2

I need to go through airport security and customs, and its known that at least the German customs (http://en.wiktionary.org/wiki/Bundestrojaner) (and I suspect others as well) try to upload software to the system.

So here my question:

How can I make sure that nobody tempers with my system while I do not have physical access to it (they usually take it backdoors to "inspect" it), or verify it has been accessed / changed?

I have installed a BIOS password, but in a hard case they could just unplug my harddrive, and do something directly. The other option I thought of was doing a MD5 sum over my complete HDD, but as soon as I reboot, that sum will change most likely.

How can I either avoid to have a system, to which I might lose physical governance over temporarily, have a Trojan / Virus / something installed, or otherwise notice an intrusion?

Improve this question
1
  • 3
    I would not work with such a device if I am suspecious that something was installed on. I would simply wipe the whole thing and do a fresh install. – AdnanG Sep 17 '13 at 4:13
6

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.

For example, using TrueCrypt can't protect you from a determined attacker who has installed a hardware key logger and is reading everything you type.

Improve this answer
2
  • While I disagree with the way you phrased the second sentence of your answer (and I hope you rephrase it*), I think this is a more appropriate answer to this question in this case and it should be the accepted one. * The reason I think you should rephrase it is that you're making it sound as if an attacker could someone "unlock" or decrypt TrueCrypt encryption on the first encounter using a hardware keylogger. – Adi Sep 17 '13 at 11:13
  • The TrueCrypt container can't be decrypted by the attacker unless you use the computer during the period it has been subverted. This is why, in a similar fashion, some businesses and lawyers perform electronic bug sweeps before important meetings. – LateralFractal Sep 17 '13 at 11:24
2

First of all, the German customs don't just randomly install spyware on people's computers. I don't know whence you've gotten that information. Like any other state body that conducts legal wiretapping, they install the spyware to track criminals linked to certain criminal activities.

As for your case, you need full-disk encryption using some software like TrueCrypt. Even if somebody has physical access to your machine, they will not be able to access anything on the disk or modify it.

They, of course, can wipe the whole disk and reinstall a new operating system. Needless to say, that can be immediately noticed by you since you won't be able to use the same old TrueCrypt password or it won't ask you for a password at all.

Improve this answer
3
  • Okay, thats kind of what I thought. – SinisterMJ Sep 17 '13 at 6:06
  • 2
    Full disk encryption doesn't stop hardware, firmware or bootloader subversion. AKA Evil Maid attack. – LateralFractal Sep 17 '13 at 10:59
  • @LateralFractal Due to the way the question was asked (specifically about something installed on the operating system itself), I neglected mentioning hardware related issues. Nevertheless, they needed to be mentioned, so +1 for your comment. – Adi Sep 17 '13 at 11:14
2

If you truly feel this is a risk, you can do the following:

  1. Use a PC-on-a-stick dongle such as Cotton Candy or MK802. An unpowered device in your pocket has no wireless transceivers to hack into while going through customs.
  2. Place your PC-on-a-stick inside a sealed tamper-evident bag whenever it must leave your physical possession. Record the bag's serial number* on a piece of paper that doesn't leave your possession; for later comparison. Unless the device is out of your possession for quite a while, the bag's security shouldn't be circumvented within the time available to the attacker.
  3. Place the tamper-evident bag inside a normal envelope, shopping bag, man-purse or luggage carry-on to reduce potential curiosity by officials.

* Assumes that the serial numbers on the bags are not known to the attacker beforehand.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.