Hacker News Reader

Comment by haunter | Hacker News Reader

> I'm impressed that they got a USB stick past Level 3 testing. Guess: maybe there are tiny wires in the casing and an "intrusion detection" chip with its own battery that is never powered off so that it can monitor for breakage of the wires and trigger a wipe?

Now I want to see a teardown of this USB stick

View on HN

I've seen a level 3 SSD teardown before. They had a humidity sensor and a photovoltaic sensor oonboard. Cease was sealed, and any change detected by these sensors would initiate a key wipe from a battery and then a data wipe once the drive received power. Interesting stuff

Photo sensor is a no-brainer, as you can assume it's dark in there, but humidity is a nice treat as you don't know what the %RH in the housing will be.

Little did you know, it achieved that level by wiping the mind of the person tampering with it rather than wiping itself.

This is likelier than the alternatives

Now I'm vaguely curious as to whether FIPS postulates that the devices must not have explosives and nerve gas as the tamper protection.

I can imagine this... two extremely thin foils separated by an insulating layer, one connected to a supercap charged at 100V at every time the stick is plugged in, the other layer connected to all pins of the flash memory via diodes. Then, encase the whole thing in epoxy. When someone attempts to cut it open now, the short between the foils will discharge the supercap to fry the memory.

Sounds plausible especially given that most likely frying the view bytes containing the AES key is enough. (Most systems have a stored AES key which then again is encrypted e.g. with a password).

You can also wrap it in something that reacts vehemently with oxygen and wrap that in a thin foil. That may last longer than that capacitor and, I guess, is less easily defeated (does that charge fry the stored bits or only the logic for reading and writing it? How do you defend against Evie carefully drilling into the epoxy until contact with the charge is made?)

A step up is two chemicals that don’t need oxygen (prevents Evie from opening the device in a nitrogen atmosphere). Bonus points if they only explode when depressurized, as then, you can mix them inside the device.

I think techniques like those have been used in safes, but can’t find a link. I did find https://people.kth.se/~msmith/is2500_pdf/Anti-Tamper%20Techn..., which discusses this use case.

It mentions detecting attempts to X-ray the device, and even mentions using explosives (with a remark “this option is not practical for consumer electronics”). I guess that is not a problem in military hardware (if a F-35 falls into enemy hands, destroying its software probably is more important than destroying the plane)

Thanks for sharing that deck! The section on volatile memory retention time/temperature stood out to me: for SRAM, at room temperature the data retention time varies from 0.1 to 10 sec – cooling SRAM to -20oC increases the retention time to 1 sec to 17 min – at -50oC the retention time is 10 sec to 10 hours

Couldn't that be defeated by draining the battery, for example with low temperatures? Programming it to wipe itself when low on charge might cause other issues.

I think this answers the OP’s question: Conversations like this are really expensive to have.

Not if: low battery -> auto wipe

Also if the content is encrypted you don't need to auto wipe the 128GB, just auto wiping the AES key is enough.

EDIT: To clarify: Many systems like that have a stored AES key for the data encryption which then again is encrypted e.g. "with a password".

That would mitigate one of the issues with auto-wiping (because the owner could store a copy of the key elsewhere and use it to recover the data if a false positive happened), but it should be explained very clearly to the user.

Reply on news.ycombinator.com