Printable View
Australian government want to give students webcams, gps, and bios tracking computers to students. They make a claim the computers are unhackable and will shut down bricking themselves when the computer feels threatened. Guess what...... it will be running 'Windows 7'. I believe they failed at 1 thing.....once bricked, a technician must have the tools to fix them!
lol
http://hackaday.com/2009/09/27/unhac...n-to-students/
If i remember correctly they are working with the manufacturer to deploy the notebook/s with a special chip.
So even if the notebook get's stolen, they format it etc the notebook will still be remotly controllable by the tech's.
it's not OS level technology they are employing, it's hardware lvl, and i doubt many junkies/theif's etc here in Aus would know the 1st thing about cracking hardware based software to disable this feature.
From what I read in the past, all modern Harddrives contain hidden code in their microcontrollers to perform security wipe of the whole disk upon command. That code has been uncovered. Im sure the special chip has a jump call to this routine.Quote:
Originally Posted by t34b4g5
Remember....Microsoft claimed the xbox-360 was unhackable. There are so many exploits\chips out in the wild that includes reflashing the hardware in the box. Ps2 online feature has somewhat been defeated. They said you can't go online with a chipped ps2 but all one had to do was get a DNA code from the original disk, which you could rent or borrow.
The best security was for them to never mention it. This is what happens when you talk toooo much about security.
http://www.youtube.com/watch?v=qE-I2VMGOJA
Here's a little more info about these netbooks
Quote:
Security smarts
At the physical layer, each netbook is password-protected and embedded with tracking software at the BIOS level of the machine.
That is administered through an enterprise services bus, which also connects the Remedy suite for asset management, Active Directory for authentication and Aruba's Airwave for wireless network management.
If a netbook were to be stolen or sold, the department can remotely disable it over the network. Even if the hard drive of the machine was swapped out or the operating system wiped, it would be useless to unauthorised users.
Already, it has noted the loss or damage of just six netbooks out of the 20,000 rolled out since August - and have tracked a teacher using their device on a field trip in New Zealand.
While there is a serial number and barcode on each computer, the department said that thieves or students might be able to remove them. To combat this, it is using passive RFID chips on every machine that will enable them to be identified "even if they were dropped in a bathtub".
Being passive, an RFID reader needs to be within close proximity of the device to read it. (Active RFID transmitted a signal back to base.)
The department used the AppLocker functionality within Windows 7 to dictate which applications are installed.
Web access on the netbooks is filtered according to a corporate security policy (using McAfee's SmartFilter technology) plus an additional SOCKS-based proxy client, which provides web filtering at the network layer.
The devices also use Microsoft's Forefront Antivirus technology.
If they want a net book no one is going to "Hack" then get a crap one from the early 90s or late 80s with DOS on it that has a driver for a network card. When is the last time anyone saw an exploit for DOS? And the fact that it's single tasking, build an app that always runs (Single user, Single Tasking) so nothing else CAN run. No one would want to "Hack" that... Or use it for that Matter. Well except me, I'd put DooM and Quake on it and call it a day.
Then how would the students be able to use them to complete work, they wouldn't be able to use them in class as the software would not be compatible with Dos...Quote:
Originally Posted by gore
this theory might of been useful back in the early 90's but in this day in age they would just be expensive paperweights. ;)
I don't think it would be too expensive. I found an old Toshiba on ebay for $10. :) Runs Windows 95, so that is actually newer than what gore was talking about.Quote:
Originally Posted by t34b4g5
Though I agree that it wouldn't have much value to most students today.
Hey, they get DooM AND Quake! What more do these kids need? lol.
I just think it's a waste is all.The day those come out, wait 5 hours and someone is going to be like "Oh look if you pull it off the board it doesn't check to see if ti's there". Or something.
There is more truth to that than you know. If it weren't for Doom and Wolf3d, I may not have ever taken as much of an interest in computers. Some of my first experiences with networking involved setting up deathmatch games...Quote:
Originally Posted by gore
Yea, I've done a lot of "Network Stress Testing" with that tool "Dynamic Object Oriented Multiplexer" tool. And of course the other load testing software I used a lot for school; "Quick User Assessment Completion Kit" or "QUAKE" for short. Just to make sure of course the college network could handle the load. ;)
:rofl:Quote:
Originally Posted by gore
That is priceless.
It's like Y2K!
First off it cannot work.
Second, It cannot work.
First rule of security = PHYSICAL Security.
No matter what is deployed (RFID, GPS, Startrek Security Intervention) Two things must happen.
RFID. The laptop has to be with in the range of a reader. Pretty sure that's not going to happen.
GPS and all that other BS they are implying. Yea, OK the laptop has to be turned on.
So three scenarios.
1. Idiot steals laptop and sells to friend. Friend gets busted.
2. ID thief gets laptop, removes HDD, Clones HDD Throws laptop in river. (wow all that anti hacking technology worked real well for you didn't it?)
3. I get the laptop, Know that a special BIOS is needed to post the attached hardware. Remove the GPS and what ever else they thought of chip, and rewrite the bios so It functions with out the chip.
Post findings on the Internet.
Sell the laptop
If you have physical access to a computer, you own it!
It's a proud day for bastards anywhere when 4 posts in a row are all from the BOFHs. *Sniffle*.
*Chest swelling with pride*. My other PFY has hit it on the head in one of my points that having physical access will probably always equal root access:)
Unless of course they make a laptop where it has a full hand scanner that also checks a temp too so you can't saw someone's hand off and use that to get passed the reader heh. Then of course you could still set his hand on fire and dip it in warm water to make it still read it, but hey I didn't say it was bulletproof.
You failed to mention how they could get past the startrek security intervention.Quote:
Originally Posted by dinowuff
I'm waiting. :D
Seriously though, I agree. There are probably quite a few people that see the term 'unhackable', and automatically think 'will fixink their leetle red wagon...'.
Hi,Quote:
Originally Posted by dinowuff
Are there any precautions one can take so that if someone gets physical access, he/she can't own it?
Thank you
Phenom
Please enlighten us.Quote:
Originally Posted by Phenom
May I suggest you patent that and get a copyright first.
Hi,Quote:
Originally Posted by dinowuff
My apologies for not being able to frame the question correctly. I was simply asking what steps one could take to harden the process of accessing the data if one has physical access (for example, in case of lost/stolen laptops)?
Thank you
Phenom
The actual data can be protected with hard encryption (i.e. AES) As far as preventing someone from being able to make use of the equipment, it is just a matter of replacing parts.Quote:
Originally Posted by Phenom
There are encryption methodologies that will absolutely prevent access unless the user has the correct credentials to "Unlock" the data. So physical access is meaningless.
That being said, that type of methodology is flawed in that only one or few will have such credentials. Now those of you that remember Novell from the early days. If you forgot your admin password, or your administrator got pissed - changed the password and left. You were pretty much ****ed!
Also, let us not forget the L.E.A.F. key for PGP. http://jya.com/pgp-clipper.htm
There will always be back doors, some line of test code not removed from the production release, something that with enough time and money - we'll get it. And to be honest, usually we will find your unencrypted data in the trash can, or facebook or somewhere where you least expect your data to end up.