{"id":33,"date":"2008-01-11T11:19:13","date_gmt":"2008-01-11T19:19:13","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/2008\/01\/11\/ink-tags-my-security-review-from-hw1\/"},"modified":"2008-01-11T11:19:13","modified_gmt":"2008-01-11T19:19:13","slug":"ink-tags-my-security-review-from-hw1","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2008\/01\/11\/ink-tags-my-security-review-from-hw1\/","title":{"rendered":"Ink Tags: My Security Review from HW1"},"content":{"rendered":"<p>For my security review, I have chosen to cover the anti-theft devices that are commonly used at retail clothing stores, which I believe are called &#8220;ink tags&#8221;.\u00a0 I am basing this information from personal experience (I briefly worked for a clothing store a while back) and also from this entry on wikipedia: http:\/\/en.wikipedia.org\/wiki\/Retail_loss_prevention.<\/p>\n<p>&nbsp;<\/p>\n<p>Summary:\u00a0<\/p>\n<p>Ink tags are used very commonly at clothing stores in an attempt to prevent theft.\u00a0 It&#8217;s a somewhat sizable piece of beige-colored plastic that&#8217;s pinned onto every single article of clothing at the store.\u00a0 The removal of this plastic is relatively hard to do so with force.\u00a0 And, more specifically, if it&#8217;s not taken off with the provided special device (which the stores stock), the glass vials inside the tags break and spill ink onto the clothing, presumably ruining it.<\/p>\n<p>&nbsp;<\/p>\n<p>Assets\/Security Goals:<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>The obvious assets are the clothes that the stores stock.\u00a0 They want to prevent people from taking it without paying money since their businesses rely on this.<\/li>\n<li>The ability for shoppers to shop effectively and safely.\u00a0 This is more subtle, but the stores need to ensure that, for example, the tags wouldn&#8217;t falsely trigger and spill ink onto valuable customers.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Potential Adversaries\/Threats:<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>A typical shoplifter.\u00a0 The thief could still just take the clothing and wear it with the tag still on there, or, if it was later taken off incorrectly, with the ink stains.\u00a0 Wikipedia also describes a method in which people try to cover the holes the ink spills out from with duct tape, thereby reducing or eliminating the amount of ink that spills onto the clothing.<\/li>\n<li>An employee or ex-employee.\u00a0 An employee with access to the device could take the tag off safely and steal the piece of clothing.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Weaknesses:<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>Though the mechanism will likely deter potential thief&#8217;s from otherwise stealing, it does very little (perhaps even absolutely nothing) to prevent them from actually taking the merchandise.\u00a0 However, the motives to want to do such thing seems illogical (steal clothing but not wear it, or, wear clothing with an ink tag still on or with ink stains).<\/li>\n<li>As I already mentioned, the ink can perhaps be blocked from spilling onto the clothing by covering up the holes.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Potential Defenses:<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>In a way, the defense is that the affected clothing will be of no use to the thief.\u00a0 Also, stores should pair this device with other security measures like sensors that sound an alarm or security cameras.<\/li>\n<li>Make the holes small enough and plentiful enough so that they cannot be seen, making it impossible to block the ink.\u00a0 This is apparently already being implemented in the newer (?) devices.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Risk Analysis:<\/p>\n<p>To begin, I would say that the monetary value of the asset is relatively small.\u00a0 The costs of producing and shipping for most clothing is cheap.\u00a0 And since we&#8217;re dealing with just clothes, there&#8217;s no confidential data or the like that we&#8217;re losing (the clothes aren&#8217;t exclusively designed to be unique products to exist as one, but instead designed once and then massively reproduced cheaply).\u00a0 The probabilities of the threats and vulnerabilities seem low as well.\u00a0 Given the state of our society&#8217;s\u00a0 ethics and enforced laws, most people wouldn&#8217;t even consider shoplifting.\u00a0 and the small percentage of people that would will be deterred from doing so since, from their perspective, the likeliness of successfully benefiting from stealing to the risks are bad.\u00a0 I would say the only exception is maybe for the employees who would have an easier time removing the ink tags.\u00a0 This is why I believe other security measures should also be in place like having security cameras.<\/p>\n<p>&nbsp;<\/p>\n<p>Conclusions:<\/p>\n<p>More recently, the retail industry&#8217;s goal has been not necessarily to prosecute thief&#8217;s but instead to simply prevent it from happening in the first place.\u00a0 This is due to many companies being sued for falsely accusing people of theft (as an example, I heard of a story about how one employee ran after a thought-to-be thief and tackled them to the ground).\u00a0 I believe that the retail industry has successfully been able to do this with the use of ink tags (along with other devices) by making the potential reward for the thief very small as compared to the risks involved.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>For my security review, I have chosen to cover the anti-theft devices that are commonly used at retail clothing stores, which I believe are called &#8220;ink tags&#8221;.\u00a0 I am basing this information from personal experience (I briefly worked for a &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2008\/01\/11\/ink-tags-my-security-review-from-hw1\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":22,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-33","post","type-post","status-publish","format-standard","hentry","category-security-reviews"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/33","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=33"}],"version-history":[{"count":0,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/33\/revisions"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=33"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=33"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=33"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}