. You don't care what's on the laptop, because you boot the thumbdrive to do work.

When you leave China, toss the (presumably compromised) laptop in a dustbin in the airport restroom.

Re:I wonder if this will work?

[lister king of smeg]

why toss it? you could give it to the kids to play flash games and minecraft on.

Re:I wonder if this will work?

[Lumpy]

"just follow the blood trail when you return"

You mean follow it to your torture cell? I dare you try that trick when you arrive in china.

Hell I dare yo to try that trick in the USA on the TSA guys.

Re:I wonder if this will work?

[roc97007]

I'm thinking because you don't want to connect it to a network (that you care about) until the disk is scrubbed and the bios is reflashed. (And perhaps, the back is taken off to make sure the box hasn't been physically compromised.) Laptops are, like, $200 apiece. Safer just to dump it.

Re:I wonder if this will work?

[roc97007]

...but let us know *when* and *where* you're going to try it, because that sounds like a youtube moment if I ever heard one.

Industrial espionage

[Taco Cowboy]

I travel all the time, for business.

China is not the only country where industrial cloak and dagger stuffs happen.

The other countries that I've personally encountered industrial espionage activities includes Japan, Korea, Vietnam, France, Italy, India, Indonesia, Egypt, Turkey, and you will be surprised, I had had similar encounters in Canada, UK, Australia, and also US of A, although not that often.

Re:Industrial espionage

[hendridm]

I've surprised by many of the countries on your list.

Can you give some examples of what you've observed that we non-travelers might find surprising/interesting?

Re:Industrial espionage

[nihaopaul]

Photos or it didn't happen!

Re:Industrial espionage

[DNS-and-BIND]

Industrial espionage is one thing. This is a government employee entering your hotel room to install software on your laptop and image your hard drive. It has been happening for years in China (but has just now made Slashdot). It is practically a signature move of theirs.

Re:Industrial espionage

[AaronW]

As you said, France is also notorious for this sort of thing which surprises a lot of people.

Re:Industrial espionage

[cheater512]

Makes you want to do something funny like boot up OS/2 or put up a fake boot up sequence resulting in massive crashes unless it is you booting your computer.

Bonus points if you activate the web cam and record the person's reaction.

Re:Industrial espionage

[CoderJoe]

How about just doing a boot-time truecrypt volume? They can't boot the system from the hard drive, and booting from a live CD/USB is also useless, as the data on the hard drive is encrypted. (unless they want to take the time to image the whole hard drive so they can work on cracking it elsewhere)

Re:Industrial espionage

[halofan_sd]

not being able to formulate a sentence without grammatical errors is a strong (actually, perfect) indicator that the speaker is a product of the American educational system.

Re:Industrial espionage

[RocketRabbit]

I'm sure your lack of experience in capital letters and their proper usage increases the public's perceived veracity in your experience with this subject.

Re:Industrial espionage

[FatdogHaiku]

Otherwise, moderatiors please mod his post -1 UNTRUE.

BEWARE!!! This plea for a -1 UNTRUE mod is a trap akin to the old "-1 BULLSHIT" proposals in days gone by... any attempt to apply this type of gradation to /. posts could result in a catastrophic failure of /. as we know it.

Re:Industrial espionage

[Zontar The Mindless]

The use of the awkward word "stuffs" has been, in my experience, a strong (actually, perfect) indicator that the speaker is Chinese.

I almost didn't post this for fear that the chicom astroturfers (you?) will adapt, but i think it's important to get the word out regardless.

Protip to westerners: keep your eyes open for awkwardly idiomatic phrases, especially when the speaker is defending China either directly or indirectly.

Protip to the other side: stuff is an uncountable plural word already. "stuffs" is just "stuff." it's like saying "mices."

I've been using "stuffs" from time to time as long as I remember. Native American English speaker here, not a bit of Chinese in my family, other than in-laws.

Now that I think of it, I've NEVER heard anyone but other Americans or Australians even use it.

Protip: My anecdote says your anecdote is full of crap.

Re:Industrial espionage

[aztracker1]

Or you could simply install linux, and not auto-load a graphical login, or X-windows by default.

Re:Industrial espionage

[bonniot]

Whilst in Vietnam, I found unsigned Ubuntu update packages coming down off an official mirror.

That would be worth reporting for investigation.

Re:Industrial espionage

[Savage-Rabbit]

Makes you want to do something funny like boot up OS/2 or put up a fake boot up sequence resulting in massive crashes unless it is you booting your computer.

Bonus points if you activate the web cam and record the person's reaction.

Why so elaborate? Just show the Goatse picture... It should yield some interesting photographs.

Re:Industrial espionage

[Idimmu Xul]

do the 2 words 'grub' and 'single' mean anything to you? ;)

Re:Industrial espionage

[rioki]

But even "cracking it elsewhere" is not such an easy task. If you use a strong password and store the boot loader on a removable drive that you carry arround I think you can be reasonably safe. Just take the data you really need and wipe the drive before connecting to the network back home, just for good measure.

Re:Industrial espionage

[JosKarith]

Unlikely, she died a decade ago you insensitive, necrophiliac bastard.

Re:Industrial espionage

[gelfling]

No not really since the French Secret Service openly and publicly states as part of its charter than one of its roles specifically IS corporate espionage inside and outside of France.

Re:Industrial espionage

[GuldKalle]

My dog can't formulate a sentence without grammatical errors. Has he been educated in the US?

Re:Industrial espionage

[AmiMoJo]

Actually the GP is on to something there. Chinese, Japanese and Korean don't have plural versions of words. The concept just doesn't exist in those languages, so they seem to find it hard to get right in English. As you point out native English speakers do too, just like we have trouble with irregular verbs ("goed" is my favourite).

So while incorrect use of plural forms is not any indication of race or native tongue it is fair to say that people who are native speakers of languages that don't have plurals find them harder to grasp.

Re:Industrial espionage

[Electricity Likes Me]

How does this protect you against anything?

You're still vulnerable if they replace the bootloader with say, a Truecrypt lookalike (the evil maid attack, which is what this refers to).

Re:Industrial espionage

[bkr1_2k]

Your experiences are far from perfect. I can count at least 15 native English speakers, born in the USA who say "stuffs" all the time. It annoys the hell out of me, but there you have it.

Re:Industrial espionage

[Aaden42]

See Bruce Schneier's "Evil Maid" described elsewhere on this thread. Encrypted volumes don't protect against an attack at the bootsector level. http://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html

Subvert the bootsector, wait for the mark to key in the password, and store it for later in the clear. Maid returns the next day, collects the password, optionally images the disk. Done.

Re:Industrial espionage

[Captain_Chaos]

"Veracity"... You keep using that word... I do not think it means what you think it means.

Re:Industrial espionage

[Nethead]

I've been using "stuffs" from time to time as long as I remember. Native American English speaker here, not a bit of Chinese in my family, other than in-laws.

I live on a Native American (Indian) reservation and I never hear "stuffs." I'm not even sure there is a Lushootseed word for it.

Re:Industrial espionage

[FictionPimp]

Factor of two authentication? Truecrypt supports that. Carry a few identical usb keys on a ring in your pocket full of random mp3 files. Use one as your key that goes with your password.

Re:Industrial espionage

[FictionPimp]

By identical I mean in look, but not files. You just have to know which one, they have to try all of them (and get the password and steal the usb keys).

Re:Industrial espionage

[dywolf]

your anecdote about using a word incorrectly only proves that your vocabulary needs improvement.

Re:Industrial espionage

[Wolfrider]

One solution: Have at least (1) person in the room at all times - like an assigned "bodyguard" for your laptop/data.

Another solution: Do all of your work over a secure VPN, save nothing locally, and re-image the laptop nightly from known-good backups that you carry on your person at all times.

Yet Another solution: Sue the ever living shiat out of the hotel for poor security.

Re:Industrial espionage

[TimMD909]

Another indication: only the word "America" is capitalized.

Re:Industrial espionage

[jonadab]

> The use of the awkward word "stuffs" has
> been, in my experience, a strong (actually,
> perfect) indicator that the speaker is Chinese.

Not Chinese specifically, just foreign in general. Foreign-language dictionaries and textbooks frequently don't bother to point out that certain words are mass nouns, and even if they do foreign-language learners don't always take note of it and mark it on their vocab cards, and even if they do they don't always remember.

Mass nouns that have a physical reason to be mass nouns (e.g., "water", "wood", "metal") are less of a problem, but the ones that refer collectively to obviously discrete things are a frequent source of trouble. "Staff" and "stuff" are among the ones that come up particularly often, but English has hundreds of mass nouns (some of which are pretty much always mass nouns, and others are only mass nouns when used with certain meanings; there are also some that can just be used either way). Native speakers don't usually think about these words as being significantly different from other nouns, but grammatically they really are. (Hang out with foreign language learners enough, and you will start to notice all sorts of interesting things about English. It's enlightening, actually.)

Admittedly, English mass nouns are particularly troublesome for native speakers of languages that ordinarily don't have grammatical number at all (e.g., Japanese), because they have had to get into a habit of forcing themselves, every single time they write a noun, to stop and think about whether it's just one or more than one (otherwise they end up writing things like "My two younger brother both goes to college."), something that comes natural to native speakers of languages that have a singular/plural distinction, and so keeping track of this can become an added distraction that makes it easier to forget about mass nouns. But native speakers of other languages (e.g., European languages, virtually all of which inflect nouns for case, number, and gender) do also make the mistake of pluralizing mass nouns inappropriately. It's not quite as frequent for them, but it's far from rare. It happens because people who have not yet achieved full fluency tend to think in their native language and then translate by components, adjusting the word order as necessary, translating the words into the other language, and so forth, whatever is needed to go from the one language to the other. If the English word that's a mass noun is a translation for a word in the person's native language that's not special in that way, this can easily result in an extraneous pluralization.

(I hang out on Lang-8, so I have had some exposure to English written by native speakers of various other languages.)

Re:Industrial espionage

[jonadab]

You can, of course, deduce things about a person's linguistic background by noticing what kinds of mistakes they make. Some examples...

* Consistently confusing certain phonemes with one another even though they in fact sound nothing alike at all is a strong indicator that the native language doesn't contain either of them. Japanese people, for example, have a terrible time with English short vowels, particularly the a in "bad" and the u in "bus". This is because Japanese does not have these sounds. (Technically, the a in "bad" does occasionally occur in spoken Japanese, but it's a minority allophone in free variation for the a in "father". The u in "bus" does not occur at all.) Hence, "Pizza Hat". English speakers have a horrible time with glottal and pharyngeal stops, for the same reason.

* Consistently substituting certain words for certain other words in certain contexts where they don't make sense can mean that the native language has a word that is translated both ways. For example, using the word "teach" in place of "tell" ("Please, don't keep me in suspense. Teach me what happened!") is characteristic of Japanese. Saying "walk" instead of "live" (particularly when referring to living one's life a certain way) is characteristic of Greek (or of spending a lot of time reading old, sub-optimal English translations of things originally written in Greek; notably, the New Testament). English speakers often mix up ser and estar (in Spanish, and the corresponding verbs in other languages) and have trouble remembering which Japanese verbs to use to talk about wearing various kinds of clothing.

* Consistently confusing pairs of otherwise-related phonemes distinguished by the same type of contrast is a very strong indicator that the person's native language doesn't contrast on that feature. Koreans, for instance, have difficulty with the voiced/unvoiced distinction. English speakers have a similarly hard time hearing the distinction between aspirated and unaspirated.

* Having trouble with grammatical gender -- especially if it's inconsistent, not always getting the same words wrong in the same way, but different mistakes each time -- is an indication that the native language probably does not have grammatical gender. This doesn't apply much to English, since English has very little gender left in it.

* Attempting to pluralize adjectives when modifying plural nouns is a very strong indication that the person's native language does that. (This is characteristic of most European languages, with English being a notable exception.)

* If the target language is tonal, a native speaker can usually tell whether another speaker's native language is also tonal or not. This doesn't apply to English, obviously.

I'm sure there are others, but that's enough to illustrate the concept.

Preposition mistakes generally mean nothing, especially selecting the wrong preposition to introduce a prepositional phrase. Everyone makes them, and preposition usage varies so much even among dialects within a language that you can't usually draw firm conclusions. Frequent failure to correctly match up verbs with the complementary prepositions they prefer is a strong indication of a non-native speaker, but even this doesn't usually tell you very much about which other language they're coming from.

Re:Industrial espionage

[jonadab]

> I've been using "stuffs" from time to time as long as I remember.

Native speakers instinctively use the words "stuffs" correctly, to refer to different categories of stuff. Foreign language learners just forget that "stuff" is a mass noun sometimes and use it as a synonym for "thing".

"There three stuffs we are remember for a good world." Dead giveaway: non-native speaker. (Yes, this is a constructed example. A real-world example would in most cases have fewer dead giveaways per sentence. See if you can spot the other ones, besides "stuffs".)

(This is not unique to Chinese. In fact, I am not aware of any specific linguistic background, other than English of course, that would make someone immune to this mistake. I've seen Chinese speakers do it, but also Japanese, Portuguese Polish, Italian, ...)

Re:Industrial espionage

[Zontar The Mindless]

All other things being equal, there's a roughly 90% chance that my vocabulary is larger than yours.

OTOH, I like have fun occasionally. With words, too.

Re:Industrial espionage

[Zontar The Mindless]

Since you bring it up, I have some Cherokee and Blackfoot ancestry (although I'm predominantly WASP).

But it was intended to be parsed as "Native speaker of American English".

They don't know your password

[Anonymous Coward]

So how do they get in and install stuff?

Re:They don't know your password

[zerro]

Chinese AC troll?

Sources Please?

[Anonymous Coward]

I see a lot of unsubstantiated opinions. How about some credible sources that this is happening?

Re:Sources Please?

[zerro]

FTW: global warming is a hoax!!!

http://www.schneier.com/blog/archives/2012/02/computer_securi_2.html

http://www.homelandsecuritynewswire.com/us-government-recommends-weighing-laptop-and-after-visit-china

Re:Sources Please?

[zerro]

http://www.washingtonpost.com/world/national-security/in-china-business-travelers-take-extreme-precautions-to-avoid-cyber-espionage/2011/09/20/gIQAM6cR0K_story.html

Re:Sources Please?

[sydneyfong]

These links only prove some people are paranoid.

They don't prove anything actually happened aside of what the world already knows (and things that the Chinese government readily admits to) -- GFW, agents monitoring the internet, etc.

Agents physically breaking into your hotel room and installing keyloggers? I don't think they're rich enough to pay all the people to do that for the average travelling businessman.

Re:Sources Please?

[spmkk]

Agents physically breaking into your hotel room and installing keyloggers? I don't think they're rich enough to pay all the people to do that for the average travelling businessman.

You'd be surprised how many average people the KGB was rich enough to assign agents to.

Re:Sources Please?

[sydneyfong]

And thus the Soviet Union collapsed....

business people in strange foreign lands

[Anonymous Coward]

The best thing to use is and Ironkey with a virtualized OS using a product like Moka5. Moka5 does not use any memory on the host and ensures that no keyloggers are in place. Ironkey is a DOD level security memorystick which will kill its self if a person violates the rules you set on the web. If you were to loose the stick the next time its on the internet it will contact the ironkey host and lock itself up and or wipe itself.

Or Windows '98

[kawabago]

and infect them right back!

Re:Or Windows '98

[RabidReindeer]

How about Windows 95 with Microsoft Bob?

I think that's a violation of the Geneva Convention.

Re:Or Windows '98

[grcumb]

How about Windows 95 with Microsoft Bob?

I think that's a violation of the Geneva Convention.

No, the Geneva Conventions covers prisoners of war.

The treaty you're thinking of is the Berkeley Convention of Dude That's Really Not Cool.

Re:Or Windows '98

[rvw]

How about Windows 95 with Microsoft Bob?

I think that's a violation of the Geneva Convention.

Yeah and the Windows Search Puppy is not safe either in China when it ends up on the menu (thanks to Clippy).

Passwords and encryption

[bobjr94]

At minimum a good windows log on password, bios set to not boot from cd & usb drives and a bios password will stop most entry level snoopers. If your worried, take your battery and PS with you in a backpack or keep them in a friends/co workers room. Bring a small motion activated spy cam to leave in your room, see if your fears are true. Keep your data encrypted or have someone back in the office email (encrypted files) it to you, or get it off your companies secure servers before your meeting.

I have a solution....

[Lumpy]

Dont bring a standard laptop. You can easily outsmart them.

Grab a ARM based laptop (chromebook) and install linux. The China spooks will not have any clue as to why their spyware is not running.

Shining passive security

[Grayhand]

Just encrypt your actual work files then leave one unencrypted on the desktop called "Work Documents". Inside each file contains an endless string of the text "All work and no play makes Jack a dull boy"". Hundreds and hundreds of files all with the same repeated text. Not only will they avoid your room but you can tell who was doing the spying, they're the maid that turns and runs when they see you in the hallway.

Re:Use BIOS Password and PGP Encryption for hard d

[hobarrera]

Or any other form of encryption for that matter - I see no reason to use PGP in particular.

Re:Shred of Evidence

[dtmos]

See the sad case of Prof. John Roth, of the University of Tennessee.

Silly

[Charliemopps]

We don't even have people that travel outside the country and yet your security standards state that:
A. The laptop is wiped and re-imaged upon return. Every time.
B. The user simply uses the laptop to VPN into our corporate network which is protected by a random keyfob plus all the usual security.
C. Corporate laptops never leave the site of the user. You take it with you everywhere you go. Period.

Granted, I don't think C gets followed all that much. But A and B are pretty solid. Who the hell keeps a personal laptop for work anymore?

Chromebook!

[kurt555gs]

Nothing else to say.

Hardcore Security Fix.

[Deathlizard]

1) Buy this: http://www.newegg.com/Product/Product.aspx?Item=N82E16822168002
2) Get a Laptop that has A TPM. Preferably a Panasonic Toughbook or Dell Latitude. Put Drive from #1 in it. (or better yet. Buy the system with a Encrypting hard drive built in.)
3) Encrypt the hard drive. I don't care how, either with bitlocker or Truecrypt.
4) Set your laptop to boot from ONLY the Hard drive in the BIOS
5) Password protect the hard drive at the BIOS level. also password the bios.
6) Backup your system (Preferably, Using A Drive form #1). put backup in a safe deposit box. set a Password on that drive or backup file if you can. Do this monthly like clockwork or a hard drive crash will screw you.
7) If uber paranoid, look into a BIOS Level remote protection system such as computrace or Lojack to remote wipe the PC, but considering who you're dealing with, most likely it will never see the internet again, but its good to thwart casual theves.

Encryption: Not allowed

[jabberwock]

From The New York Times in February:

Both China and Russia prohibit travelers from entering the country with encrypted devices unless they have government permission.

Re:Encryption: Not allowed

[BenEnglishAtHome]

The same is true of France. In fact, I think they were the first to adopt that policy; it's been several years.

Low-tech solution?

[NewtonsLaw]

How about just carrying some of those "warranty void" stickers with you and place one so that it bridges the keyboard and screen on the opposite edge to the hinge.

Now the "maid" can't open your laptop without knowing their intrusion would be very obvious to the owner.

I wonder if they still would?

They must have learned them from the USA

[deodiaus2]

Just as when Nixon died, I asked, "From whom are the next generation of politician going to learn?"

So, turn full-disk encryption on.

[jcr]

I do that with any portable machine I use, all the time. Why would anyone not do so?

-jcr

Throwaway laptop, Linux LiveCD, SSH

[Swampash]

You're welcome

Full hard drive encryption

[fufufang]

If you use Windows, you can install Truecrypt, and change the bootloader so it shows "Operating System Not Found".

If you use Linux, set up encrypted LVM, and have your boot partition on a separate USB flash drive, which you attach to your keyring, and carry around with you all time.

Re:Full hard drive encryption

[Selur]

Hdd ecryption is a must + don't forget to also have a look at your tablet and other entertainment travel stuff that is basically a pc,..

Half-FUD, Half-Fluff piece

[lucm]

There is no actual information in that article. Some dude says: a lot of business people go to China and come back with spyware, but nobody finds the spyware or when they find it they don't report it... So how the fuck does that guy know it actually happens?

That's the paid expert version of Baghdad Bob or Tokyo Rose, only instead of doing propaganda for a country it's just for ads and traffic. Lame.

Re:Half-FUD, Half-Fluff piece

[i]

Lets put it this way: Why would the Chinese *NOT* do as the article implies ? Assuming competence, there is in their own interest to do just his.

Re:Half-FUD, Half-Fluff piece

[lucm]

Articles about things other people would not not do is not news, so following your logic the new Slashot tagline should be "Fiction for nerds. Stuff that we made up but could definitely happen". I have no problem with Slashdot pivoting but someone should come out and say it.

Surprised no footage

[farnsaw]

I'm surprised nobody has video recorded this actually happening and posted it to YouTube. You would think a repeat visitor would have brought along a Nanny-Cam or some such.

troll them

[Lehk228]

Troll like a pro, carry lots and lots of "super sekrit" docs in a poorly truecrypted volume (password on a sticky note under the mouse)

gigabytes and gigabytes of detailed looking prototype data from your projects that failed due to a fatal and truly unsolvable flaw, but fudge the data and info to mask the unsolvable part

bonus points for anything that will cost them 100 million to fail to reproduce
more bonus points at the billion, 10 billions and 100 billion level

cold fusion, hot fusion, electric vehicle, atomic reactors, there must be trillions of dollars worth of hopelessly flawed design proposals kicking around collecting dust in company archives. -- Put them to good^H^H^H^HLulzy use

Re:troll them

[Blue Stone]

Beautiful.

*wipes tear from eye*

Ha Ha!

[Greyfox]

That was all just a part of my master plan! Now our poor business process and software design will destroy them from the inside! Had they just opted to design their software on their own, they wouldn't have been plagued by our constant bugs, server crashes, database outages or our pathetically slow storage capabilities! I have single-handedly set the Chinese software industry back by two decades! Muahahhahahaha! Plus their operatives should enjoy the two gigabytes of furry, zombie and skeleton porn I loaded onto the system in advance. Because I knew they'd be digging through it. Yeah...

Use Local Knowledge

[IonOtter]

Put your laptop in a metal briefcase. Modify the briefcase to have a dark blue light on it that slowly pulsates.

On the top, put: Chinese text for "Dangerous - deadly voltage". The dark blue light is a color associated with death, mourning and funerals. Red, on the other hand, is considered very lucky. That's a detail that will stick in their minds like a splinter under your nail.

It won't stop them of course, but it might give them a bit of a pause. Of course, if you actually follow through and hook a taser up to the thing, you're gonna have some very frizzy, highly pissed off Chinese security agents wanting to speak with you.

Re:Use Local Knowledge

[RivenAleem]

You could combine that with one of the posts above:

If you use Windows, you can install Truecrypt, and change the bootloader so it shows "Operating System Not Found".

Build in a little smoke canister into the case, triggered on opening (unless you press a non-descript button on the side) and when they open it it goes *poof* then displays "Operating System Not Found" when they try to boot it. Now they think that they fried the HDD when they opened the case.

Re:Use Local Knowledge

[cheros]

Hmm, what makes you so confident you will even get on a plane with something like that?

I had to abandon a perfectly functional Samsonite briefcase for travel because it had a digital lock - it was guaranteed to get me selected for screening because it had batteries and electronics.

It was a shame, because that lock was so good it managed to withstand an entire weekend of London's hacker weekend "Access All Areas" a good decade ago (mainly because the person who patiently tried entering "0000" to "9999" based his attempts on a flawed assumption, but I digress) despite it having a very basic flaw..

MSDOS 3.11 and a Flash drive

[farnsaw]

Just partition the HD, install MSDOS 3.11 and set it as the default boot. Make your 2nd partition nothing but randomized noise. Setup camera and prepare to send to AFV... Then carry an encrypted Flash drive and let it boot your OS of choice. Don't ever let the flash drive out of your sight. Be sure to scrub your laptop prior to reusing it once you are back home, or just throw it out.

Re:MSDOS 3.11 and a Flash drive

[fido_dogstoyevsky]

"Computer Scientists can count to 1023 on their fingers" (non-mutant, non-mutilatated, human computer scientists

FTFY [/pedant]

Re:Shred of Evidence

[RocketRabbit]

Well it appears that he chose to "employ" spies and then give them controlled technology. It's hardly sad when one is busted for near-treasonous activities.

Full disc encryption

[Anonymous Coward]

I work for a major multi-national corporation with big interests in China. Every transportable computer in the company has strong full-disc encryption installed by default, and NO ONE is allowed to divulge the ID/password required to boot it. If you are going to travel internationally, you back up your system before you leave. If some border agency demands the keys to your kingdom, you give them the laptop, but not the keys. Then the company ($40+B and major presence in every country) will bang on a few heads until the system is returned and some poor schlub is hung out to dry...

Re:Full disc encryption

[thelukester]

Finally,a knowledgeable post. Executives won't be bothered to use burner laptops or fresh installs, never-mind bootable CD Linux install. Any IT admin would be fired for trying such a stunt. As someone who's HD crashed while traveling in Vienam and was forced to use a bootable linux CD for a few days, it was a MISERABLE experience. Anytime you do anything in the OS, you have to wait seconds for the system to respond. No businessman traveling to Asia would put up with that.

Fully encrypted laptop and if you're really extremely concerned with security, give them a system "upgrade" after their trip. That's the only reasonable solution to this real threat.

Re:Full disc encryption

[Lincolnshire Poacher]

NO ONE is allowed to divulge the ID/password required to boot it

That's a lovely idea, but unfortunately local laws such as the UK's RIPA trump corporate rules.

Given a choice between five years for contempt of court ( refusing to divulge password ) or being noble... which would you choose?

Re:This happens everywhere, not just China...

[Reschekle]

Yeah this stuff happens everywhere but China is like the world's capital of industrial espionage. It happens by several orders of magnitude more in China than any other place.

Re:Shred of Evidence

[Man On Pink Corner]

US export law is no joking matter. It is impossible to exaggerate how goofy the rules are, and how much trouble you can get in for violating them. It doesn't matter if you're a hacker in a basement or a Fortune 100 defense contractor -- you do not want to mess around with these people.

Some examples of the evidence you're asking for.

More here. I think my favorite is the veterinary supply wholesaler in Waukee, Iowa who was fined $250,000 for sixteen unlicensed exports of cattle prods to Mexico.

USA does the same as China.

[Anonymous Coward]

Well, when travelling to the US, I have been asked at customs to unlock my (corporate-owned) laptop. It was then taken away for 20m before being returned to me. I wonder what customs did with it during that time; they would not say.

Yeah

[bytesex]

We have the same problem. With an obscure little country called the USA.

Sorry, but the hypocrisy is staggering. We are NOT allowed to even bring an encrypted laptop across US borders.

At Least China Won't

[fullback]

confiscate your laptop like the U.S. does at the border.

Simple solution?

[jackjumper]

Lock your laptop in a hard case while you're out.

Are you serious?

[Krneki]

Who is the idiot that leaves the laptop with sensible info not password protected and data encrypted?

And how this differ from sensible documents not being physically secured from 3rd party?

Why isn't the US doing the same?

[benjfowler]

Allegedly, the US, unlike China, does NOT use government resources to do economic espionage to help American business, which strikes me as bizarre.

If they aren't -- they should be. Certainly if I were in charge, I'd be making the intelligence community earn their keep.

Further

[argStyopa]

Instead of just a "China laptop" that's a throwaway, I would imagine it would be interesting to have deep-installed monitoring software, stuff that can sit under the OS and record precisely what happens and when, even to the point of taking a surreptitious webcam pic of whoever is messing with your laptop.

Re:Shred of Evidence

[supercrisp]

That's a very unfair characterization of Roth's actions. He employed two graduate students, one from China and then one from Iran. He had the Chinese student send him a file while he, Roth, was in China, at a Chinese professor's e-mail address. The material in the file was deemed sensitive, as was the research. I think the professor ended up in prison primarily because he didn't understand that the FBI didn't appreciate him speaking with the professorial authority, like Moses from the mountain, that he was accustomed to use in his lab and within his field of study. but he did not hire spies, at least knowingly, not that anyone knows. And, I'll just drop this in: If I were a professor in the sciences I can imagine that I might want to employ non-American grad. students. I worked with and was friends with grad. students in the STEM fields, and there were a lot of "foreign" ones, and many of those foreign ones were much harder working than the American ones, many of whom seemed to think that grad. school was just more undergrad. school.

48 hours?

[gstovall]

Wow, you have slow digestion.

My evening meal reappears the next morning...

What's the problem?

[tehcyder]

The Chinese are only copying data, not "stealing" anything. At worst it's copyright infringement, and we all know that copyright infringement!=theft.

Bring a fake laptop

[morgauxo]

If I were in a position to travel to a place this was likely to happen and with important secrets (business or other) I wouldn't just not leave a laptop lying around... I'd leave a laptop with fake information. It would have bad designs, bad formulas, bad business strategies whatever fit my position. It would all be designed to fail on purpose. Remember all the bad capacitors?

Why just keep your competitors out of your stuff when you can do so much more? It serves them right if they are trying to steal from you in the first place!

Some advice here could get you thrown in jail

[onyxruby]

I see a lot of people here talking about encrypting the laptop using truecrypt. live boot cd's etc or any number of other 'technical' solutions. Depending on the country you go to that could get you thrown in jail.

Remember, guns and jail time trump policy and technical expertise.

There are some practical consideration to take such as reviewing whether or not you have anything in terms of software or data that could run foul of export controls. You also need to assume that any data on your laptop will be copied. You also need to assume that your password will be obtained by a key logger or other means.

The easiest way to do things is to have a loaner pool of laptops that /never/ touch the corporate network. To make it easier to differentiate them I would suggest using a different model or make than you use elsewhere in your company. When it comes time to travel you have a laptop pre-configured by your IT department with only the bare minimum software and data that you need and is safe for legal purposes (foreign and domestic).

When you return the laptop is wiped and BIOS reset and it never touches the corporate network. Same thing for flash drives. The same thing /needs/ to happen with any passwords that you have.

If your extra paranoid you can weigh your laptop before and after the trip to see if a hardware keylogger is installed. Laptop models vary but the components inside are often common and a keylogger for one keyboard ribbon would likely work on a wide range of models from multiple vendors.

You can also configure your VPN to bring you to a sandbox server that is firewalled off from the rest of the network. That way if someone gains your credentials or steals your laptop they can't log in as you and start wholesale downloads of data using your credentials.

Remember as well that all of this advice applies just as much to your cell phone as it does to your laptop!

Re:Shred of Evidence

[dtmos]

Keep in mind that his grad students were the ones that created the controlled technology in the first place, while working in his lab, and there is no evidence (nor any accusations made by the Prosecutor at his trial) that his students ever surreptitiously transferred the controlled technology outside the US. As another commenter notes elsewhere, it's impossible to exaggerate how goofy the rules are, and Prof. Roth ignored the "obviously illogical and irrational" regulations -- to his detriment.

And if you think he "chose" to employ foreign citizens as grad students, you haven't visited a US science, technology, engineering, or math graduate school since, say, 1980 or so. The ratio of foreign citizens to US citizens among the electrical engineering doctoral students at a major US state university with which I am familiar is approximately 20:1.