Breaking and Entering is Their Business

Los Alamos National Laboratory Kathy DeLucas, (505) 665-9201/[email protected]

BREAKING AND ENTERING IS THEIR BUSINESS LOS ALAMOS, N.M., Mar. 13, 1997 -- Whether it be the protective tape on compact discs or the plastic and wire seal on a cable box or an electric meter, tamper indicating devices could be improved, a Los Alamos National Laboratory study reports.

Los Alamos researchers have been able to defeat every seal they have studied, meaning they can get inside to whatever the seal is protecting without being detected.

The special group at the Laboratory intentionally tests tamper-indicating devices -- safety seals ranging from inexpensive adhesive tapes through expensive optical or electronic devices -- to gain access to the protected product without any evidence of gained entry.

Los Alamos researchers Roger Johnston, Kevin Grace, Anthony Garcia and Ron Martinez successfully completed 132 entries on 94 different seals by opening the seal and resealing it or replacing it with a counterfeit so the entry or tampering was undetectable.

"We learned how to spoof all the seals using rapid, low-tech methods," Johnston said. "Most of the attacks could be performed successfully by almost anyone who has access to a hardware store and a standard machine shop." Funded by a variety of government agencies and private companies, the team invades the supposedly protected device, building or product to learn how to make tamper indicating seals better and uncover probable scenarios of tampering.

Tamper-indicating seals are not intended to stop unauthorized access, but leave obvious evidence of entry or tampering.

The seals are widely used in industry and government for a variety of applications including access and inventory control, records, and shipping integrity, hazardous material accountability, theft prevention, tests for illegal drug use and protecting consumer products.

The research team defeated the seals in times ranging from three seconds to two hours, with an average of four minutes. The majority of the attacks involved opening the seal, then resealing it and repairing any damage.

"We believe this is the most comprehensive vulnerability assessment of tamper seals ever done," Johnston said. "The major finding is disturbing: all the seals we examined can be defeated quickly and easily."

Another surprise the researcher discovered is that higher cost does not necessarily mean a better seal. Before the study, researchers thought the most costly seals would be the most difficult to break into.

The research team discovered that the correlation between breaking into and resealing the tamper and the cost of it was so weak, that on the average, seals that cost one dollar more added less than one second to the defeat time. To fix the problem, researchers recommend minor, low-cost modifications, most of which are seal-specific.

"We believe most of the seals can be greatly improved by changing how the seal is manufactured, installed or inspected," Johnston said. "We also believe that encouraging security personnel to be aware of the most likely attack scenarios and watching for these attacks would greatly improve tamper detection."

Rather than panic, researchers would prefer the public, manufacturers and industry become better educated on how tamper seals can be fooled and what to watch for.

The researchers also say that seals are only one aspect of an overall security program. The fact that any given seal can be defeated does not automatically mean the overall security program has failed.

Johnston, Grace, Garcia and Martinez are not singling out specific commercial products for criticism, nor will they freely disseminate information on how to defeat the seals, but do want to work with industry and government agencies to improve detection and manufacture.

"Tamper-indicating seal users and manufacturers are welcome to contact us to discuss how to improve their training or their product," Johnston added.

The research team recently won a Los Alamos award for distinguished performance and has been asked to consult with the Department of Defense, the International Atomic Energy Agency and the Department of Energy.

The research has been published in technical journals such as The Journal of Nuclear Materials Management, as well as in forthcoming papers in The Journal of Security Administration and The Journal of Testing and Evaluation.

Los Alamos National Laboratory is operated by the University of California for the U.S. Department of Energy.

-30-