2

An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did?

For example, let us say that you were walking into your computer room, and when you open the door, a hacker rushes out and escapes. You check your phone, and it says that nothing suspicious happened to your computer while you were gone. Should you assume the computer is compromised?

We can assume the computer has the following security features:

  • The computer sends signed and time-stamped messages over the internet to your phone logging various events described below. The phone also timestamps when it received the message. The phone notifies you if the timestamp of the message is significantly different from the time it was received.
  • Every second, it sends a message "still connected to the internet". It also attaches a photo taken by the laptops webcam. The webcam is pointed toward the door. If this message is not sent, or there is a significant change in the photo, the phone notifies you.
  • The computer contains an accelerometer. The computer will log any (coordinate) accelerations, vibrations, or orientation changes detected by the accelerometer. The phone will notify you when any of these are sent, unless disabled on your phone (although it will still be logged).
  • The computer logs all key presses made using its physically built-in keyboard, as well as the physical attachment or detachment of any peripherals (including the power plug). The phone will notify you when any of these are sent, unless disabled on your phone (although it will still be logged).
  • The hacker of course knows all of this, via Kerckhoffs's principle.

Here are some attacks that would be detected.

Software Attacks

Assuming the hacker knows a software vulnerability, we will probably be able to detect it. If the hacker tries to hack the computer using the keyboard, the logs will show it:

19:00:00 Still connected to the internet. [photo of empty room]
19:00:01 Still connected to the internet. [photo of hacker wearing gloves coming in room] User notified.
19:00:02 Still connected to the internet. [photo of hacker hacking] User notified.
19:00:03 Keypressed "password'); hack();" detected. User notified.
19:00:04 Mouse moved to "sign in" button. User notified.
19:00:05 Disregard previous messages. Everything is fine.

Likewise with the USB

19:00:00 Still connected to the internet. [photo of empty room]
19:00:01 Still connected to the internet. [photo of hacker with rubber ducky coming in room] User notified.
19:00:02 Still connected to the internet. [photo of hacker hacking] User notified.
19:00:03 Something inserted into USB slot. User notified.
19:00:04 Disregard previous messages. Everything is fine.

If hacked over the internet, the above security features would not protect it. That is true of any computer though, and has nothing to do with physical access.

Evil Maid Attack

The real threat when physical access is involved is a network evil maid attack. This too would be detected though.

19:00:00 Still connected to the internet. [photo of empty room]
19:00:01 Still connected to the internet. [photo of hacker with laptop coming in room] User notified.
19:00:02 Still connected to the internet. [photo of hacker putting hands toward laptop] User notified.
19:00:03 Acceleration and rotation detected. User notified.
19:00:04 Still connected to the internet. [photo of hacker room upside down] User notified.

A similar thing would happen with a classic evil maid attack.

Faraday Cage

Perhaps the hacker put the laptop in a faraday cage before hacking it (either with a software, hardware, or evil maid attack). This too will be detected.

19:00:00 Still connected to the internet. [photo of empty room]
19:00:01 Still connected to the internet. [photo of hacker with Faraday cage coming in room] User notified.
(Phone notifies user because the laptop has not reported that it is still connected to the internet at 19:00:02.)
19:00:05 Connection restored.
19:00:05 Still connected to the internet. [photo of empty room]

The last two logs were made after the computer is hacked. Note that without the camera, the user may have thought that the computer just disconnected from the internet. Even without the photo though, the user should assume the system is compromised (since the hacker could dig a tunnel to get into the room without getting detected by the camera, or place a faraday cage around the room, or the building the room is in, itself).

  • Non-contact RF attack. – RubberStamp Dec 31 '18 at 1:56
  • 2
    I don't think that this question can be answered with a clear yes or no. But in general one should treat any system as maybe compromised since one does not even know if an attacker might have gotten access to is (no matter if one has seen somebody), if the vendor has installed a backdoor, if there is a serious software bug which could be used as backdoor etc. How much of a risk one sees in these potential problems depends on the actual use case of the system and the environment it is used in. How easy such problems can be detected and mitigated depends also on the design of the system. – Steffen Ullrich Dec 31 '18 at 4:20
  • This stuff is kind of cool. Is this an imaginary scenario, or do you really have such protections on your laptop? If so, is it custom software that you wrote yourself? – reed Jan 1 at 14:57
  • This question needs some work. Admittedly, I enjoy a nice thought experiment such as this but it probably doesn't fit here in its current format. It's too opinion based due to the possible consequences and circumstances around a hypothetical situation. – TTT Jan 1 at 16:00
  • @reed Its an imaginary scenario. Software does exist to accomplish those things though. – PyRulez Jan 2 at 0:01
1

This looks like a pretty specific scenario and a lot of important details are probably missing, but here's what I thought. Let's consider that:

  • You say that a pic of the room is sent every second, and you provided some examples showing that if someone entered the room they would be caught by your system.
  • You imagine opening the door and finding a hacker there, who then runs away.
  • You say that you checked your phone and nothing suspicious was reported.

When I first read your question I thought that by "nothing suspicious" you meant nothing at all, so I thought you were not even getting notifications about the hacker entering the room. In this scenario we can come to the conclusion that your protection system (actually, detection system) did not work as expected. You should have gotten some notifications when the attacker entered the room, but that didn't happen. The system might be buggy or could have been compromised in lots of unexpected ways (maybe by infecting the machine in the past, or by infecting your phone to display fake notifications, etc). Therefore the system cannot be trusted anymore in such an inconsistent state, and it is likely that your machine has been compromised, or that it will be compromised in the future if you don't find out exactly what went wrong.

But in a comment you then said that the system actually detected the intrusion, taking pictures of the attacker while they entered the room. So technically "suspicious behavior" was reported, and it all depends on what exactly was reported. For example, you might have three pictures of the attacker entering the room, followed by other pictures of you opening the door and finding the hacker, the hacker running out of the door, etc. If the timestamps and everything else was ok, you could deduce that the attacker had only been in the room for a few seconds. If the pictures also show that the hacker was always pretty far from your machine, you could deduce that they were never able to touch it. However, the attacker could have compromised the environment where you machine is, for example by placing a hidden camera somewhere, etc.

In conclusion, I think that it's impossible to give a definite answer to this question, because it depends on a lot of details that were not provided. Even if you have no evidence whatsoever that your machine has been compromised, there is still a probability that it was compromised anyway. Whether you want to consider that probability of not, however small it could be, depends on your risk assessment. Risk assessment does not only involve the probabilities, but also the costs: the cost of restoring your system to a safe state, and the cost of leaving your system in a possibly compromised state.

  • Nothing suspicious happened. There would be pictures of the hacker, but he wasn't doing anything suspicious in them. – PyRulez Jan 1 at 16:31
  • @PyRulez Do those pictures show him touching the computer? – securityOrange Jan 1 at 19:34
  • @PyRulez, I added that possibility in my answer. – reed Jan 1 at 23:03
1

The camera could be bypassed by entering through the window for example. The keypresses (if it really only logs the mechanical keyboard)... you can use a wireless keyboard for example. You didn't say anything about network based logging so all of that is probably vulnerable if the device is connected. Bluetooth/IR/Similar interfaces might matter as well. If you don't the mouse, he could still use the onscreen keyboard without triggering anything (if he can stay out of the camera view - which might be possible using a picture of the door held in front of the cam.

Thats all i can think of for now that hasn't been said in other answers already.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.