Slashdot Mirror
The Trouble With Bringing Your Business Laptop To China
snydeq writes "A growing trend faces business executives traveling to China: government or industry spooks stealing data from their laptops and installing spyware. 'While you were out to dinner that first night, someone entered your room (often a nominal hotel staffer), carefully examined the contents of your laptop, and installed spyware on the computer — without your having a clue. The result? Exposure of information, including customer data, product development documentation, countless emails, and other proprietary information of value to competitors and foreign governments. Perhaps even, thanks to the spyware, there's an ongoing infection in your corporate network that continually phones home key secrets for months or years afterward.'"
The other -- and, I would submit, more important -- reason for not taking your business laptop to China (if you're from the US) is US export control laws. The definitions of "export" and "controlled technology" have been so generalized that it is an even-money bet that the laptop of a given technologist contains information that, were he to travel to China, would result in at least a technical violation of the law -- and the penalties are severe.
Take a TRS-80 and watch them try to figure it out.
A feeling of having made the same mistake before: Deja Foobar
Why doesn't your business mandate HDD encryption?
China isn't the only place this goes on...
Who leaves their business secrets in the open. Especially laptops, they get lost stolen, or as the article says people examining it. Really you can use a truecrypt container and hide it somewhere.
If you are travelling anywhere without HDD encryption, then you kinda deserve this. By the way, let's see them trying to put spyware on a PowerPC Linux laptop. :)
They're there in their room. You're on your own.
http://www.schneier.com/blog/archives/2009/07/laptop_security.html
https://www.eff.org/wp/defending-privacy-us-border-guide-travelers-carrying-digital-devices
I had this problem when I was doing work with associates in China when I was working to develop some software to use there. After going out one night I noticed the next day my laptop had been gotten into. Sure they poked around, but I didn't care. Not stupid enough to actually bring any data physically there with me. Checked the machine for anything funky, but seemed he was poking around to copy any interesting data. In the end they ended up trying to screw us & do the job we were doing which was they found really hard without our actual software in their hands. We just ran pointers that always pushed data from China back to the US where we churned through the data because I was a paranoid maniac. Sucks the company went under due to them, but felt a sort of sick satisfaction they ended up looking really dumb when everything ground to a halt suddenly.
the laptop battery goes critical on bootup
Nah. Dell tried that already..
Insert
Any serious exec is going to use a throw-away laptop for travelling to China. A $400 special will keep you online abroad, and then it can be destroyed as a business expense. Cheap insurance against hacking.
there are 3 kinds of people:
* those who can count
* those who can't
There are several ways around this, with increasing levels of overhead.
0) don't bring the laptop to begin with. (Hehe.. har.. yeah, who am I kidding?)
1) yank the HDD completely, boot the laptop using a custom knoppix DVD, with an RDP client. Save your work in the cloud/at the enterprise, behind a strong enterprise password. Malware magically vanishes when the laptop powers down. No local data to collect.
2) use something like black ice defender.
3) use whole disk encryption with almost reigious zeal.
Personally, I prefer the live dvd approach. It has fringe benefts of always being a fresh, clean environment, and a complete black hole for forensic data recovery. Only the rubber hose method to get you to reveal the RDP account password remains as a reliable method of intrusion, though this assumes you aren't an idiot, and weren't so stupid as to package a keyring on the live DVD. (The whole idea is to keep sensitive data OFF the system!) If you absolutey NEED a keyring, find some way to use an actual usb keyfob to store it, and always carry your keys.
Regardless of the method used, remember that allowing unauthorized persons access to the physical system is practically synonymous with being pwned. The live dvd method only gives them physical access to a terminal.
You take a laptop to China. In your coat pocket is a "live" thumbdrive, which remains on you at all times. You don't care what's on the laptop, because you boot the thumbdrive to do work.
When you leave China, toss the (presumably compromised) laptop in a dustbin in the airport restroom.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
I travel all the time, for business.
China is not the only country where industrial cloak and dagger stuffs happen.
The other countries that I've personally encountered industrial espionage activities includes Japan, Korea, Vietnam, France, Italy, India, Indonesia, Egypt, Turkey, and you will be surprised, I had had similar encounters in Canada, UK, Australia, and also US of A, although not that often.
Muchas Gracias, Señor Edward Snowden !
I see a lot of unsubstantiated opinions. How about some credible sources that this is happening?
Chinese AC troll?
and infect them right back!
See the sad case of Prof. John Roth, of the University of Tennessee.
We don't even have people that travel outside the country and yet your security standards state that:
A. The laptop is wiped and re-imaged upon return. Every time.
B. The user simply uses the laptop to VPN into our corporate network which is protected by a random keyfob plus all the usual security.
C. Corporate laptops never leave the site of the user. You take it with you everywhere you go. Period.
Granted, I don't think C gets followed all that much. But A and B are pretty solid. Who the hell keeps a personal laptop for work anymore?
Well... that explains why the HOT HORNY MAID never showed up... she got canned so they could insert their perfidious data thief in her place! Damn. Someone should update the Asian Porn section of the internet so travelers aren't disappointed...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
1) Buy this: http://www.newegg.com/Product/Product.aspx?Item=N82E16822168002
2) Get a Laptop that has A TPM. Preferably a Panasonic Toughbook or Dell Latitude. Put Drive from #1 in it. (or better yet. Buy the system with a Encrypting hard drive built in.)
3) Encrypt the hard drive. I don't care how, either with bitlocker or Truecrypt.
4) Set your laptop to boot from ONLY the Hard drive in the BIOS
5) Password protect the hard drive at the BIOS level. also password the bios.
6) Backup your system (Preferably, Using A Drive form #1). put backup in a safe deposit box. set a Password on that drive or backup file if you can. Do this monthly like clockwork or a hard drive crash will screw you.
7) If uber paranoid, look into a BIOS Level remote protection system such as computrace or Lojack to remote wipe the PC, but considering who you're dealing with, most likely it will never see the internet again, but its good to thwart casual theves.
In Soviet Russia, Trojan exploits YOU!
From The New York Times in February:
Both China and Russia prohibit travelers from entering the country with encrypted devices unless they have government permission.
How about just carrying some of those "warranty void" stickers with you and place one so that it bridges the keyboard and screen on the opposite edge to the hinge.
Now the "maid" can't open your laptop without knowing their intrusion would be very obvious to the owner.
I wonder if they still would?
If you use Windows, you can install Truecrypt, and change the bootloader so it shows "Operating System Not Found".
If you use Linux, set up encrypted LVM, and have your boot partition on a separate USB flash drive, which you attach to your keyring, and carry around with you all time.
Troll like a pro, carry lots and lots of "super sekrit" docs in a poorly truecrypted volume (password on a sticky note under the mouse)
gigabytes and gigabytes of detailed looking prototype data from your projects that failed due to a fatal and truly unsolvable flaw, but fudge the data and info to mask the unsolvable part
bonus points for anything that will cost them 100 million to fail to reproduce
more bonus points at the billion, 10 billions and 100 billion level
cold fusion, hot fusion, electric vehicle, atomic reactors, there must be trillions of dollars worth of hopelessly flawed design proposals kicking around collecting dust in company archives. -- Put them to good^H^H^H^HLulzy use
Snowden and Manning are heroes.
I work for a major multi-national corporation with big interests in China. Every transportable computer in the company has strong full-disc encryption installed by default, and NO ONE is allowed to divulge the ID/password required to boot it. If you are going to travel internationally, you back up your system before you leave. If some border agency demands the keys to your kingdom, you give them the laptop, but not the keys. Then the company ($40+B and major presence in every country) will bang on a few heads until the system is returned and some poor schlub is hung out to dry...
US export law is no joking matter. It is impossible to exaggerate how goofy the rules are, and how much trouble you can get in for violating them. It doesn't matter if you're a hacker in a basement or a Fortune 100 defense contractor -- you do not want to mess around with these people.
Some examples of the evidence you're asking for.
More here. I think my favorite is the veterinary supply wholesaler in Waukee, Iowa who was fined $250,000 for sixteen unlicensed exports of cattle prods to Mexico.
We have the same problem. With an obscure little country called the USA.
Sorry, but the hypocrisy is staggering. We are NOT allowed to even bring an encrypted laptop across US borders.
Religion is what happens when nature strikes and groupthink goes wrong.
That's a very unfair characterization of Roth's actions. He employed two graduate students, one from China and then one from Iran. He had the Chinese student send him a file while he, Roth, was in China, at a Chinese professor's e-mail address. The material in the file was deemed sensitive, as was the research. I think the professor ended up in prison primarily because he didn't understand that the FBI didn't appreciate him speaking with the professorial authority, like Moses from the mountain, that he was accustomed to use in his lab and within his field of study. but he did not hire spies, at least knowingly, not that anyone knows. And, I'll just drop this in: If I were a professor in the sciences I can imagine that I might want to employ non-American grad. students. I worked with and was friends with grad. students in the STEM fields, and there were a lot of "foreign" ones, and many of those foreign ones were much harder working than the American ones, many of whom seemed to think that grad. school was just more undergrad. school.