Best practices for physically securing a notebook

Question

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for protection?

The obvious one is to lock the login screen - ok. Still not sure how to protect from live CDs, live USBs and most of all, hardware modifications, such as inserting physical keyloggers in the machine.

As to this last case one can verify after it potentially happened but any creative idea on how to prevent it in first place? Maybe some special locker, tape or what-not?

Answer 1

This should be sufficient at least for the moderately to quite paranoid:

• Change BIOS settings to boot only from the harddisk, so you can't boot from other devices. Make sure to disable network boot, which is usually in the same menu.
• Set up a password for changing BIOS settings and for startup, so nobody can get past the BIOS loading screen without resetting the BIOS.
• Set up automatic shut down when closing the lid (you should be able to do this in the power saving options). That way, intruders will have to go through the BIOS password prompt to get anywhere.
• Encrypt the whole disk. That way, you'll have to get to the PC while unlocked or to add keyboard sniffing to access anything.

Some more outlandish suggestions:

• Install a James Bond-type trigger which will be broken if someone opens up the case. Ideally, this should be detectable only by the owner, and should be easy to see.
• Glue up the ports which are not used.
• Fill up the insides of the computer with resin or glue, so nobody can install hardware devices there without seriously messing with it. Of course, you might run quite a risk of hardware failure if the machine contains any moving parts.

Answer 2

Without physical security, you can't have strong protection. So I don't know of any very strong, robust security measure for your situation.

But you can mitigate some of the risks. One possible approach is to have two OS installs. One of them should be Truecrypt encrypted with a strong passphrase. The other, not encrypted at all. Before giving the laptop to someone else, reboot to the unencrypted OS instance. This doesn't protect against physical keyloggers or some other threats, but at least it prevents straightforward ways that a malicious user might use to get at your data.

Answer 3

External parts (usb ports, firewire ports, cd drive) are somehow visible. User should watch them. I couldn't find any device that could be inserted inside an USB port and locked with a key: USB ports weren't designed to afford such screwing, so probably putting some lock inside it (physical lock) could cause damage.

To prevent from opening the notebook case: put some seal in every place that you could open using screws. If the seals are somehow personalized, better, so it's hard to replace one after being damaged. There are some seals that can't be removed without destroying themselves.

And be sure that this will only prevent soft spying. If you have informations that you want to hide from NSA, well.. good luck trying. :)

Answer 4

Put glue into the heads of the screws protecting sensitive pieces such as the hard drive. You can always chip it out when you need to, but it provides tamper detection, since the attacker would also need to chip it out, and presumably would have trouble replicating the specific look of the glue spot you left in place.

Answer 5

BIOS

The user should set her BIOS to disable booting from removable media, and password protect her BIOS/bootloader. This would prevent an attacker being able to boot from a USB drive or a LiveCD, unless perhaps they disassembled the laptop in order to remove the CMOS battery to either cause the BIOS to reset, or to physically replace the BIOS chip. She should also consider write-protecting the BIOS chip.

HDD/SSD

Full disk encryption would protect against data theft as long as the attacker could not access or determine the encryption key. It would also prevent an attacker changing the root password by booting into single user mode or booting from an removable drive.

Operating system

Qubes OS has some features, like Anti Evil Maid and DMA protection via VT-d/IOMMU that should reduce the attack surface further. An attacker wouldn't be able to perform a DMA attack via Firewire, Expresscard or Thunderbolt interfaces, for example. (Qubes, unfortunately, ships with numerous binary blobs, and may not be compatible with a GNU/Linux user's desire to run fully free software.)

Traditional measures

A laptop could be configured to perform some more traditional alarm or security functions, e.g. sounding an alarm upon motion detection; or streaming video from a 360-degree webcam to a server, so that the footage could be reviewed later and would identify any attackers, effectively providing the laptop with CCTV.

A good lock (not one of these) secured to the laptop's lock slot, and to an immovable object, would make the laptop harder to steal, as would putting it in a locked anti-theft bag (e.g. from PacSafe or one of their competitors) or hard case and locking that to an immovable object.

Tamper-evident seals might help reveal any attempts to open the laptop's case, although tamper-evident seals that will defeat a skilled attacker are apparently hard to find.

Different computer?

Some computers, e.g. the ORWL, are designed with physical security in mind, and come with built-in tamper evidence and protection against thermal attacks such as cold boot. (The ORWL, unfortunately, ships with many binary blobs, and may not be compatible with a GNU/Linux user's desire to run fully free software.)

Education

Finally, the user should probably also inform herself about the range of attacks and possible defences. For example, she might wish to read about security engineering, or to watch Daniel Selifonov's talk from DEF CON 21: A Password is Not Enough: Why Disk Encryption is Broken and How We Might Fix It.