1
00:00:00,000 --> 00:00:03,040
This is the tamper-evident village at DEF CON 30.

2
00:00:03,040 --> 00:00:07,420
And what's interesting is another type of physical security bypass, isn't it?

3
00:00:07,420 --> 00:00:08,060
Yes.

4
00:00:08,300 --> 00:00:16,780
So at the tamper-evident village, there's, I think of, when I think of tamper-evidence, I think about like the zip ties around stuff, which are like one-way zip ties.

5
00:00:16,780 --> 00:00:25,340
And then these type of labels, where when you rip them off, it leaves some of the, like a lot of it behind.

6
00:00:25,340 --> 00:00:29,960
Now that's being cardboard, I understand it's a little different, but it leaves kind of this residue behind.

7
00:00:30,700 --> 00:00:32,540
What is tamper-evident?

8
00:00:32,540 --> 00:00:34,920
Like, can you just kind of put a definition a little bit to it?

9
00:00:34,920 --> 00:00:35,040
Sure .

10
00:00:35,040 --> 00:00:38,640
So tamper-evident is technology that is adjacent to locks.

11
00:00:38,640 --> 00:00:42,060
So locks are meant to keep people out of your thing for some period of time.

12
00:00:42,360 --> 00:00:51,860
Tamper-evident is made to show that somebody tried to access your thing, whether it's a shipping package, an envelope, a safe, a shipping container, whatever it is, right?

13
00:00:51,860 --> 00:00:57,840
I think I even remember, didn't like some of the old phones for the hardware hacking village.

14
00:00:57,840 --> 00:01:05,920
I know like to void a warranty, for instance, you open it up and it might either rip a chip off or it just shows that, hey, you've voided the warranty by opening it.

15
00:01:05,920 --> 00:01:05,920
Yeah .

16
00:01:05,920 --> 00:01:08,920
Most electronics have some form of adhesive seal.

17
00:01:08,920 --> 00:01:11,440
That's like a warranty sticker or something like that.

18
00:01:11,440 --> 00:01:17,840
And here you start finding, and within this village, you start finding vulnerabilities for these type of tamper-evident.

19
00:01:17,840 --> 00:01:18,240
Yes.

20
00:01:18,240 --> 00:01:19,120
And you have one of them.

21
00:01:19,120 --> 00:01:24,560
You're going to show me a demo right now of how you would go about pulling off one of these pieces of tape.

22
00:01:24,560 --> 00:01:24,920
Yep.

23
00:01:24,920 --> 00:01:25,920
Let's jump in.

24
00:01:25,920 --> 00:01:28,540
What do I have to do to be able to pull this thing off?

25
00:01:28,620 --> 00:01:28,800
Okay.

26
00:01:28,800 --> 00:01:30,920
So there's lots of different ways to attack it.

27
00:01:30,920 --> 00:01:32,900
You can go with temperature, hot or cold.

28
00:01:32,900 --> 00:01:39,620
We're going to use chemicals just because it's easier and less likely for people to hurt themselves here at DEF CON and lots of other things.

29
00:01:39,680 --> 00:01:45,820
But the goal is that if this is your package, when you get it on, you receive your package, it looks the same to you.

30
00:01:45,820 --> 00:01:47,560
You go, yes, there's no residue.

31
00:01:47,760 --> 00:01:51,520
The tape hasn't been damaged or ripped off or cut or anything like that.

32
00:01:51,960 --> 00:01:52,620
So chemical...

33
00:01:52,620 --> 00:02:00,080
I imagine like a practical application that we've seen be exploited is with like crypto wallets, like the Ledger crypto wallets.

34
00:02:00,080 --> 00:02:05,920
What happens is they take them, they open the package, they set a private key, they write it down.

35
00:02:05,920 --> 00:02:10,960
Then they repackage it, put all the tamper evidence stuff back on and then sell that.

36
00:02:10,960 --> 00:02:11,160
Yeah.

37
00:02:11,160 --> 00:02:12,340
It applies to anything, right?

38
00:02:12,340 --> 00:02:14,920
So if your company orders servers, right?

39
00:02:14,920 --> 00:02:16,140
They get shipped to you.

40
00:02:16,140 --> 00:02:21,420
What if somebody intercepts it, tampers the package, affects your hardware, changes your firmware, whatever, right?

41
00:02:21,420 --> 00:02:26,400
So basically anything, mail, shipping, cargo related can be tampered, right?

42
00:02:26,620 --> 00:02:32,240
And usually the goal is not theft because if you're just going to steal it and it's going to be missing anyway, you just rip this off, right?

43
00:02:32,240 --> 00:02:39,240
So obviously chemistry is a big subject, but we're just using acetone on these tapes here.

44
00:02:39,520 --> 00:02:46,120
Acetone doesn't work for every single thing, but for the most part, it's a pretty decent accessible solvent for most people.

45
00:02:46,120 --> 00:02:46,980
Now I'm a noob.

46
00:02:46,980 --> 00:02:49,980
For acetone, can anyone pick this up?

47
00:02:49,980 --> 00:02:50,800
Do you need a license?

48
00:02:50,800 --> 00:02:54,220
Where would you go picking this up if you wanted to learn some of this?

49
00:02:54,220 --> 00:02:58,920
So this is just, at least in the US, this is just hardware store acetone.

50
00:02:58,920 --> 00:03:01,920
It's pure acetone, like 90 plus percent pure.

51
00:03:02,340 --> 00:03:06,580
If you don't have access to that, you can also get it from drugstore as nail polish remover.

52
00:03:06,580 --> 00:03:10,340
The only downside to nail polish remover is that number one, it's usually weaker.

53
00:03:10,440 --> 00:03:15,960
Number two, it usually has dyes or perfumes in it, which might affect your ability to tamper.

54
00:03:15,960 --> 00:03:18,560
You don't want to leave like a blue circle.

55
00:03:18,560 --> 00:03:19,460
No, that makes sense.

56
00:03:19,460 --> 00:03:23,620
Okay, so it's just like standard hardware, I can pick it up, Home Depot or something like that?

57
00:03:23,620 --> 00:03:23,940
Yeah .

58
00:03:24,540 --> 00:03:26,240
So what we're going to do is, I'm going to...

59
00:03:26,240 --> 00:03:33,500
By the way, I love how you say hot or cold is dangerous at DEF CON, yet you go ahead and you're like, one second, let me grab this needle out right now.

60
00:03:33,500 --> 00:03:35,260
Well, we used to use hypodermic needles.

61
00:03:35,260 --> 00:03:37,600
I actually prefer them, but we're using industrial needles.

62
00:03:37,600 --> 00:03:37,820
Okay.

63
00:03:37,820 --> 00:03:40,260
So you can't hurt yourself, at least not as easily.

64
00:03:41,080 --> 00:03:43,480
I'm propping it up just to help gravity do it.

65
00:03:43,480 --> 00:03:49,460
One of the advantages of cardboard is that you can, it's absorbent, so it'll soak up the solvent.

66
00:03:49,740 --> 00:03:52,320
But I'm just putting a little bit here.

67
00:03:52,480 --> 00:03:53,640
That was a lot.

68
00:03:54,680 --> 00:03:57,920
Yeah, I know you're at an awkward angle to get it on camera, so...

69
00:03:57,920 --> 00:04:05,340
Yeah, well, I'm doing the angle so that it flows down so that when I start picking this up, the cardboard will soak it up.

70
00:04:05,340 --> 00:04:07,400
Oh, wow, it works that fast?

71
00:04:07,400 --> 00:04:07,980
Oh, yeah.

72
00:04:08,100 --> 00:04:09,680
And you'll notice this is still sticky, right?

73
00:04:09,680 --> 00:04:15,600
So this is still stuck to, thank you, to my tongue depressor here.

74
00:04:15,600 --> 00:04:21,900
And I'm using the tongue depressor just so I don't mar the finish or, if you're working with your hands, to not leave fingerprints.

75
00:04:24,890 --> 00:04:26,070
But it works pretty quick.

76
00:04:26,070 --> 00:04:28,050
And you'll notice this is sticky still.

77
00:04:29,350 --> 00:04:31,530
So I'm gonna let this soak for a second.

78
00:04:31,610 --> 00:04:33,690
But you'll see this is already evaporating.

79
00:04:33,990 --> 00:04:40,910
Yeah, so that was what I was just thinking is, would the water damage the box, or not water, but would the acetone damage the box?

80
00:04:40,910 --> 00:04:42,350
And I see it drying already.

81
00:04:42,350 --> 00:04:45,110
Yeah, for most cardboard and most acetone, it won't.

82
00:04:45,110 --> 00:04:51,350
If you use a lot, you might stress the fibers of the cardboard, or think of like a paper that gets wet, it gets kind of wavy.

83
00:04:52,090 --> 00:04:53,770
But for the most part, it's fine.

84
00:04:53,770 --> 00:04:56,450
This board was just a random board we picked off the table.

85
00:04:57,170 --> 00:05:00,250
And it may have been done dozens of times over the weekend.

86
00:05:02,050 --> 00:05:03,630
That is incredible.

87
00:05:03,870 --> 00:05:05,570
I can't believe how fast it was.

88
00:05:05,570 --> 00:05:07,010
Yeah , you'll see it's already drying.

89
00:05:08,630 --> 00:05:11,390
I mean, if it was a giant box, you can just kind of wave it a little bit.

90
00:05:11,390 --> 00:05:11,890
No, I'm just kidding.

91
00:05:11,890 --> 00:05:21,570
Yeah, I mean, generally, you open the package, you're doing something with the contents for some period of time, photographing it, modifying it, it's like computer hardware or software kind of thing.

92
00:05:21,670 --> 00:05:26,230
I imagine with the tamper evidence stuff, also, there's multiple attack paths.

93
00:05:26,230 --> 00:05:28,070
This one is removing it.

94
00:05:28,070 --> 00:05:38,670
The other one might be like buying more of that, like going, finding the manufacturer of that specific tape and say, okay, cool, I can just, I can remove it, but I can also put a new piece on.

95
00:05:38,670 --> 00:05:43,030
Exactly, so this specific piece of tape doesn't have any serial number.

96
00:05:43,750 --> 00:05:47,830
The lines are made so that if you cut it, it's very hard to realign the lines, like visually.

97
00:05:48,130 --> 00:05:52,090
Some of the others we ripped it up, but you can see there's a serial number on this one.

98
00:05:53,210 --> 00:05:58,050
So if you just try to replace this, in theory, the person should see, hey, my serial number changed.

99
00:05:58,630 --> 00:06:05,970
Just depends on, there's a person, no matter if it's adhesive or mechanical or electronic, there's a person in the loop that says, yes, that is good or not.

100
00:06:05,970 --> 00:06:14,910
So part of this is fighting technology, part of it is fighting the person, like if they don't check the serial number, then maybe you can get away with putting another one that looks the same.

101
00:06:14,930 --> 00:06:17,730
So at this point, it's dry, pretty much dry, yeah.

102
00:06:17,790 --> 00:06:22,210
Did that dissolve all of the, I guess, the glue on the thing?

103
00:06:22,210 --> 00:06:23,510
Speaking of which, sorry, you reminded me not to do face down.

104
00:06:23,510 --> 00:06:24,710
Or on the piece of tape.

105
00:06:25,610 --> 00:06:27,530
So it actually doesn't dissolve the glue.

106
00:06:27,650 --> 00:06:33,490
What it does is it creates a buffer between the adhesive layer of the tape and the surface of, in this case, cardboard.

107
00:06:33,510 --> 00:06:36,370
So it basically causes it to float up off.

108
00:06:36,370 --> 00:06:37,690
So that's why it's still sticky.

109
00:06:37,690 --> 00:06:38,910
It doesn't dissolve the tape.

110
00:06:38,910 --> 00:06:45,110
Maybe over like, if we tamper this, Yeah, in theory, true attack, you're only doing it once.

111
00:06:45,110 --> 00:06:47,210
In the village, you're doing it over and over.

112
00:06:47,210 --> 00:06:49,690
So again, like this board, who knows how many times.

113
00:06:49,690 --> 00:06:53,090
So we open it up, we modify hardware, we put it back.

114
00:06:53,090 --> 00:06:54,730
Are we able to just stick it right back on?

115
00:06:54,730 --> 00:06:56,190
Oh yeah, it's sticky right now.

116
00:06:56,190 --> 00:07:03,450
So now that it's dry, and professionally, we would take a photo and measure this and put it back in the same spot, but it doesn't matter.

117
00:07:03,450 --> 00:07:07,450
To get it off the last little bit, we're just gonna take a little bit of acetone.

118
00:07:08,670 --> 00:07:11,030
It's amazing, it's even stuck to that.

119
00:07:11,850 --> 00:07:13,670
Give that a second to dry.

120
00:07:14,730 --> 00:07:16,550
But it's back to what it was.

121
00:07:16,550 --> 00:07:18,330
This is so cool.

122
00:07:18,330 --> 00:07:24,150
I know I say this for so many videos, but this legitimately is so cool.

123
00:07:24,430 --> 00:07:26,810
I have, this is the first time I've experienced this.

124
00:07:26,810 --> 00:07:27,590
This is awesome.

125
00:07:27,750 --> 00:07:28,390
Thank you.

126
00:07:28,390 --> 00:07:31,390
If someone wants to research more, I guess this is the question.

127
00:07:31,410 --> 00:07:34,970
If you want to research more about this, where would they go?

128
00:07:34,970 --> 00:07:35,910
Is there a forum?

129
00:07:35,910 --> 00:07:38,150
Is there a DEF CON forum they can look at?

130
00:07:38,150 --> 00:07:38,870
Not really.

131
00:07:38,870 --> 00:07:43,590
So I gave a talk about it at some number DEF CON, I don't remember, a while ago.

132
00:07:44,230 --> 00:07:45,310
What's your handle?

133
00:07:45,310 --> 00:07:46,970
I'm Datagram, by the way, hi.

134
00:07:48,030 --> 00:07:49,610
There's not really a lot of info on it.

135
00:07:49,610 --> 00:07:55,390
You can find some scattered YouTube videos of people doing individual tapes or individual mechanical seals.

136
00:07:55,610 --> 00:07:57,050
There's really not a lot of info.

137
00:07:57,350 --> 00:08:05,990
I wanted to troll and say tamperwiki.com, because it's a website I made a long time ago that I never did anything with, that people are really upset that I haven't filled out information for.

138
00:08:06,330 --> 00:08:08,550
But yeah, sorry, there's not a lot of info.

139
00:08:08,550 --> 00:08:11,450
There's some talks, like I said, my talk from Black Hat DEF CON.

140
00:08:11,450 --> 00:08:12,550
Or come to DEF CON.

141
00:08:12,550 --> 00:08:13,470
Or come to DEF CON, yeah.

142
00:08:13,470 --> 00:08:14,630
And figure it out.

143
00:08:14,670 --> 00:08:15,870
Thank you so much.

144
00:08:15,870 --> 00:08:17,370
Thanks for watching.

145
00:08:17,370 --> 00:08:19,630
And as always, hack on.