# Presentation: 090517

## The State of the Art:Technologies, Vulnerabilities, & Warnings 

- Roger G. Johnston, Ph.D., CPP
- Vulnerability Assessment Team
- Los Alamos National Laboratory
- 505-667-7414
- _[rogerj@lanl.gov](mailto:rogerj@lanl.gov)_
- http://pearl1.lanl.gov/seals/default.htm

- LAUR-04-4328

- Invited Talk for the  National Cargo Security Council Conference
- on Security Technology, Linthicum Heights, MD, July 18-20, 2004.

## LANL Vulnerability Assessment Team

-   consulting
-   cargo security
-   tamper detection
-   nuclear safeguards
-   training & curricula
-   vulnerability assessments
-   novel security approaches
-   new tags & seals (patents)
-   unique vuln. assessment lab

-    The VAT has done detailed
-    vulnerability assessments on
-    hundreds of different security
-    devices, systems, & programs.

**LANL Vulnerability Assessment Team**

-  The greatest of faults, I should say,
-   is to be conscious of none.
-           -- Thomas Carlyle (1795-1881)

## Security:  the dismal science?

-   Not necessary in an ideal world.
-  	Difficult.
-   Not appreciated when there are no  		security incidents;  plagued by hysteria 	& scapegoating when there are.
-  	Inadequate or misused tools, 	  		technologies, & concepts.

## Terminology

**tamper detection:**  delayed (after the fact) detection of unauthorized access.
**intrusion detection:**  immediate (real-time) detection of unauthorized access.
**access control:**  attempting to keep unauthorized personnel out.

## Terminology

**seal:**   a tamper-indicating device (TID)  designed to leave non-erasable, unambig-     uous evidence of unauthorized entry or tampering.  Unlike locks, seals are not necessarily meant to resist access, just      record that it took place.

## Tamper-Evident Packaging

## Examples of some of the 5000+ Commercial Seals

## Advantages of Seals vs. Locks

-  	Locks don’t stand up to determined adversaries.
-  	Knowing that unauthorized access took place                       	is often more practical than trying to stop it.
-    lighter, cheaper, smaller
-    no keys or combinations to manage
-   	often disposable, so don’t need to be returned to sender
-  	can be removed quickly by anyone in an emergency
-  	encourage an intruder to enter through the safest & least 		destructive route

## Advantages of Seals vs. Intrusion Detectors

-  	simpler, easier to use & install
-  	(often) no need for electrical power
-  	lighter, cheaper, smaller
-  	more practical for individual containers & for moving   		cargo
-  	fewer false alarms
-  	It’s often unnecessary to know immediately that  		 	unauthorized access has taken place.

- Advantages of Seals vs. Intrusion Detectors

## Terminology

-  	They are a compromise--neither the best lock           	nor the best seal for a given application.
-  	With 2 dissimilar functions, they tend to confuse the user.

**barrier seal:**  part lock & part seal.

## Warning 2: Avoid bad Terminology!

**“****tamper-proof” seal:**  No such thing.  Unprovable even   if there were.  Silly, because a seal that can’t show tampering is of no use.  The correct term is “tamper-indicating” seal.
**“****tamper-resistant” or antipilferage seal :**  Locks resist tampering & pilferage, not seals.  Seals record that it took place.
**“****security” seal: ** Not a good substitute for the term “barrier seal” because all seals provide security, even if made of flimsy paper or plastic.

_**Warning 2**_: Avoid bad Terminology!

## Why do we lock or seal the handlewhen it is the locking rod we care about?

## Terminology (con’t)

**attacking a seal:**  undertaking a sequence       of actions designed to defeat it.
- Defeating seals is mostly about fooling people, not beating hardware (unlike defeating locks, safes, or vaults)!

- Terminology (con’t)

## (Yanking a seal off a container is not defeating it, because it will be noted at the time of inspection that the seal is damaged or missing.)

## Seal Warnings

_**Warning 3**_:  Current seals, the way they are typically used, can be quickly and easily defeated using only low-tech methods, tools, and supplies available to almost anyone.  (Note:  There are at least 105 major ways to defeat seals.)

## Seals Vulnerability Assessment

-     We studied 213 different seals in detail:
- 	• 	government & commercial
- 	• 	mechanical & electronic
- 	• 	low-tech through high-tech
- 	• 	cost varies by a factor of 10,000
-       Over half are in use for critical applications,
-        and 16% play a role in nuclear safeguards.

## Percent of seals that can be defeated  in less than a given amount of time by 1 person using only low-tech methods

- 213 seals

## Defeat Time vs. Seal Cost  (213 seals) 

- _linear LS fit_
- r = 0.14
- slope:  1.6 sec/$

- 307 attacks

## Results for 213 Seals

| defeat time for         1 person |  
2.7 mins |  
1 min |
| --- | --- | --- |
| cost of tools & supplies |  
$144 |  
$5 |
| margin cost of attack |  
42¢ |  
9¢ |
| time to devise successful attack |  
5 hrs |  
12 mins |

-      parameter                 mean       median

## Warnings About High-Tech

_**Warning 4**_:  High-tech, expensive seals--at least the way they are typically used--are not currently much better than low-cost, mechanical seals.
_**Warning 5**_**:**  High-tech security devices and systems (in general) can usually be defeated with low-tech attacks.

- If you think technology can solve your security problems,
- then you don't understand the problems and you don't
- understand the technology.      -- Bruce Schneier

## Why High-Tech Devices Are Usually Vulnerable To Simple Attacks

- Still must be physically coupled to the real world
- Still depend on the loyalty & effectiveness of user’s personnel
- The increased standoff distance decreases the user’s attention to detail
- Many more legs to attack

## Why High-Tech Devices Are Usually Vulnerable To Simple Attacks (con’t)

- The high-tech features often fail to address the critical vulnerability issues
- Users don’t understand the device
- Developers & users have the wrong expertise
-     and focus on the wrong issues
- The “Titanic Effect”:  high-tech arrogance

## The Good News:  Countermeasures 

-  	Most seal attacks have simple and		inexpensive countermeasures, but the 	seal installers & inspectors must 			understand the seal vulnerabilities, 		look for likely attacks, and have hands-	on training.  (Rarely done.)
-  	Also:  better seals are possible!

## Tamper Detection Problems

- Conventional seals store the
- ‘alarm’ condition until it is time
- to inspect the seal.
- But many attacks on seals involve
- simply hiding or erasing this stored
- information!

## Anti-Evidence: a better way             to do tamper detection

-  	At the very start, before installing the seal,
- 	store information in/on the seal that
- 	tampering has NOT yet occurred.
-  	Erase this information when tampering
- 	is detected.

## Some of Our 20+ New Seals

- MagTag - volumetric seal
- Beads-in-a-Box Seal - volumetric seal
- Glass & Powder Seal - for cargo security
- Plug Seal - for containers with no hasp
- Theodolite Seal - remotely read seal
- 3D Profiling - tag & seal
- Triboluminescence Seal - for high security
- Magic Slate Seal - 100% reusable passive seal
- One-Time Keypad “Seal” - for intrusion detection

## Anti-Evidence Approach to Intrusion Detection:  The “Town Crier” Method

-  	Allows for great simplicity and low cost,    	yet high levels of security & reliability.
-   Ideal for cargo security:  Can be used to 	simultaneously monitor many moving 		vehicles or containers, all using the        	same radio frequency.

## Terminology

- _Type 1_:  The intruder discovers the trap only after the unauthorized access--at which point it is hopefully too late to cover his tracks.
- _Type 2_:  The intruder is unaware of the trap both before and after engaging in unauthorized access.  (More difficult.)
- _Type 3_:  The intruder knows or suspects there is a trap but lacks the time and/or technology to find it.  (This type will become important in  the future with the development of micro- and nano-traps.)

## Terminology

- Tag security issues:
** ****	****counterfeiting:**  making a fake tag _that is not__	__	__recognized as such_.
** ****	****lifting:**  removing a tag from one object or container  	and placing it on another, _without being detected_.

## Tag Warnings

-     _types of tags_
- 	  inventory tag  (no malicious adversary)
- 	  anti-counterfeiting tag  (counterfeiting is an issue)
- 	  security tag  (counterfeiting & lifting are issues)
- 	  buddy tag or token  (counterfeiting is an issue)
_**Warning 7**_:  Security Tags can be used as Seals and vise versa.  Not true for the other kinds of tags.

## Terminology

- _Examples include_**:**
**  **height, weight, eye color
-   2D & 3D face geometry
-   voice recognition
-   ear morphology
-   blood type

**  **hand geometry
-   fingerprints
-   retina or iris
-   body odor
-   DNA

## Biometric Warnings

_**Warning 8**_:  Most or all current biometrics are relatively easy to counterfeit, despite claims by manufacturers & vendors to the contrary.
_**Warning 9**_:  Most or all current biometric devices are relatively easy to spoof even without counter-feiting the biometric.
-    (“easy” = quick and without high technology.)

## Biometric Warnings (con’t)

**Total Error Rate**:  Sum of False Reject (type 1) error rate + False Accept (type 2) error rate.

- Biometric Warnings (con’t)

_**Warning 10**_:  It is difficult to avoid the 5% Rule.

- 5%

## Inventory vs. Security

_**Warning 11**_:  Don’t confuse the inventory function with the security function.

## Inventory

-  	Counting and locating our stuff.
-  	No nefarious adversary.
-  	Will detect innocent errors by insiders,         	but not surreptitious attacks by 		insiders or outsiders.

## Security

-  	Meant to counter nefarious adversaries,  	typically both insiders & outsiders.
-  	Watch out for mission creep:  inventory 	systems that come to be viewed as 	security systems!

## Inventory & Security

-  	One device or system can do both, but 		it is a compromise:  neither the best 		inventory nor the best security possible.
-  	Tends to confuse users.
-  	Analyze the 2 functions separately.

**+**

##  	bar codes

-  	bar codes
-   rf transponders (RFIDs)
-   contact memory buttons

- High-Tech Tags:  Classic examples of confusing           Inventory & Security, High-Tech & High-Security

- _Usually easy to:_    *  lift                         *  counterfeit            *  spoof the reader

- These are excellent as *inventory*
- tags, but problematic for applications
- calling for seals, security tags, or
- anti-counterfeiting tags!

## GPS: Another classic example of confusing Inventory & Security, High-Tech & High-Security

-  	The private sector, foreigners, and 90+% of
-  	the federal government must use the _civilian_
- 	GPS satellite signals.
-   	These are unencrypted and unauthenticated.
-   	They were never meant for critical or
-  	security applications, yet GPS is
-  	being used that way!

## GPS Signal Structure

## DOT GPS Warning

- 	“As GPS further penetrates into the civil infrastructure it becomes a tempting target that could be exploited by [hostile] individuals, groups or countries...  The potential for jamming exists.  The potential for inducing a GPS receiver to produce misleading information exists.”

**Notes:**
Source:  “Vulnerability Assessment of the Transportation Infrastructure Relying on the Global Positioning System”, Aug. 29 2001, Prepared for the U.S. DOT by the John A. Volpe National transportation Systems Center, p. ES-3.

## Attacking GPS Receivers

**Blocking:** 	just break off the antenna, or shield it with 	  		metal; 	 not surreptitious.
**Jamming:** 	easy to build a noisy rf transmitter from 		 	plans on the Internet;  not surreptitious.
**Spoofing:** 	surreptitious & (as we’ve demonstrated) 		  	surprisingly easy for even unsophisticated 	 	adversaries using widely available GPS 			satellite simulators.
**Physical attacks:**  appear to be easy, too.

## GPS Vulnerabilities

- Many national computer, utility, financial, & telecommunications networks are somewhat prepared for loss of time synchronization due to GPS jamming.  But they are not prepared for spoofing, which is easy and could crash the networks.
- The alternate time standard (NIST atomic clock) is also not secure.
- We know of simple, inexpensive counter-measures, but these are not being implemented.

## GPS Cargo Tracking

- GPS Satellite

- Tracking Information
-         Sent to HQ
- (perhaps encrypted/authenticated)

- GPS
- Signal

- (vulnerable here)

- GPS is great for navigation, but it does not provide high security.

## More Warnings  (con’t)

_**Warning 12**_:  Don’t place undue confidence in data encryption or authentication!
_**Warning 13**_:  Don’t assume counterfeiting is difficult!

## Data Encryption/Authentication

- Intended to prevent eavesdropping on
- secret communications between two points.
- Provides reliable security _if and only if_
- the sender and the receiver are physically secure.

## Counterfeiting 

-  	Typically easier than developers, 		vendors & manufacturers claim.
-  	Often overlooked:  The bad guys usually 	only needed to counterfeit the _apparent_ 	performance of the security device, not 	the device itself or its real performance.

## More Warnings

**bad security equals good security.**
_**Warning 15**_:  Security managers will usually over-estimate the difficulty of defeating their security, and under-estimate the cleverness, determination, & resourcefulness of adversaries.
_**Warning 16**_:  Adversaries can usually bluff their way into a facility or organization more easily
- than might be imagined.

- More Warnings

## More Warnings  (con’t)

-  	scapegoating
-  	wishful thinking
-  	“one-size fits all”
-  	sloppy terminology
-  	conflicts of interest
-  	design by committee
-  	ambiguous functions & goals
- 	ignoring changing goals & adversaries
-  	failure to understand the end user’s world
- 	lack of periodic, effective vulnerability assessments
-  	forgetting that security is a probabilistic compromise
-  	over-confidence in standards, testing, & precedence

- More Warnings  (con’t)

## More Warnings  (con’t)

- 	_**Warning 19**_:  Shannon’s Maxim must be considered:  The adversaries know and understand the security systems, strategies, and hardware being used.
_**Warning 20**_:  The bad guys get to define the problem, not the good guys.

- More Warnings  (con’t)

## Example:  Access Control on a Door

-  	penetrate the ceiling, floor, or walls
- 	hack in, or plant bugs
- 	be or become insiders
- 	social engineer insiders
-  	ship themselves* or a robot in
- 	steal the building & leave the door
- 	compromise the room or building before
-     the access control is installed

**Notes:**
*  Contortionist Daniel Browning (“Rubberboy”) Smith, (5’8”, 135 lbs) and his assistant can SIMULTANEOUSLY fit in a 20” X 20” X 30” box.

## More Warnings  (con’t)

- More Warnings  (con’t)

## The LANL

- Available today or request  a copy at _[rogerj@lanl.gov](mailto:rogerj@lanl.gov)_

**The LANL**
**Vulnerability Assessment Team**

- http://pearl1.lanl.gov/seals/default.htm

- Leon Lopez, Ron Martinez, Adam Pacheco, Jon Warner, Ph.D. Roger Johnston, Ph.D., CPP,  Anthony Garcia,  Sonia Trujillo

- Ring the bells that still can ring.
- Forget your perfect offering.
- There is a crack in everything.
- That's how the light gets in.
-                          -- Anonymous

## A new scholarly, non-profit, 

**peer review journal:**
**The Journal of Physical Security**
- _[http://jps.lanl.gov](http://jps.lanl.gov/)_

**JPS**

## The End

**The State of the Art:****Technologies, Vulnerabilities, & Warnings**** **

- rogerj@lanl.gov