Questions tagged [tampering]

Tampering refers to the unauthorized access or modification of a good or device. Use this tag for question regarding the process of tampering, the protection against tampering, or the detection thereof.

Tampering is the process of accessing or modifying goods or devices without authorization to do so. An example of tampering is opening a container to modify its contents, or a consumer electronic device in order to introduce aftermarket modifications.

Tamper Evident Devices

Certain devices or measures can be used to detect tampering. While these do not prevent the attacker from tampering with the device, they indicate to the person inspecting the Tamper Evident Device that tampering has occurred.

How this inspection is performed depends on the device being used, and the time and effort being put into the inspection. A casual inspection may only check if a seal is present or not, while an in-depth forensic inspection will go to great lengths to detect any signs of possible tampering

Examples of Tamper Evident Devices

  • Stickers
  • Zip-Ties
  • Crimps
  • Wraps
  • Seals (Plastic, Metal, etc.)
  • Electrical Sensors

Tamper Resistant Devices

Tamper Resistant Devices are devices that actively deter an attacker from tampering with a device. Tamper Resistant Devices do not necessarily need to be Tamper Evident Devices at the same time. An example for such a situation is a tamper-resistant slotted screw, which is a specific kind of screw that is easy to tighten with a regular slotted screwdriver, but hard to unscrew. The reason why this screw is not considered Tamper Evident is because the screw can be drilled into and removed, then replaced by an identical screw.

Examples of Tamper Resistant Devices

  • Unusual Screws
  • Locks
  • Electronic Modules

Tamper-Proof Devices

A device claiming to be tamper proof claims that it is impossible to tamper with. This belief is generally considered marketing speak. Every device sold as "tamper proof" is either Tamper Evident and/or Tamper Resistant at best. At worst, it is trivially bypassable.

53 questions
0
votes
1 answer

Any there any tools like Burpsuite that fully support HTTP/2?

Nowadays websites start migrating to HTTP/2, but Burpsuite hasn't fully support HTTP/2 yet. I know HTTPCanary is good and support multiple protocols like replaying HTTP2 and even TCP/UDP, but that only available in Android. Are there any similar…
0
votes
0 answers

Are there any standards or guidelines tamper-evident devices can adhere to?

Tamper-Evident devices and measures are devices which in some way indicate that an event not intended by the developer or manufacturer has occurred. Examples of tamper-evident devices are stickers that leave specific residue or are destroyed upon…
user163495
0
votes
1 answer

How to know whether a textfile has been edited or tampered with on the local system?

Related to "How to know whether a textfile has been edited or tampered with?", I wonder if it's possible to detect file tampering on the local system? Typical threat model: the old "Hack" computer game. I want to write out saved game state and…
Edward Falk
  • 103
  • 3
0
votes
1 answer

Semantic URL Attack Mitigation

I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks Example updateprofile.php?uid=1 I can change to updateprofile.php?uid=2 I can update the second user's profile without logging in into his or her…
Cash-
  • 57
  • 4
  • 10
0
votes
1 answer

How to determine when iPhone photograph was taken?

If I have a suspicion that someone changed the date on their iPhone, took photos with that back-dated date and time, can I prove this? Or is this something that you just can't track?
0
votes
0 answers

Altering assembly without affecting digital signature

I have discovered a software crack where the license check assembly (.NET) has been altered but the digital signature and the strong name are both still perfectly intact. Strong naming is easy to inject back into modified or recompiled assemblies,…
-2
votes
4 answers

Trying to secure a code

I am trying to make hard to a code to be modified. Security is my concern. Ok, I know what you guys will say about piracy, bla bla bla. Lets refrain from that discussion. I am trying to collect ideas to do things differently in code. Things like…
Duck
  • 121
  • 1
-4
votes
1 answer

How does Paypal validate the transaction amount?

How does Paypal validate the transaction amount if the buyer changed the purchase amount using http parameter tampering attack?
Blah
  • 35
  • 4
1 2 3
4