Methods for protecting computer systems from physical attacks

Question

I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures.

Consider the following attack scenario: An attacker would like to obtain data from a harddrive. The target machine is setup with Full Disk Encryption, a bios password is set and the boot priority states that the encrypted drive is the first device to be booted.

The passphrase must be typed in order decrypt the drive and boot the machine. A Hardware Keylogger could be installed to obtain this value. Some full disk encryption implementations can be defeated with Bus Sniffing, however in order to carry out this attack the computer case must be opened. In either attack, after a period of time the attacker can return and collect the harddrive and intercepted passphrase.

How can you detect if your computer case has been opened? How can you thwart the use of a hardware keylogger?

Also here is a great talk on Bypassing Tamper Evident Devices.

Edit: The state of modern physical security is incredibly poor. Literally every door lock available at my local Walmart can be picked in seconds. Most homes in the US are still using pin tumbler locks that originally invented by the Egyptians thousands of years ago.

Answer 1

The problem with trying to detect these attacks is that their common target - desktop workstations - largely goes unobserved for most of its life. Even if it actually sits on the desktop, users rarely pay attention to it except to push the power button, insert/remove removable media, or plug/un-plug accessories - all of which generally can be done from the front of the system, while the simplest way to hide these attacks is to plug into the rear. You could perhaps mandate that all desktops be kept actually on the desktop, and have all peripherals plugged into front-facing ports, but that almost certainly won't gain good user acceptance.

There probably is no easy way to thwart a hardware keylogger, except to regularly check your peripheral connections. You can include this in your end-user training, but it's unlikely to ever actually be done by them and it increases the probability that they'll have to call for help when they've inadvertently unplugged something essential in the process. A better method, if there must be one, may be to have a team of technicians perform regular hardware inspections.

The easiest and most cost-effective way to detect breaches into the computer case itself would be to use stickers akin to the ones OEMs use for warranty validation. Of course, this would require that you regularly check said sticker to verify it hasn't been tampered with. Again, this is not something that would be well accepted or implemented by the end-user. So, it will be up to your technicians to regularly inspect their systems. You'll also have to make sure that said technicians have access to the stickers so that they can apply new ones whenever they service the systems, but then we wander into the possibility of insider attacks.

Alternately, some cases and motherboards support hardware-based monitors which can alert you at boot-time if the case was opened since the last power-on. These may or may not be easily circumvented (i.e.: Attacker covers his track by power-cycling the system to dismiss the alert before the victim uses it again.) depending on design, and again may still be vulnerable to insider threats.

Answer 2

I had a Dell computer at one time that would notify me any time the case had been opened. Resetting the notification was done in the BIOS. Probably something similar to a computer case intrusion detection system.

Something like tamper evident tape might work (like the one pictured below).