{"id":125,"date":"2008-02-10T18:15:46","date_gmt":"2008-02-11T02:15:46","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/2008\/02\/10\/security-review-laptop-locks\/"},"modified":"2008-02-10T18:15:46","modified_gmt":"2008-02-11T02:15:46","slug":"security-review-laptop-locks","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2008\/02\/10\/security-review-laptop-locks\/","title":{"rendered":"Security Review: Laptop Locks"},"content":{"rendered":"<p>Most modern laptops have a slot in them that allows the user to affix a lock to the chassis.\u00a0 The locks usually come in the form of metal cables with a combination or keyed lock on one end which fits into the side of the laptop.\u00a0 The mechanism locks around a metal bar inside the computer, which is attached securely to the frame.\u00a0 While these locking mechanisms do succeed in deterring mild, spontaneous theft, they are definitely not safe to be used in many scenarios.\u00a0<!--more--><\/p>\n<p>The most obvious asset being protected in this case is the laptop itself.\u00a0 Computer hardware is expensive, so they are often a target for theft.\u00a0 They can easily be wiped clean and resold for profit.\u00a0 The second important asset protected by computer locks is the data and software on the computer.\u00a0 Many laptops hold important private information or expensive software that cannot easily be replaced.\u00a0 Thieves can take advantage of personal information, such as credit card or social security numbers for their own benefit.<\/p>\n<p>There are many adversaries that would want to steal a laptop.\u00a0 These include petty thieves looking to redistribute stolen electronics for profit, identity thieves who use personal information to obtain credit cards in other peoples&#8217; names, and intelligence operatives stealing government secrets.\u00a0 In the last two cases, the information or data on the laptop is more important to the thieves than the value of the laptop itself.<\/p>\n<p>Laptop locks have many vulnerabilities.\u00a0 Firstly, the metal cable used to secure the laptop to an immobile object can be cut using special clippers or electronic cutting tools.\u00a0 Another major weakness is user error&#8211;a person can attach the lock correctly to the laptop, but fail to attach it correctly to a sturdy object, or in some cases the anchoring object may be moved or compromised in some way to circumvent the locking mechanism.\u00a0 Finally, laptop locks do not prevent a laptop from being used or prevent data from being taken off of the laptop (physically or electronically).\u00a0 An adversary could dismantle the laptop and remove the hard drive without worrying about the lock.<\/p>\n<p>The bottom line is that laptop locks should only be used for specific purposes&#8211;when someone needs to leave a laptop unattended for a short amount of time and where the laptop does not contain incredibly sensitive information.\u00a0 In many cases, laptop locks are used as part of a larger defense-in-depth scheme (i.e. locking a laptop to a desk inside a locked office) to provide extra protection.\u00a0 The locks definitely do work to deter mild theft, where a potential adversary identifies an opportunity to steal a laptop, but decides that it is not worth the effort.\u00a0 It is also important for the user to ensure that the lock is used properly and that it is attached to an appropriate immobile anchor.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Most modern laptops have a slot in them that allows the user to affix a lock to the chassis.\u00a0 The locks usually come in the form of metal cables with a combination or keyed lock on one end which fits &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2008\/02\/10\/security-review-laptop-locks\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":24,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-125","post","type-post","status-publish","format-standard","hentry","category-security-reviews"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=125"}],"version-history":[{"count":0,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/125\/revisions"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}