Gaping security flaw exposed on anti-tamper devices

19.01.2011

Tampering can be discovered if people are looking specifically for it and test for it, but in most cases all these devices get is a "just kind of a once-over," said Schwettmann, "because we put so much trust in these things."

Michaud, who has worked on the Argonne Vulnerability Assessment Team training International Atomic Energy Agency (IAEA) inspectors, said the same type of anti-tamper devices used commercially are also used on containers that may store nuclear devices, waste, and equipment to help verify arms treaties.

Michaud believes those seals can be tampered with. "It's a massive risk," he said.

There aren't any controls on the use of the seals, said Michaud. He called one maker of seals and asked them for a sample. They sent "a non-voided legitimate stack of them," he said. If he wanted to forge the seals, he could have, he said.

Patrick Thibodeau covers SaaS and enterprise applications, outsourcing, government IT policies, data centers and IT workforce issues for Computerworld. Follow Patrick on Twitter at or subscribe to . His e-mail address is .