Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Trouble With Bringing Your Business Laptop To China

Posted by Soulskill on from the laptops-are-the-panda's-favorite-food dept.

snydeq writes "A growing trend faces business executives traveling to China: government or industry spooks stealing data from their laptops and installing spyware. 'While you were out to dinner that first night, someone entered your room (often a nominal hotel staffer), carefully examined the contents of your laptop, and installed spyware on the computer — without your having a clue. The result? Exposure of information, including customer data, product development documentation, countless emails, and other proprietary information of value to competitors and foreign governments. Perhaps even, thanks to the spyware, there's an ongoing infection in your corporate network that continually phones home key secrets for months or years afterward.'"

48 of 402 comments (clear)

  1. That's only one of the problems by dtmos · · Score: 4, Interesting

    The other -- and, I would submit, more important -- reason for not taking your business laptop to China (if you're from the US) is US export control laws. The definitions of "export" and "controlled technology" have been so generalized that it is an even-money bet that the laptop of a given technologist contains information that, were he to travel to China, would result in at least a technical violation of the law -- and the penalties are severe.

    1. Re:That's only one of the problems by ZorinLynx · · Score: 3, Interesting

      Considering these laptops are for the most part manufactured in China anyway, how does bringing them back there in anyway give China access to any "controlled technology" they don't already have?

    2. Re:That's only one of the problems by DragonWriter · · Score: 5, Informative

      Considering these laptops are for the most part manufactured in China anyway, how does bringing them back there in anyway give China access to any "controlled technology" they don't already have?

      Controlled technology includes software as well as hardware.

    3. Re:That's only one of the problems by dtmos · · Score: 4, Informative

      how does bringing them back there in anyway give China access to any "controlled technology" they don't already have?

      It's the information the technologist has stored on it that is the problem. The export control laws are enforced by the Bureau of Industry and Security, and they are arcane, complex, and woefully out of date. Just to give one example, if you're a microprocessor designer, and have a design that operates at temperatures exceeding 125C, that design is controlled; carrying that design in your laptop when you go to China is a violation of the law -- whether or not it is even accessed while in China. (It's also illegal to show that design to any person of Chinese citizenship, even if you both are in the US at the time; that, too, is considered export under the law.)

    4. Re:That's only one of the problems by neyla · · Score: 4, Interesting

      True !

      Fun Fact

      encryption*SOFTWARE* was classified as munitions and restricted, meanwhile free speech laws meant that printed words could very seldom be stopped.

      I was part of exporting PGP from USA legally, by way of printing the (zipped, uuencoded + checksums) source-code, mailing it physically to norway, scanning it, OCRing it and manually proofreading all lines where the checksum failed.

  2. Fix 'em good. by ackthpt · · Score: 4, Funny

    Take a TRS-80 and watch them try to figure it out.

    --

    A feeling of having made the same mistake before: Deja Foobar
    1. Re:Fix 'em good. by Dr_Barnowl · · Score: 3, Insightful

      Even more vulnerable - your compromised host machine could be screen-scraping the virtual image for all it's worth and sending the snapshots to Uncle Chang (side note - what is the Chinese equivalent of "Uncle Sam"?).

      The guest machine also needs an unencrypted bootloader - because it's a virtual computer with the same BIOS implementation, which could be compromised in exactly the same way as the host.

      UEFI Secure Boot? Not a defence. If you can get access to the machine, you can swap the BIOS out with one that trusts the signing key of Chinese Intelligence, and will load their signed bootloader. Or they'll just filch the Microsoft signing key and use that.

      Boot from a USB that you keep on your person? Doesn't preclude your compromised laptop running some kind of hypervisor that captures all your keystrokes and again, mails them to Uncle Chang.

      At the basic level they could just insert a traditional hardwired keylogger between your keyboard and motherboard, and you'd never detect it unless you were around when it decided to phone home (some models will run commands to send their logs out).

      The only defence is not to leave your hardware unattended. Maybe this is a good use case for a Raspberry Pi in a physically secure case - powerful enough for basic productivity computing but portable enough to keep on your person. For maximum security you'd also have to carry the display and any input devices, so a visor display (like Google Glass), and a roll-up USB keyboard and mini-mouse would be reasonable.

    2. Re:Fix 'em good. by Electricity+Likes+Me · · Score: 3, Insightful

      This is also unreasonable.

      While it is technically possible to do most of these things, for low-grade espionage it's way too expensive to do and requires a well-defined target (i.e. building up a stock of compromised ROMs, of every laptop you're likely to hit, would be expensive as hell and even then you might end up tripping something or damaging the hardware doing it).

      The BIOS swap for example would be particularly troublesome - you'd need to pull apart the laptop, desolder the BIOS chips and solder new ones. No matter how good you are, that's not going to be done in anything less then a few hours, presuming you had all the tools, the chips, and it went flawlessly. And it would require knowing the exact make and model of the target machine.

  3. encryption by Anonymous Coward · · Score: 5, Insightful

    Why doesn't your business mandate HDD encryption?

    China isn't the only place this goes on...

    1. Re:encryption by able1234au · · Score: 3, Interesting

      Encryption but to be extra paranoid, don't bring a laptop. You need to assume that there will be spies on your own payroll. Someone supplementing their pay and being patriotic at the same time. Paranoia is a good thing. Encryption is critical but don't assume it is a magic bullet. If they video or capture you typing in your password then you will have a false sense of security.

    2. Re:encryption by dnaumov · · Score: 3, Informative

      Mandatory and automatic lock-up of a computer after a period of inactivity is neither new nor hard to enforce.

    3. Re:encryption by lister+king+of+smeg · · Score: 4, Interesting

      better yet live cd let them try installing malaware on there then, encrypt the whole drive and only use it for data storage, when chinless agents tries booting and no OS is found so he simply images you drive for later analysis let him stew for a few billion years trying to decrypt it.

      --
      ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
    4. Re:encryption by homer_ca · · Score: 5, Informative

      A hardware keylogger inline with the keyboard cable takes care of that. It only means they'll have to break in twice instead of once.

    5. Re:encryption by Qzukk · · Score: 4, Interesting

      And if the laptop has a firewire port, i'm fairly certain RAM can be dumped on ANY operating system.

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
    6. Re:encryption by ColdWetDog · · Score: 3, Funny

      And if the laptop has a firewire port, i'm fairly certain RAM can be dumped on ANY operating system.

      Ah, this must be the reason that Apple is dropping Firewire in it's laptops. Always looking out for us. Thanks Steve! (wherever you are)

      --
      Faster! Faster! Faster would be better!
    7. Re:encryption by mikeiver1 · · Score: 3, Interesting

      The wise money would go a couple of steps further. Install nothing more than a plain jane out of the box live Linux CD image. Boot the thing and store/work out of a fast USB thumb drive on which all data is encrypted with the latest and greatest super kick ass encryption and a key that is very strong. You take the USB key with you around your neck. For extra points you could have the OS start the camera and record upon boot as well as screen capture every few seconds to the HDD unless a special key combo is used to shut it down.

    8. Re:encryption by Jeremi · · Score: 4, Funny

      You take the USB key with you around your neck.

      Still insecure, someone could grab it and run. For enterprise-level security, swallow the USB key. That will keep the USB key well and truly secure, while still giving you access to your data every 48 hours.

      --


      I don't care if it's 90,000 hectares. That lake was not my doing.
    9. Re:encryption by Vegan+Cyclist · · Score: 5, Funny

      As a vegan it's probably more like every 16hrs. ;)

    10. Re:encryption by Dr_Barnowl · · Score: 3, Insightful

      They defeat your HDD encryption by attacking the weak spot - the non-encrypted bits on your laptop.

      The same physical attack pattern would work for VPN - keylogger, hypervisor, whatever, because it's still a compromised machine with access to the sensitive data.

      The only defence is not to be separated from your hardware - which means carrying your laptop on your person at all times. They can still arrange to have it stolen by a "mugger", but it was all encrypted, right? But if the police conveniently "find" the culprit and give it back, you can't use it.

  4. That's what encryption is for. by stevenh2 · · Score: 4, Insightful

    Who leaves their business secrets in the open. Especially laptops, they get lost stolen, or as the article says people examining it. Really you can use a truecrypt container and hide it somewhere.

    1. Re:That's what encryption is for. by sconeu · · Score: 3, Insightful

      If your boot partition is encrypted, and you can't boot without entering the password, it's harder to put a trojan or a keylogger on the system.

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    2. Re:That's what encryption is for. by dslbrian · · Score: 3, Informative

      This exactly. Encrypt the laptop but don't actually keep anything important on it. Instead use Truecrypt and a USB thumb drive. Have the thumb drive keyed to a different password than the laptop.

      Further, as far as customs, drop a live CD of any variety in the CD drive, and have the laptop default to booting the CD. Now when custom guys asks to inspect your laptop, say sure, and let it boot the live CD. You can be amused while they laugh at how slow your laptop boots. In the end let em clone the HD, whatever, even if the NSA cracks it there is nothing on it. Everything important is on the thumb drive that you have "hidden" away (usually in plain sight on a keychain).

      As far as the article, carrying your corporate secrets encrypted in your pocket will make any thieves job harder, and having the laptop encrypted will force them to install keylogger hardware, a more time consuming and harder thing to get away with. If I were such an executive and had real concerns I would just get a throwaway laptop, or better yet have some fun and epoxy all the case screws in. There are possibilities.

    3. Re:That's what encryption is for. by blueg3 · · Score: 3, Interesting

      If your boot software is encrypted, how does your system boot at all?

      Oh, I see, you're thinking of something like Truecrypt. So, when you boot, where does the code that knows how to decrypt your hard drive live? Why can't the attacker put the keylogger there?

  5. Always encryption by rbprbp · · Score: 3, Funny

    If you are travelling anywhere without HDD encryption, then you kinda deserve this. By the way, let's see them trying to put spyware on a PowerPC Linux laptop. :)

    --
    They're there in their room. You're on your own.
  6. some reading by zerro · · Score: 3, Informative

    http://www.schneier.com/blog/archives/2009/07/laptop_security.html

    https://www.eff.org/wp/defending-privacy-us-border-guide-travelers-carrying-digital-devices

  7. Hah, I had this problem... by DDLKermit007 · · Score: 4, Funny

    I had this problem when I was doing work with associates in China when I was working to develop some software to use there. After going out one night I noticed the next day my laptop had been gotten into. Sure they poked around, but I didn't care. Not stupid enough to actually bring any data physically there with me. Checked the machine for anything funky, but seemed he was poking around to copy any interesting data. In the end they ended up trying to screw us & do the job we were doing which was they found really hard without our actual software in their hands. We just ran pointers that always pushed data from China back to the US where we churned through the data because I was a paranoid maniac. Sucks the company went under due to them, but felt a sort of sick satisfaction they ended up looking really dumb when everything ground to a halt suddenly.

  8. Re:Booby trap time by cheros · · Score: 4, Funny

    the laptop battery goes critical on bootup

    Nah. Dell tried that already..

    --
    Insert .sig here. Send no money now. Owner may sue, contents will settle. Batteries not included.
  9. throw away laptops by lophophore · · Score: 5, Interesting

    Any serious exec is going to use a throw-away laptop for travelling to China. A $400 special will keep you online abroad, and then it can be destroyed as a business expense. Cheap insurance against hacking.

    --
    there are 3 kinds of people:
    * those who can count
    * those who can't
    1. Re:throw away laptops by Anonymous Coward · · Score: 5, Interesting

      Yup, that's how we deal with it. We're frequently in China to do software and hardware testing at our facilities (I work for a large US transportation company), and we have "China laptops". These are encrypted machines that are specifically loaded with the bare minimum stuff we need when we leave and immediately blown away when we get back. Installation of anything beyond the bare minimum (which is pretty much Win7 and VS2005) is strictly disallowed. Source is kept on a separate, encrypted sd card which is not to be kept in the machine, but even then it's just not that interesting. It's all internal source for package sort controllers and such, and we don't even have the ability to check code back in from these machines. It's purely for debugging and sending problem reports back home.

      There's a big sticker on them that even says "China laptop, do not connect to corporate network"

    2. Re:throw away laptops by Minupla · · Score: 3, Interesting

      I have in the past provided the following instructions to an exec:

      1) Go to local computer store
      2) Purchase off the shelf hard drive with this model:xxx-xxxx-xxx - pay with local cash
      3) Purchase philips screw driver
      4) Remove HDD (more details here on how to remove a HDD) and replace with local drive.
      5) Drive over old HDD with rental SUV. Repeat until fragments. Ensure HDD platters are fragments.
      6) drop into at least 3 random trash bins in tourist areas
      7) If questioned during exit, inform them that the computer crashed and that IT had you take it to a local repair shop but it's not working still.

      Such is life in the odd world we live in.

      Min

      --
      On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
    3. Re:throw away laptops by swillden · · Score: 5, Informative

      ChromeOS encrypts all user data by default, automatically verifies the integrity of all software during startup, and reverts to a known-good version in the event any compromise is discovered. Boot verification is based on code and data stored in ROM, so subverting it requires modifying the hardware. Run-time compromise must be done by leveraging web-style attacks (cross-site scripting, etc.) and can normally only achieve what web-style attacks can achieve which is access to data from other sites, etc. In the event deeper compromise is achieved, it's lost as soon as the device is restarted, until the user visits the malicious web site again.

      Use a Chromebook, connect only to trusted sites and only over SSL, and you become an extremely hard target for compromise. Little if any of your data is actually stored on the device, what is cached on it is encrypted. When you get home, reboot and you're very, very likely to have a trustworthy system again. Do a factory reset and it's guaranteed to be clean (barring hardware hacks), since all data will be gone, and any modified code will be detected by the verified boot process. And, as a last resort, you only paid $200 for the thing, so if you fear hardware hacks, just chuck it and buy a new one. It's unlikely to add more than about 5% to the cost of your trip.

      http://www.chromium.org/chromium-os/chromiumos-design-docs/security-overview

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  10. solutions: by wierd_w · · Score: 3, Informative

    There are several ways around this, with increasing levels of overhead.

    0) don't bring the laptop to begin with. (Hehe.. har.. yeah, who am I kidding?)

    1) yank the HDD completely, boot the laptop using a custom knoppix DVD, with an RDP client. Save your work in the cloud/at the enterprise, behind a strong enterprise password. Malware magically vanishes when the laptop powers down. No local data to collect.

    2) use something like black ice defender.

    3) use whole disk encryption with almost reigious zeal.

    Personally, I prefer the live dvd approach. It has fringe benefts of always being a fresh, clean environment, and a complete black hole for forensic data recovery. Only the rubber hose method to get you to reveal the RDP account password remains as a reliable method of intrusion, though this assumes you aren't an idiot, and weren't so stupid as to package a keyring on the live DVD. (The whole idea is to keep sensitive data OFF the system!) If you absolutey NEED a keyring, find some way to use an actual usb keyfob to store it, and always carry your keys.

    Regardless of the method used, remember that allowing unauthorized persons access to the physical system is practically synonymous with being pwned. The live dvd method only gives them physical access to a terminal.

  11. Industrial espionage by Taco+Cowboy · · Score: 4, Interesting

    I travel all the time, for business.

    China is not the only country where industrial cloak and dagger stuffs happen.

    The other countries that I've personally encountered industrial espionage activities includes Japan, Korea, Vietnam, France, Italy, India, Indonesia, Egypt, Turkey, and you will be surprised, I had had similar encounters in Canada, UK, Australia, and also US of A, although not that often.

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:Industrial espionage by hendridm · · Score: 5, Interesting

      I've surprised by many of the countries on your list.

      Can you give some examples of what you've observed that we non-travelers might find surprising/interesting?

    2. Re:Industrial espionage by DNS-and-BIND · · Score: 3, Insightful

      Industrial espionage is one thing. This is a government employee entering your hotel room to install software on your laptop and image your hard drive. It has been happening for years in China (but has just now made Slashdot). It is practically a signature move of theirs.

      --
      Shutting down free speech with violence isn't fighting fascism. It IS fascism!
    3. Re:Industrial espionage by AaronW · · Score: 4, Interesting

      As you said, France is also notorious for this sort of thing which surprises a lot of people.

      --
      This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
    4. Re:Industrial espionage by CoderJoe · · Score: 4, Insightful

      How about just doing a boot-time truecrypt volume? They can't boot the system from the hard drive, and booting from a live CD/USB is also useless, as the data on the hard drive is encrypted. (unless they want to take the time to image the whole hard drive so they can work on cracking it elsewhere)

    5. Re:Industrial espionage by halofan_sd · · Score: 4, Funny

      not being able to formulate a sentence without grammatical errors is a strong (actually, perfect) indicator that the speaker is a product of the American educational system.

    6. Re:Industrial espionage by RocketRabbit · · Score: 5, Funny

      I'm sure your lack of experience in capital letters and their proper usage increases the public's perceived veracity in your experience with this subject.

    7. Re:Industrial espionage by Zontar+The+Mindless · · Score: 3, Informative

      The use of the awkward word "stuffs" has been, in my experience, a strong (actually, perfect) indicator that the speaker is Chinese.

      I almost didn't post this for fear that the chicom astroturfers (you?) will adapt, but i think it's important to get the word out regardless.

      Protip to westerners: keep your eyes open for awkwardly idiomatic phrases, especially when the speaker is defending China either directly or indirectly.

      Protip to the other side: stuff is an uncountable plural word already. "stuffs" is just "stuff." it's like saying "mices."

      I've been using "stuffs" from time to time as long as I remember. Native American English speaker here, not a bit of Chinese in my family, other than in-laws.

      Now that I think of it, I've NEVER heard anyone but other Americans or Australians even use it.

      Protip: My anecdote says your anecdote is full of crap.

      --
      Il n'y a pas de Planet B.
  12. Or Windows '98 by kawabago · · Score: 3, Funny

    and infect them right back!

    1. Re:Or Windows '98 by RabidReindeer · · Score: 5, Funny

      How about Windows 95 with Microsoft Bob?

      I think that's a violation of the Geneva Convention.

  13. Silly by Charliemopps · · Score: 3, Informative

    We don't even have people that travel outside the country and yet your security standards state that:
    A. The laptop is wiped and re-imaged upon return. Every time.
    B. The user simply uses the laptop to VPN into our corporate network which is protected by a random keyfob plus all the usual security.
    C. Corporate laptops never leave the site of the user. You take it with you everywhere you go. Period.

    Granted, I don't think C gets followed all that much. But A and B are pretty solid. Who the hell keeps a personal laptop for work anymore?

  14. Re:EVIL MAID! by FatdogHaiku · · Score: 3, Funny

    Well... that explains why the HOT HORNY MAID never showed up... she got canned so they could insert their perfidious data thief in her place! Damn. Someone should update the Asian Porn section of the internet so travelers aren't disappointed...

    --
    You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
  15. Encryption: Not allowed by jabberwock · · Score: 5, Informative

    From The New York Times in February:

    Both China and Russia prohibit travelers from entering the country with encrypted devices unless they have government permission.

  16. Full hard drive encryption by fufufang · · Score: 3, Interesting

    If you use Windows, you can install Truecrypt, and change the bootloader so it shows "Operating System Not Found".

    If you use Linux, set up encrypted LVM, and have your boot partition on a separate USB flash drive, which you attach to your keyring, and carry around with you all time.

  17. troll them by Lehk228 · · Score: 5, Funny

    Troll like a pro, carry lots and lots of "super sekrit" docs in a poorly truecrypted volume (password on a sticky note under the mouse)

    gigabytes and gigabytes of detailed looking prototype data from your projects that failed due to a fatal and truly unsolvable flaw, but fudge the data and info to mask the unsolvable part

    bonus points for anything that will cost them 100 million to fail to reproduce
    more bonus points at the billion, 10 billions and 100 billion level

    cold fusion, hot fusion, electric vehicle, atomic reactors, there must be trillions of dollars worth of hopelessly flawed design proposals kicking around collecting dust in company archives. -- Put them to good^H^H^H^HLulzy use

    --
    Snowden and Manning are heroes.
  18. Re:Shred of Evidence by Man+On+Pink+Corner · · Score: 5, Informative

    US export law is no joking matter. It is impossible to exaggerate how goofy the rules are, and how much trouble you can get in for violating them. It doesn't matter if you're a hacker in a basement or a Fortune 100 defense contractor -- you do not want to mess around with these people.

    Some examples of the evidence you're asking for.

    More here. I think my favorite is the veterinary supply wholesaler in Waukee, Iowa who was fined $250,000 for sixteen unlicensed exports of cattle prods to Mexico.