# Presentation: 524835

## Rethinking Tamper & Intrusion Detection 

- Roger G. Johnston, Ph.D., CPP
- Vulnerability Assessment Team
- Los Alamos National Laboratory
- 505-667-7414
- _[rogerj@lanl.gov](mailto:rogerj@lanl.gov)_
- http://pearl1.lanl.gov/seals/default.htm

- LAUR-04-0386/04-193
- Presentation for the ASIS Emerging Trends In Security Conference, Chicago, IL, May 29-April 1, 2004

## http://pearl1.lanl.gov/seals/default.htm

- Leon Lopez
- Ron Martinez
- Adam Pacheco
- Jon Warner, Ph.D.
- Roger Johnston, Ph.D., CPP
- Anthony Garcia
- Sonia Trujillo

- VAT

- _[http://pearl1.lanl.gov/seals/default.htm](http://pearl1.lanl.gov/seals/default.htm)_

## Problems with ConventionalTamper & Intrusion Detection

** ****	****Terminology**
** ****	****Excessive complexity (ID)**
**	****Excessive focus on hasps and portals (TD)**
** ****	****Assuming that High Tech means High  ****	****	****Security**
** ****	****Confusing Inventory & Security functions**
** ****	****Failing to securely store or transfer the  ****	****	****‘Alarm’ condition**

## Other Problems with Tamper & Intrusion Detection(for another day)

** ****	****High false alarm rates (ID)**
** ****	****Wishful thinking/silver bullet chasing**
** ****	****Naive faith in “standards” & “testing”**
** ****	****End users don’t use seals well (TD)**
** ****	****End users don’t analyze costs well (TD)**
** ****	****End users don’t demand good seals (TD)**
** ****	****Badly designed door locking hardware on  ****	****trucks & transportainers (TD)**

## Why do we lock or seal the handlewhen it is the locking rod we care about?

## Terminology

**tamper detection:**  delayed (after the fact) detection of unauthorized access.
**intrusion detection:**  immediate (real-time) detection of unauthorized access.

## Terminology (con’t)

**lock:**  a device to delay, complicate, and/or discourage unauthorized entry.
**seal :**  a tamper-indicating device (TID)  designed to leave non-erasable, unambig-     uous evidence of unauthorized entry or tampering.  Unlike locks, seals are not necessarily meant to resist access, just      record that it took place.
**barrier seal:**  part lock & part seal.

## Terminology to Avoid

**“****tamper-proof” seal:**  No such thing.  Unprovable even if there were.  Silly, because a seal that can’t show tampering is of no use.  The correct term is “tamper-indicating” seal.
**“****tamper-resistant” or antipilferage seal :**  Locks resist tampering & pilferage, not seals.  Seals record that it took place.
**“****security” seal: ** Not a good substitute for the term “barrier seal” because all seals provide security, even if made of flimsy paper or plastic.

## Terminology (con’t)

**seal protocols:**  the official and unofficial procedures for using a seal, including procurement, shipping, checkout, installation, inspection, removal, disposal, postmortem exams (if any), record keeping, interpretation, response, and training.
- A seal is no better than its protocols!

- Terminology (con’t)

## Terminology (con’t)

**tag:**  an applied or intrinsic feature that uniquely identifies an object or container.
-     _types of tags_
- 	  inventory tag  (no malicious adversary)
- 	  anti-counterfeiting tag  (counterfeiting is an issue)
- 	  security tag  (counterfeiting & lifting are issues)
- 	  buddy tag or token  (counterfeiting is an issue)
**lifting:**  removing a tag from one object or container and placing it on another, _without being detected_.

## Terminology (con’t)

**attacking a seal:**  undertaking a sequence       of actions designed to defeat it.
- Defeating seals is mostly about fooling people, not beating hardware (unlike defeating locks, safes, or vaults)!

- Terminology (con’t)

## (Yanking a seal off a container is not defeating it, because it will be noted at the time of inspection that the seal is damaged or missing.)

## Seals Vulnerability Assessment

-     We studied 213 different seals in detail:
- 	• 	government & commercial
- 	• 	mechanical & electronic
- 	• 	low-tech through high-tech
- 	• 	cost varies by a factor of 10,000
-       Over half are in use for critical applications,
-        and 16% play a role in nuclear safeguards.

## Percent of seals that can be defeated  in less than a given amount of time by 1 person using only low-tech methods

- 213 seals

## Defeat Time vs. Seal Cost  (213 seals) 

- _linear LS fit_
- r = 0.14
- slope:  1.6 sec/$

- 307 attacks

## Findings for 213 Seals

-  	Average cost of attack tools/supplies:  $144    	(median = $5)
-   	Average time to devise attack:  5 hours         	(median = 12 mins)
-   	High-tech e-seals aren’t significantly more 	 	difficult to defeat than low-tech mechanical 	seals.  (Some are much easier.)

## Counterfeiting 

-  	Usually easier than vendors & 		manufacturers claim.
-  	But typically not the easiest attack.
-  	The bad guys usually only needed to 	counterfeit the _apparent_ performance 	of the security device, not the device 	itself or its real performance.

## The Good News:  Countermeasures 

-  	Most of the attacks have simple and  	inexpensive countermeasures, but the 	seal installers & inspectors must 		understand the seal vulnerabilities, 	look for likely attacks, and have 		hands-on training.
-  	Also:  better seals are possible!

## High-Tech ≠ High-SecurityInventory Function ≠ Security Function

-  	bar codes
-   rf transponders (RFIDs)
-   contact memory buttons
-  	data encryption/authentication
-  	GPS

## Data Encryption/Authentication

- Intended for public communication
- between two secure points.
- Provides reliable security _if and only if_
- the sender and the receiver are physically secure.

## DOT GPS Warning

- 	“As GPS further penetrates into the civil infrastructure it becomes a tempting target that could be exploited by [hostile] individuals, groups or countries...  The potential for jamming exists.  The potential for inducing a GPS receiver to produce misleading information exists.”

**Notes:**
Source:  “Vulnerability Assessment of the Transportation Infrastructure Relying on the Global Positioning System”, Aug. 29 2001, Prepared for the U.S. DOT by the John A. Volpe National transportation Systems Center, p. ES-3.

## GPS Vulnerabilities

- The private sector and 90+% of the federal government must use the _civilian_ GPS satellite signals.
- These are unencrypted and unauthenticated.
- They were never meant for critical or security applications, yet GPS is being used that way!

## Attacking GPS Receivers

**Blocking:** 	just break off the antenna, or shield it with 		metal;  not surreptitious.
**Jamming:** 	easy to build a noisy rf transmitter from 		plans on the Internet;  not surreptitious.
**Spoofing:**	surreptitious & (as we’ve demonstrated) 		surprisingly easy for even unsophisticated 		adversaries.
**Physical attacks:**  appear to be easy, too.

## Spoofing Civilian GPS Receivers

- Easy to do with widely available GPS satellite simulators.
- These can be purchased, rented, or stolen.
- Not export controlled.
- Many are surprisingly user friendly.  Little expertise is needed in electronics, computers, or GPS to use them.

## GPS Vulnerabilities

- Many national computer, utility, financial, & telecommunications networks are somewhat prepared for loss of time synchronization due to GPS jamming.  But they are not prepared for spoofing, which is easy and could crash the networks.
- The alternate time standard (NIST atomic clock) is also not secure.
- We know of simple, inexpensive counter-measures, but these are not being implemented.

## GPS Cargo Tracking

- GPS Satellite

- Tracking Information
-         Sent to HQ
- (perhaps encrypted/authenticated)

- GPS
- Signal

- (vulnerable here)

- GPS is great for navigation, but it does not provide high security.

## GPS Spoofing Countermeasures

- Look (in hardware or software) for artificial characteristics of GPS satellite simulator signals (or pre-recorded real GPS signals):
-  	wrong time
-  	suspiciously low noise
- 	excessive signal strength
-  	artificial spacing of signals
-  	no time variation in signal strength
-  	all satellites have the same signal strength
-  	do a sanity check (e.g., no 10g accelerations)

## Why High-Tech Devices Are Usually Vulnerable To Simple Attacks

- Still must be physically coupled to the real world
- Still depend on the loyalty & effectiveness of user’s personnel
- The increased standoff distance decreases the user’s attention to detail
- Many more legs to attack

## Why High-Tech Devices Are Usually Vulnerable To Simple Attacks (con’t)

- The high-tech features often fail to address the critical vulnerability issues
- Users don’t understand the device
- Developers & users have the wrong expertise
-     and focus on the wrong issues
- The “Titanic Effect”:  high-tech arrogance

## Inventory

-  	Counting and locating our stuff.
-  	No nefarious adversary.
-  	Will detect innocent errors by insiders,         	but not surreptitious attacks by 		insiders or outsiders.

## Security

- Meant to counter nefarious adversaries, typically both insiders & outsiders.

## Inventory & Security

- A single device or system will usually not do a good job of both inventory and security.
- At best, it will be a compromise:  neither the best for inventory nor the best for security.

## Tamper DetectionHow do we do it right?

## The Alarm Condition Problem: Tamper Detection

- It’s easy to detect tampering!
- But what do we do with the information
- that tampering has occurred?

**?**

## The Alarm Condition Problem: Tamper Detection  (con’t)

- Conventional seals store the
- ‘alarm’ condition until it is time
- to inspect the seal.
- But many attacks on seals involve
- simply hiding or erasing this stored
- information!

## Solution:  Anti-Evidence Approach to Tamper Detection

-  	Store secret information, such as a  		random number.
-  	Erase the number when tampering              	is detected.
-  	The ‘good guys’ can check the number by
-  	using a password, PIN, or combination.

- 1663

## Anti-Evidence Approachto Tamper Detection  (con’t)

-  	Any attempt by the ‘bad guys’ to enter the  	wrong password, PIN, or combination  		erases the number.
-  	Any attempt by the ‘bad guys’ to access 	the number (so they can counterfeit it)  	causes the number to be instantly erased 	in the process.

## Anti-Evidence Approachto Tamper Detection  (con’t)

-  	No tools needed to install or remove the 	seal!
-  	The seal is 100% reusable (even if 		mechanical!)
-  	Proves the inspector actually checked  	the seal!

## Some of Our 20+ New Seals

- MagTag - volumetric seal
- Glass & Powder Seal - for cargo security
- Beads-in-a-Box Seal - volumetric seal
- Theodolite Seal - remotely read seal
- Plug Seal - for containers with no hasp
- 3D Profiling - tag & seal
- One-Time Keypad “Seal” - for intrusion detection
- Magic Slate Seal - 100% reusable passive seal
- Triboluminescence Seal - for high security
- RJ Lock/Seal - protects computer ports

## Magic Slate Seal

- exploded view of an early prototype

## Magic Slate Seal

- end views of the male half of the seal & the sled

## Bike Lock

- a combination bike lock:
- The slots in each of the 4
- plastic wheels must be
- aligned in order for the
- shackle to open.
-          (1 in 10000)

**Notes:**
*  Note: Alternately, the seal can be designed with a series of stops such that you pull it out part way under one letter, rotate to another letter and pull it out some more, etc.  This both decreases the odds of the bad guys getting lucky, and also permits the magic slate seal, when installed on a transportainer, to be inspected at different stops along the way without the seal being fully opened until the final destination.

## Intrusion Detection How do we do it right?

## The Alarm Condition Problem: Intrusion Detection

- It’s easy to detect intrusion!
- But what do we do with the
- information that intrusion has occurred?

**?**

## The Alarm Condition Problem: Intrusion Detection  (con’t)

- Simple conventional intrusion detectors
- send an alarm once intrusion is detected.
- But it is easy to block an alarm.

## The Alarm Condition Problem: Intrusion Detection  (con’t)

- More sophisticated, conventional intrusion
- detectors rely on encryption/authentication
- and/or two-way communication or polling
- of sensors.
- This is complicated, and not very practical,
- especially for monitoring moving cargo.

## Solution: Anti-Evidence (“Town Crier”) Approach to Intrusion Detection

-  	Send a periodic “All OK” signal if no intrusion 	is detected--a different secret signal each time 	that only the good guys know.
-   Send gibberish if intrusion _is_ detected.              	(The bad guys won’t know the difference.)
-  	Allows for great simplicity &
- 	security.

## Anti-Evidence (“Town Crier”) Approach to Intrusion Detection  (con’t)

-  	Requires only one-way, extremely low 	  	bandwidth communication  (1 byte/sec to 1 bit/min)
-  	Can be used to simultaneously monitor  	many moving vehicles or containers, all
-    using the same radio frequency.

## Anti-Evidence (“Town Crier”) Approach to Intrusion Detection  (con’t)

-  	We only listen, we don’t try to communicate
- 	with the cargo.
-  	The low bandwidth signal can be hidden
- 	in amongst general communications traffic.  	 	We don’t need to alert the whole world to the 	importance of the cargo by having it emit high 	bandwidth signals.

## “Town Crier” Monitoring  -  Smart Container

## “Town Crier” Prototypes

- Generation 2  ($30)

- Generation 1 ($1600)

## Conclusions

-  	Inventory Function  ≠  Security Function.
- 	Don’t assume inventory technologies (RFIDs,    		contact memory buttons, GPS) provide security!
-  	Don’t overtrust ciphers/encryption/authentication.
-  	Better TD/ID is needed & possible.
-  	“Anti-Evidence” is an attractive approach.

**Conclusions**

## For more information...

_**Tamper & Intrusion Detection**_
- RG Johnston, "How To Be a Better Seal User", Logistics/Supply Chain, January 9, 2004, _[http://logistics.about.com/cs/technology/a/uc010904.htm](http://logistics.about.com/cs/technology/a/uc010904.htm)__._
- RG Johnston, AR Garcia, AN Pacheco, RK Martinez, JS Warner, and SJ Trujillo, "New Approaches to Tamper and Intrusion Detection for Safeguards and Transport Security", INMM Proceedings, July 13-17, 2003, Phoenix, AZ.
- RG Johnston, ARE Garcia, and AN Pacheco, "Improved Security via 'Town Crier' Monitoring (The Correct Way to Do Cargo Security)", Proceedings of Waste Management '03.
- RG Johnston, ARE Garcia, and AN Pacheco, "The 'Town Crier' Approach to Monitoring", The International Journal of Radioactive Material Transport, 13, 117 (2002).
- RG Johnston, ARE Garcia, and AN Pacheco, "Efficacy of Tamper-Indicating Devices", Journal of Homeland Security, April 16, 2002, _[http://www.homelandsecurity.org/journal/Articles/displayarticle.asp?article=50](http://www.homelandsecurity.org/journal/Articles/displayarticle.asp?article=50)__._
- RG Johnston, "The Real Deal on Seals", Security Management, 41, 93 (1997).
- RG Johnston, "Tamper Detection Requires Dedication", Metering International, Issue 3, Fall 1999.
- RG Johnston, DD Martinez, and ARE Garcia "Were Ancient Seals Secure?", Antiquity 75, 299 (2001).

## For more information...

_**GPS**_
- RG Johnston, and JS Warner, "Think GPS Cargo Tracking = High Security? Think Again!", Transport Security World, Sept. 1, 2003, _[http://www.transportsecurityworld.com](http://www.transportsecurityworld.com/)__._
- JS Warner and RG Johnston, “A Simple Demonstration that the Global Positioning System (GPS) is Vulnerable to Spoofing”, The Journal of Security Administration 25, 19 (2003).
- JS Warner and RG Johnston, "GPS Spoofing Countermeasures",  Homeland Security Journal, December 12, 2003, _[http://www.homelandsecurity.org/bulletin/Dual%20Benefit/warner_gps_spoofing.html.](http://www.homelandsecurity.org/bulletin/Dual%20Benefit/warner_gps_spoofing.html)_
_**Physical Security & Vulnerability Assessments**_
- RG Johnston and ARE Garcia, "Effective Vulnerability Assessments for Physical Security Devices, Systems, and Programs", Österreich Militärische Zeitschrift (ÖMZ), Special Issue, pp. 51-55 (2003).
- RG Johnston, "Effective Vulnerability Assessment of Tamper-Indicating Seals", Journal of Testing and Evaluation, 25, 451 (1997).
- RG Johnston, "Cryptography as a Model for Physical Security", Journal of Security Administration, 24, 33 2001.

## Tamper-Evident Packaging

## Examples of some of the 5000+ Commercial Seals

## Advantages of Seals vs. Locks

-  	Locks don’t stand up to determined adversaries.
-  	Knowing that unauthorized access took place                       	is often more practical than trying to stop it.
-    lighter, cheaper, smaller
-    no keys or combinations to manage
-   	often disposable, so don’t need to be returned to sender
-  	can be removed quickly by anyone in an emergency
-  	encourage an intruder to enter through the safest & least 		destructive route

## Advantages of Seals vs. Intrusion Detectors

-  	simpler, easier to use & install
-  	(often) no need for electrical power
-  	lighter, cheaper, smaller
-  	more practical for individual containers & for moving   		cargo
-  	fewer false alarms
-  	It’s often unnecessary to know immediately that  		 	unauthorized access has taken place.

- Advantages of Seals vs. Intrusion Detectors

## A new scholarly, non-profit, 

**peer review journal:**
**The Journal of Physical Security**
- _[http://jps.lanl.gov](http://jps.lanl.gov/)_