6

I need to provide a customer of the company I work at, a laptop computer with a demo software that will run on it.

The software is for display only and doesn't require any user interaction via keyboard or mouse.

I need the computer to disable all device inputs and the hard drive to be encrypted, so only this computer can run. I want to prevent the customer from accessing the computer while it works and prevent the option of removing the hard drive and using it on a different computer.

Does anyone know of any hardware computer\hard-drive combo that can do this?

Thanks.

6
  • 7
    If the software is display only why don't you just create a video and then use a laptop without any secret information? Mar 28, 2011 at 9:07
  • 12
    What makes you think they will try to tamper with the machine? One way might be to include a clause in the agreement he signs for accepting delivery of the laptop that states that he can't tamper with the machine in any way. If you can make it legal sounding all the better.
    – ChrisF
    Mar 28, 2011 at 9:21
  • 6
    Did you consider to run the demo on another computer and provide visual access via some remote desktop protocol?
    – vtest
    Mar 28, 2011 at 13:04
  • The system is display only on the computer itself, but its a dynamic system, downloading news and new videos all the time from the web. Part of the demo is to place real computers like the ones we're going to supply the customer if he agrees to the deal. The problem is that its a big customer and asking him to sign such a paper is pointless since this customer has a world known record of reverse engineering and stealing ideas. I would like to work with him, but I would like to prevent him, as long as possible, from hacking the system. at least until a deal is signed
    – RaamEE
    Mar 30, 2011 at 0:20
  • 3
    Just lock the entire computer up inside a very strong box. Wires going in for power, wires coming out for the monitor and nothing more. Restrict his access physically (though if he really wanted to, he could always physically force the box open, then theres nothing you can do).
    – Faken
    Mar 30, 2011 at 1:32

14 Answers 14

7

Check your laptop's BIOS at boot, look around for options like hard drive encryption or "ATA Hard Disk Lock" (not encryption, but I don't think most drives have any mechanism that would allow you to bypass the password).

You can shoot epoxy into the firewire port to prevent them from attaching a PCI memory reader debugging tool.

Update

The fact that it's Linux gives you some more flexibility. :) You can remove the usbhid.ko, hid.ko, and similar kernel modules from the system. Look through lsmod(8) output and remove anything that looks like it'd be useful for the trackpad or keyboard or nipple-mouse. Delete the firewire modules. Maybe even the serial and parallel modules. (If you're not using them, it won't hurt to be rid of them.)

You'll need to lock down grub as well, so that your client can't just edit the kernel boot line and add init=bash or init=getty /dev/ttyS01 or something else similarly annoying.

You might also want to use a tool such as AppArmor, SElinux, TOMOYO, or SMACK. Any of these mandatory access control tools can prevent an application from escaping a well-defined set of privileges. As I've worked on the AppArmor system for a decade now, it's the one I know best and the one I'd recommend :) but any of these tools can help lock down every mechanism that your client can interact with the computer.

(To tell a small diversionary tale, we took an AppArmor-confined system to the DEFCON Capture The Flag contest for several years; one year required allowing users to telnet in as root with a specific password. AppArmor made it easy to confine the telnetd daemon, the shell it started, and then the programs that the 'scorebot' needed to run. We never won the CTF contests, but we never got rooted, either. We never needed to worry about physical attacks because everyone who was defending was known to us.)

Best of luck.

3
  • The system is linux, so I am currently checking if devices can be disabled on the OS level, I am guessing its possible. But I am also considering physically damaging all usb\keyboard\mouse IO ports to prevent connecting the computer and then gluing shut (with epoxy) the HD to the computer. I will access the system from remote by SSH.
    – RaamEE
    Mar 30, 2011 at 0:49
  • @RaamEE, some updates specific to Linux in my answer; hope they're helpful.
    – sarnold
    Mar 30, 2011 at 1:20
  • Following your update, I checked the computer's current kernel and found your ideas doable. I'll use them. Thanks.
    – RaamEE
    Mar 31, 2011 at 7:07
8

This is simply not possible. Physical access to hardware literally removes all promise of security.

Sure, you can make it more difficult for someone to gain unauthorized access. But beyond the most trivial and inexpensive measures, doing so is a complete waste of time and money. If someone really wants to get in, they will find a way to do so and you won't be able to stop them.

Not to mention they could reverse engineer your software without ever compromising the demo computer that you provide. I'm not sure if this falls under your definition of "hacking", but it probably should.

This is not a technology problem, it's a legal problem. You need to protect your software and your intellectual property with licenses and other contractual agreements. Get the customer to sign a non-disclosure agreement, if necessary. The best thing to do is to consult a lawyer, not a technologist.

If you're afraid of lawyers, hire a security company. Lock the computer down with hardware solutions, like a locked cabinet and an armed guard. If that sounds ridiculous, see the above paragraph.

3
  • Hi, loved the guard idea. I thought that there might be a cpu-harddrive combo where a HD works only as long as its installed in a system with a given cpu id. the problem is I can't find such hardware combo. If I had it, then next I could block all IO ports by physically damaging them. This also won't stop the customer, but will hold him back long enough and discourage him from hacking long enough for us to retrieve the system after a couple of months.
    – RaamEE
    Mar 30, 2011 at 0:37
  • @RaamEE: I'm not aware of such a device. I'm not sure how it would work. I don't think all processors have unique serial numbers, and those that do generally have an option to disable them in the CMOS setup utility. With it disabled, there's no way for the drive to detect which machine it's running on. Mar 30, 2011 at 4:07
  • it's called TPM. You do need specific hardware, but quite a few computer manufacturers build it in.
    – Rory Alsop
    Mar 31, 2011 at 13:17
3

As hinted at in the comment on the question, the correct device for accomplishing this is called a "contract". Write one up (or, better, hire a lawyer to write one up - you can probably get it done for a couple hundred dollars, which is a lot less than tamper-proof hardware would cost) detailing what they are and are not allowed to do with the demo unit and have them sign it as a condition of receiving said demo unit.

4
  • not possible. The customer won't sign such a thing and even if he does, it won't prevent him from hacking. Without mentioning names, I can tell you he has a very bad record of honoring contracts.
    – RaamEE
    Mar 30, 2011 at 0:27
  • 1
    @RaamEE, pity you've got to try to seal the deal with someone with a reputation for not honoring contracts. :( No chance of finding better customers?
    – sarnold
    Mar 30, 2011 at 0:58
  • @RaamEE: I have to agree with sarnold - you need better customers. I've been self-employed, so I know how hard it is to drop someone, but there comes a time to say, "The customer is always right, but you clearly aren't, so I guess you can't be a customer any more." Mar 30, 2011 at 8:52
  • 1
    @RaamEE: If I were you, I'd set up the contract deal (and make sure it was legally airtight) and dare the customer to hack it. Then, when he did, I'd resign from the software development industry and retire on the money I make from the resulting legal victory. And I say that only somewhat tongue-in-cheek (I am from the US; we do like our lawsuits). But seriously, you can't just "not honor contracts". Mar 30, 2011 at 13:38
3

After getting some good advices and understanding from you, the weak points I should look out for I would like to sum up and tell you what we decided to finally do:

First, a couple of things you need to know.

  1. Legal protection is not available when dealing with our customer. If he decides to hack the system he would succeed, eventually.

  2. As long as we can protect the product in such a way that the customer will have to invest more money in the reverse engineering, than what the entire company is worth, that's a good enough protection for us.

  3. Our system is Linux + Java + Postgres

Now for the solution we selected

  1. We will protect the bios with a password. on the bios level, we'll limit boot to the HD and prevent connection of USB devices. This can be hacked by buying a back door code on the web for 30$ or tampering with a chip on the board. However, this will leave indications of tampering, which are quite visible.

  2. We'll lock down Grub to prevent booting to the command line.

  3. The keyboard, mousepad and usb mouse in XWin are locked using parameters in xorg.conf:

    Section "ServerFlags"
    Option "AllowEmptyInput" "false"
    Option "AutoAddDevices" "false"
    Option "AutoEnableDevices" "false"
    EndSection
    
  4. We'll delete usb and keyboard drivers from the kernel. (to make life harder on hackers).

  5. We'll put physical indication (probably color silicon) on the HD, to see if the HD is removed from the computer. If they remove the HD or hack the bios, they will leave fingerprints that they won't be able to wipe.

  6. We'll use Obfuscation tools on the Java code. Our product is quite complex, so Obfuscating it, will prevent any reverse engineering at reasonable cost or time frames. Please read: http://www.javaworld.com/javaworld/javaqa/2003-05/01-qa-0509-jcrypt.html and we'll use one the following tools Open Source tools: http://java-source.net/open-source/obfuscators or DashO from http://www.preemptive.com/

  7. SSH access is available to me only with a key file. All passwords will be removed where possible.

With all the steps above, we can force hackers to work for their money and get an indication if the system was hacked.

2

Once someone has physical access to a system, there's not much you can do about it. For starters its OS dependant - you could possibly use read only media to prevent the user from messing with the the system, and in the process of setting it up, set it to have the inputs unavailable - possibly using bartpe (for windows) or some manner of livecd - many methods allow you to make a bootable backup from a running system.

I'd also suggest tamper evident stickers over the hard drive, or cd rom drive - at the very least it'd let you know if the hard drive was removed.

In this case tho, a mini ITX or full system which has a lockable case might be a better bet tho

2
  • Hi, loved the idea, but the system needs to write to the disk, so it can't use a live-cd. I had an idea about gluing the disk shut, preventing the removal of the disk, but that will help as long as he doesn't try to pry it open from the computer. My purpose is to make the hacking as challenging as possible for him, while considering the fact that with enough time and effort hacking is possible.
    – RaamEE
    Mar 30, 2011 at 0:33
  • In this case, a basic desktop case is MUCH better than a laptop, honestly. much easier to secure for one, and far more impressive.
    – Journeyman Geek
    Mar 30, 2011 at 1:43
1

Full-disk encryption software normally relies on a password being entered to decrypt it, how were you proposing to protect the harddrive - in other words where are you going to put the 'secret'?

2
  • This is why I opened this post. I thought that this problem was common enough that some hardware provide would have a computer with a hard drive, where the HD is encrypted by a key unique to the cpu of that computer, so when you try to move the HD to another computer, it won't work. The IO ports I would close by accessing the system via ssh and controlling it from remote. Problem is, I couldn't find such hardware. I am looking for ideas that could hold back hacking up to some level. 100% hack proof is probably impossible in my case, but I would be happy with 75%.
    – RaamEE
    Mar 30, 2011 at 0:45
  • @RaamEE - see my post on Trusted Platform
    – Rory Alsop
    Mar 31, 2011 at 13:16
1

Why give them physical access to the software at all?

If so little local input is involved, the laptop you provide them needs to do nothing more than act as a remote viewer of another machine that remains in your possession.

This way they can run with very limited privileges, be constantly monitored and the family jewels need never leave your vault. Even without knowing your platform, I am sure there are quite a number of remote access options that would suit; Teamviewer, LogMeIn or Remmina to name a few.

There are obviously still security issues to consider, but back this up with a pretty strict legal contract and you should be able to sleep nights without a worry.

1
  • The system my company sells includes a computer and software. We need to provide the customer a fully working system, This is why we can't get by with only a remote-access or VNC of some sort. Again, The risks are known, but I want to make his life hard, in case he thinks of hacking the system.
    – RaamEE
    Mar 30, 2011 at 0:41
1

Once you give someone physical access to a machine, they can pull out the hard drive, make a copy of it, stuff it back in, and hack it at their leisure. Cody is correct that this problem is not really solvable.

One work-around is to have the real program running on a remote demo computer. Have your client's demo computer connect to it. This will make your application look less responsive, so it may hurt sales :/

1

This is a very tricky problem. I have an off-the-wall idea that I am just going to throw out there, since it might be a better solution than physically damaging the computer. You could have this software product of yours setup as a linux screen-saver. Then set the time-out to really small that way if a user tries to interact with the computer a login screen will appear and they will be SOL, but application should resume after time-out for screensaver. To get past your hard-drive encryption problem, The only solution I can really think of here is that if you have hardware encryption on the motherboard of the laptop it could be so that only THAT specific laptop can access the hard-drive. You will have to check your system BIOS to see if you have that feature. other than that I use truecrypt.org for all of my (and my works) encryption needs, but that all usually requires a password entry. Figured I would suggest it all the same though. If I think of something more I will let you know, good luck ;)

1

Have you considered enabling the CPU ID in BIOS and then since you control the code, insert appropriate check into your code at periodic areas. During program start - check CPU ID, if bad, abort and overwrite the program. During program run - check CPU ID, if bad, abort and overwrite program...

1

A solution would be to look at the Trusted Platform functionality a few companies offer, although it may be over priced for what you want to do.

Microsoft have a TPM module which you can use with TPM hardware

This Infineon page gives links to a number of manufacturers such as Dell, HP, Toshiba etc

TPM allows you to tie software to hardware in a much more secure way.

0

You could open the laptop and disable the keyboard and trackpad by unplugging the physical connectors.
You would have to do this once everything else was configured. USB devices disabled, boot from CD/DVD disabled etc. This way once you get the computer back yuo can simply open it up, re-connect the trackpad and keyboard and set everything back to normal and the computer will be fully usable again.
If you were really concerned you could use security screws / security tape to prevent him opening the laptop himself.

6
  • 2
    not all computers are bootable if the built in keyboard is unplugged
    – Journeyman Geek
    Mar 28, 2011 at 11:01
  • Very true, hadn't thought of that. Would have to check prior to the install that it worked. Most Laptops I've repaired will boot without the inner keyboard connected. Not always on purpose either :-(
    – Joe Taylor
    Mar 28, 2011 at 11:17
  • thinkpads won't, since the power on switch is on the keyboard
    – Journeyman Geek
    Mar 28, 2011 at 11:35
  • good point guys. I think that the dell computers I am using, don't have the power as part of the keyboard itself, will check. Unplugging won't help, since the customer can open the computer and plug everything back in, I will have to damage the connectors physically and in an irreversible way.
    – RaamEE
    Mar 30, 2011 at 0:56
  • That's why you couls use security screws or tape. It would show if the customer had been in to the Laptop. Dell Latitude laptops can certainally be powered on with the keyboard disconnected. Some Inspirons have sperate power / keyboard connectors off the keyboard.
    – Joe Taylor
    Mar 30, 2011 at 10:05
0

I saw mention of remote access in some of the answers here, and responses hinting or eluding to a VNC. No one metioned a Thin Client.

Since your software/machine needs to access dynamic content, and be connected to a network, a thin client would seem to be a good fit.

Applications run as if installed on your potential customer's machine; however very little hardware, and certainly NOT your software needs to be installed on the machine that's going to leave your hands.

In a transaction like the one you're describing, there absolutely has to be some give/take from both parties involved - an effort to keep everyone honest.

If you don't trust this person, do not hand them your idea and cross your fingers. Even if you end up suing for copyright infringement, or theft, the damage is already done - but it seems you already feel that way.

Best of luck.

0

If it's Linux disable inputs from the mouse and keyboard and don't allow USB drives or CD to boot.

You'll need a way of getting in yourself but with some authentication it's shouldn't be too tricky to research. Maybe add a BIOS password and allow CDs to boot after yuo've accessed the BIOS.

2
  • DO you know how to disable the USB\mouse\keyboard devices on ubuntu. That would help alot. I hadn't researched that direction yet, although I understood its possible. Connection to the computer will be by SSH and available only on my side.
    – RaamEE
    Mar 30, 2011 at 0:52
  • I haven't done it myself but this seems to give some pointers at least: ubuntuforums.org/showthread.php?t=1395690 Mar 30, 2011 at 6:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .