A few months ago, Gabe asked if I wanted to be a part of the Tamper Evident Contest at ToorCon. This type of event was first held at DefCon this year. Not knowing at all what I was getting into, I said “yes”.
The contest challenges whether “tamper evident” devices are as secure as they claim. Such devices include stickers that leave a layer when ripped off, envelope seals, and zip ties. Furthermore, it is not only necessary to defeat the security measures, but also to conceal everything as if nothing was done (which is the harder part).
We received this box at 10 am Saturday morning and had until 1 pm the following day to return it fully intact. And so the hacking began…
Turns out most stickers can be taken off with isopropanol and will remain sticky for quite a while. Within the big container where 4 more:
In one paper bag was a chain of various locking devices. All the devices needed to be moved from the metal chain to the yellow plastic chain. This drained over 7 hours of our time and the help of many (and still was not completed fully).
To my delight, in one envelope was the following. This was totally perfect for me!
The small black box was a circuit. Luckily almost everyone else had electric engineering backgrounds.
And of course there were all kinds of codes, including a CD with a passworded RAR file.
By 1 pm Sunday, we had everything sealed back up as if nothing had been touched.
We didn’t crack everything and missed a bunch of bonus points, but ended up getting first place! Our team consisted of Gabe, Brandon, Declan, the artistic Nonie, and pretty much everyone who hung out, gave suggestions, and fiddled with us. It was a great experience!
This event is filled with scientific inquiry and technological manipulation. One must carefully observe the nature of the devices, decide on the right tools, and execute with extreme care and precision. Practice often makes perfect. Our cohesive teamwork and openness to others were highly beneficial. All of these characteristics really appeal to the scientist in me.
Documentation blog: http://covertpenetration.posterous.com/
All photos: http://www.flickr.com/photos/gebl/sets/












