[HN Gopher] Show HN: Tripwire: A new anti evil maid defense
___________________________________________________________________
Show HN: Tripwire: A new anti evil maid defense
If you have heard of
[Haven](https://github.com/guardianproject/haven), then Tripwire
fills in the void for a robust anti evil maid solution after Haven
went dormant. The GitHub repo describes both the concept and the
setup process in great details. For a quick overview, read up to
the demo video. There is also a presentation of Tripwire available
on the Counter Surveil podcast:
https://www.youtube.com/watch?v=s-wPrOTm5qo
Author : DoctorFreeman
Score : 68 points
Date : 2025-12-11 09:46 UTC (1 days ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| sandworm101 wrote:
| This isnt a tripwire. This is a canary. You have to actively
| check a canary. A tripwire would send notifications in real time
| without the user needing to check.
|
| An evolution of this would be to put a server on a different
| network, a remote location, and have it pump out warnings the
| moment movement was detected and/or contact with the "tripwire"
| system was lost.
|
| But the best way of preventing evil maid attacks remains knowing
| your hardware. Anyone trying to swap out my laptop, or open it,
| is going to have a problem replicating my scratch marks, my non-
| standard OS boot screen, or prying out the glue holding in the
| ram modules (to prevent cold boot attacks).
| ramses0 wrote:
| I was sure I'd made a comment like this before, but I'd love
| some sort of home-spun setup like this:
| https://news.ycombinator.com/item?id=2465687 ...hood, tuck,
| john. (2x local, 1x remote) which constantly rotated roles as
| to who was primary/secondary.
|
| Basically core "chaos-infra" for your home setup(s). Hood/Tuck
| switch between primary and secondary, always trying to stay in
| touch with "John" (offsite), maybe like a primitive etcd for
| home automation/monitoring/backup/file-serving. Green==3good,
| Yellow=degraded[local|remote], Red=single-point-of-failure,
| Black=off/not-serving.
|
| Other funsie to think about is getting a thumbprint/PIN-locked
| USB-drive to hold/unlock `~/.passwordstore/*.gpg` so that even
| on power-outage/reboot you'd need to physically "re-auth" to
| unlock important secrets.
|
| Something like this would fit nicely into this (imaginary)
| setup!
| sandworm101 wrote:
| I had a professor once ask about the strip of duct tape
| across the back of my brand new laptop. "Well, thieves cannot
| pawn electronics with cracked cases. So all my laptops have
| at least some tape so they think it may be cracked." The next
| lecture, the prof had a strip of masking tape on his laptop
| too.
|
| But slap a tux logo and an "i l9ve truecrypt" banner on you
| device and nobody short of the NSA would even attempt a maid
| attack.
| gruez wrote:
| >Well, thieves cannot pawn electronics with cracked cases
|
| Can't, or they'll get less money? I'm also not sure if I
| ever saw a laptop with a cracked case before, not to
| mention macbooks are the most recognizable and can't have
| cracked cases (because they're aluminum), and other laptops
| aren't worth stealing because their value drops sharply.
|
| >But slap a tux logo and an "i l9ve truecrypt" banner on
| you device and nobody short of the NSA would even attempt a
| maid attack.
|
| truecrypt is actually very susceptible to evil maid attacks
| because it doesn't use secureboot/tpm, which means all a
| baddie has to do is installed a backdoored version of
| truecrypt and wait for you to enter the password.
| sandworm101 wrote:
| The stickers are just a statement that the owner is
| privacy aware. And, physically, stickers are hard to
| replicate quickly, preventing simple swapping of
| hardware. A clean iPad that looks brand new is
| indistinguishable from any other ipad that the maid can
| swap in.
| hurturue wrote:
| new CPUs have built in memory encryption with random key.
| activate it for an additional layer on top of your glue
|
| it's called TSME on AMD
| justincormack wrote:
| Or "memory guard". Its only available on "Pro" CPUs though,
| not all of them.
| mlyle wrote:
| > A tripwire would send notifications in real time without the
| user needing to check.
|
| c.f.
|
| > > If any motion is detected by RPi's camera module or motion
| sensor, the server will delete those secrets immediately, in
| addition to sending push notifications to the web client.
|
| It sends notifications in real time _and_ tries to stay
| irrevocably tripped.
| voxadam wrote:
| For a second I thought Tripwire, Inc.[0] had risen from the dead
| with a new IDS.
|
| [0] https://en.wikipedia.org/wiki/Tripwire_(company)
| Eduard wrote:
| I guess this is actually not an anti evil maid defense.
|
| It's rather an anti evil maid tool, or an evil maid defense. :)
|
| sorry for being pedantic, but with the arms race within
| cybersecurity, "anti something defense" sounds like double
| negation to me.
| nine_k wrote:
| I would call it "a defense against evil maid attacks" to avoid
| any ambiguity.
| bflesch wrote:
| The bullet point stating that tripwire was built for "High-
| ranking officials in businesses/organizations" should be removed,
| because that group is very unlike the "Developers of critical
| software", "Investigative journalists", and "Attorneys with high-
| profile clients" which are also mentioned.
|
| Everybody who had the pleasure to work with "high-ranking
| officials in businesses/organizations" knows that this group is
| the one who overrides many technically optimal decisions and
| thinks internal policies do not apply to them. Their lives are
| not affected if a device is compromised because they are
| financially stable and can just blame an intrusion on the IT
| team.
| neuralkoi wrote:
| The author did an excellent job explaining what an evil maid
| attack is, but a very poor job of explaining how their proposal
| mitigates such attack.
|
| I think the classic "Detecting unauthorized physical access with
| beans, lentils and colored rice" [0] approach is simpler to
| understand and simpler to implement. It doesn't rely on any
| hardware, such as a Raspberry Pi or otherwise technology which
| can be more easily subject to scrutiny via Ken Thompson's
| "Reflections on Trusting Trust".
|
| [0] https://dys2p.com/en/2021-12-tamper-evident-protection.html
| x187463 wrote:
| That's cool. I hadn't heard of that, before. I had a related
| idea for achieving plausible deniability of the key in full
| disk encryption or similar scenarios. The password would be
| derived from the position of sensitive, yet innocuous, elements
| on the device, ensuring that the seizure of the device would
| likely corrupt this relationship. For instance, a series of
| N-sided dice could be placed in specific positions on top of
| the device (in the case of a desktop computer, perhaps), and
| the password derived from their sequence. Consideration must
| also be given to the possibility of the device being
| photographed--likely from a single angle--before being moved.
| So, the dice would be positioned to include some amount of
| occlusion. Any dice-based algorithm would need to ensure the
| search space for the resulting key was sufficiently large.
| IncreasePosts wrote:
| With beans and colored rice, a smart evil maid will just wait
| until they next earthquake to compromise your devices.
| alias_neo wrote:
| It's vacuum packed so movement such as that of an earthquake
| would have no effect.
| ignoramous wrote:
| I'm surprised vaccum packing a Laptop with lentils/rice
| doesn't crack its screen.
| thenthenthen wrote:
| Thanks for sharing again, I saw this at some point but lost the
| reference, great technique, cheap, easy, fun. This is art
| guerrilla wrote:
| Just so you know, this name is already taken by a famous security
| product for intrusion detection.
|
| https://en.wikipedia.org/wiki/Tripwire_(company)
|
| https://en.wikipedia.org/wiki/Open_Source_Tripwire
| QuadmasterXLII wrote:
| as well as https://en.wikipedia.org/wiki/Tripwire ;)
| angry_octet wrote:
| Agreed, it's pointlessly confusing to call it tripwire.
| FuriouslyAdrift wrote:
| Yep... first big project I worked on (as a baby intern). Spaff
| is a legend.
| pyrolistical wrote:
| For high sec people, they should have an internal sec camera
| system. They are have come down in price over time
| kotaKat wrote:
| I've slowly been working on building a Honeywell burglar alarm
| panel (a Vista15P/20P) into part of a Pelican case for travel.
| I can just stick up sensors where I need them temporarily (a
| PIR, a glassbreak, a couple motions), and then use an ECP bus
| decoder (like the old AlarmDecoder board[1]) to kick
| notifications and alerts out where they need to go with an LTE-
| connected miniPC/Pi.
|
| When I need to secure an area (eg, vending at a convention at a
| hotel, locking up the room with stock), I can just pop down the
| Pelican, plug in the keypad (which doubles as the RF
| transceiver), stick up sensors, and I'm off to the races.
|
| [1] http://www.alarmdecoder.com/
| friend99 wrote:
| > NEVER PLUG/UNPLUG THE CAMERA MODULE, THE PIR SENSOR, OR WIRES
| WHEN THE RPi IS POWERED ON!!!
|
| Why?! Will it will trigger W.O.P.R. and start attempting to brute
| force missile silo keys?
| hulitu wrote:
| It will trigger SW bugs.
| Mistletoe wrote:
| How does an evil maid get past a locked iPhone or laptop? It's
| really not that easy with a proper password and encryption right?
| seanhunter wrote:
| The threat is them implanting some sort of device that sniffs
| your password next time you type it. Then they come back at a
| later date for the password and unlock your gadget.
| seanhunter wrote:
| This reminded me of the (real life) story of Oleg Gordievsky, the
| FSB officer who was a double agent for the west[1]. He was
| alerted to the fact that the FSB were on to him and had been in
| his apartment because there were three locks on his front door
| but he never locked one of them as he didn't have the key. He
| came home one day to find all three were locked.
|
| [1] read "The spy and the traitor" by Ben Mackintyre. It's
| incredibly gripping and at times hard to believe the courage and
| perseverance of the people involved but it was real.
| MrBuddyCasino wrote:
| And if that tickles your fancy, "Tinker Tailor Soldier Spy" [0]
| is an excellent miniseries from 1979 about a mole in MI6,
| perhaps the best spy series ever made. I didn't care about the
| movie much, so don't let this deter you, but Alec Guiness as
| George Smiley is a perfect match. John Le Carre thought so,
| too.
|
| Oh and Patrick Steward plays "Karla" the soviet mastermind in
| this series and its successor "Smiley's People". Just a few
| seconds, but very memorable, its incredible really.
|
| [0] https://www.imdb.com/title/tt0080297/
| buredoranna wrote:
| "Smiley's People" remains one of my favorite shows.
|
| If you track it down, I highly recommend watching it with
| headphones. The sound design is amazing.
|
| The sound of an empty room being profoundly menacing.
| seanhunter wrote:
| Wholeheartedly second that. Both series are amazing.
| whalesalad wrote:
| We used to put nail polish on all the screws/panels so that if
| they were ever removed it was clear as day.
| lukan wrote:
| If you just have nail polish, can't an attacker just put on new
| nail polish after removing all the previous one?
|
| The first comment here
| https://news.ycombinator.com/item?id=46244062 links to
| something more elaborate with nail polish.
| swores wrote:
| The person you replied to didn't explain the full concept -
| it's not just nail polish, it's nail polish with glitter in
| to create a unique pattern that the attacker wouldn't be able
| to replicate.
|
| Unfortunately... I've seen a video of somebody defeating this
| concept before, not by trying to recreate the pattern with
| new nail polish and glitter, but by using a chemical (I can't
| remember what) that lets them, gently and very carefully,
| remove the whole layer of nail polish in one piece rather
| than having to break it apart, and then afterwards they stuck
| it back in place such that it looked identical. So it's not
| as secure an idea as it's often considered to be.
|
| Edit: actually my memory was slightly wrong. The video I was
| remembering wasn't about defeating glitter in nail polish on
| a screw, but about "tamper proof" stickers which are made for
| the same purpose. I don't know for sure if nail polish could
| equally be defeated, but I suspect so. Here's that video
| (LockPickingLawyer defeating a tamper proof sticker):
| https://youtube.com/watch?v=xUJtqvYDnkg&
| Thorrez wrote:
| Instead of deleting the secret on trip, and requiring a re-arm,
| it could instead derive a new secret on trip, by e.g. hashing the
| previous secret. That way you don't have to manually re-arm it,
| and you get a record of all trips.
|
| Say e.g. a bug walks in front of the camera, tripping it. Then 1
| hour a later an evil maid comes in and tampers with the system.
| In my design, you could look at the photo record, see that the
| 1st trip was a false alarm, then continue looking at the data,
| and see that the 2nd trip was something real.
|
| Compared to with the current design, the bug would trip it, then
| you would get no record of the actual evil maid. You would see
| the photos of the bug tripping it, and think "oh, it's just a
| false alarm, I don't need to worry", and trust the computer, even
| though it's tampered with.
| IshKebab wrote:
| Fun project, but the chances that this is ever used successfully
| are exactly zero.
| nullbyte808 wrote:
| Perfect addition to my Darknet traphouse!
___________________________________________________________________
(page generated 2025-12-12 23:01 UTC)