{"id":450,"date":"2009-01-16T18:56:04","date_gmt":"2009-01-17T02:56:04","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/?p=450"},"modified":"2009-01-16T18:59:36","modified_gmt":"2009-01-17T02:59:36","slug":"security-review-uw-bookstore","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2009\/01\/16\/security-review-uw-bookstore\/","title":{"rendered":"Security Review: UW Bookstore"},"content":{"rendered":"<p><!--[if gte mso 9]&gt;  Normal 0   false false false        MicrosoftInternetExplorer4  &lt;![endif]--><!--[if gte mso 9]&gt;   &lt;![endif]--><!--[if !mso]&gt;-->Everyone knows the bookstore sells books only after a tremendous markup. But does that really mean they can afford to employ lax security?<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">Consider the situation of the books department: all of the textbooks for every class in the university are housed in a single room smaller than the main Kane lecture hall. Much smaller, actually. About half of the floor space is taken up by racks of books. Under everyday conditions this is fine, because generally less than ten customers are browsing around at a given time. The problem becomes apparent just before the quarter begins, when the book room becomes so crowded that standing in the register line I sometimes think that I\u2019m back in Disneyland, waiting for a ride on Splash Mountain.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">Imagine my disappointment when I realize I\u2019m actually in line to empty my wallet in exchange for ten pounds of paper.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">All these bodies in such a small area can help to hide a malicious book-snatcher masquerading as a customer. Booknappers need simply gather target books into their backpacks and force their ways upstream around the registers and out of the store. The UW bookstore provides no substantial countermeasures.<\/p>\n<p class=\"MsoNormal\"><!--more--><\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\"><strong>Assets and security goals<\/strong><\/p>\n<ul style=\"margin-top: 0in;\" type=\"disc\">\n<li class=\"MsoNormal\">Asset:      books. This is what the bookstore makes its money from; without the      profit, there\u2019s no point.<\/li>\n<li class=\"MsoNormal\">Security      goal: to keep the books from walking out unpaid for. Like I said, there\u2019s      really no point otherwise.<\/li>\n<\/ul>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\"><strong>Adversaries, threats<\/strong><\/p>\n<ul style=\"margin-top: 0in;\" type=\"disc\">\n<li class=\"MsoNormal\">Students.      Books are expensive, and students might not always want to pay for them.<\/li>\n<li class=\"MsoNormal\">Competitors.      There\u2019s a used textbook reseller across the street from the bookstore. Why      pay other people for books when the UW bookstore will give you them for      free?<\/li>\n<\/ul>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\"><strong>Weaknesses<\/strong><\/p>\n<p class=\"MsoNormal\">Ah yes, of course. They make everything possible.<\/p>\n<ul style=\"margin-top: 0in;\" type=\"disc\">\n<li class=\"MsoNormal\">Little      space. When there are lots of people at the bookstore, the register line      can back up into the book area. To compound this, there isn\u2019t much space      in the book area to begin with, so people become packed into the area.      This can be leveraged to help hide malicious activity from the views of      bookstore employees.<\/li>\n<li class=\"MsoNormal\">Cameras.      Security cameras may seem like a good idea (the bookstore has few), but      the truth is that overhead cameras can be easily defeated by correct body      positioning and by wearing clothes such as a hood and hat to hide identifying      features.<\/li>\n<li class=\"MsoNormal\">No      security devices. The books don\u2019t contain typical anti-shoplifting      measures such as metal strips which, when sent through a sensor, trigger      an alarm. Thus, once an attacker successfully hides a book, the attacker      can walk right out.<\/li>\n<li class=\"MsoNormal\">No bag      check. If you\u2019re wearing a backpack into the book section, you can      continue to wear it. And when you leave, nobody checks its contents. All      an attacker has to do is to get a book into his bag unnoticed.<\/li>\n<\/ul>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\"><strong>Defenses<\/strong><\/p>\n<ul style=\"margin-top: 0in;\" type=\"disc\">\n<li class=\"MsoNormal\">Guards.      The bookstore does post guards to watch the flow of people when it becomes      crowded. However, since they don\u2019t check bags, guards alone don\u2019t      contribute anything by themselves to overcome the weakness.<\/li>\n<li class=\"MsoNormal\">Bag      check. It may be inconvenient to shoppers and increase congestion at peak      periods because customers must go to the bag check before and after      purchasing, but it would increase the difficulty of concealing contraband      coursework.<\/li>\n<li class=\"MsoNormal\">Receipt      check. The most powerful anti-theft device in my opinion. Before leaving      the book section, customers would present their receipt and purchased      books to someone who would then mark them as good to go. The customers      could then exit the store. Combined with a bag check, this could greatly      reduce the ease at which books can be swiped.<\/li>\n<li class=\"MsoNormal\">Security      devices. There is of course the option of retail security devices, such as      hidden metal strips which must be removed before exit, unless one wants to      trigger an alarm. But these would be costly to install in every book, and      if used incorrectly could be easy to find and remove. I believe the      receipt check is the more powerful alternative.<\/li>\n<\/ul>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">The risk to the bookstore from such criminal tactics is usually small, because there are usually few enough customers that the employees can track their individual movements. However, the risks greatly increase when coupled with a high congestion of bodies. The problem is that the bookstore likely makes far more money when the store is that crowded, so that\u2019s exactly when they don\u2019t want it to be easier to walk off with free books. This isn\u2019t, of course, a reason for readers to now go out and take advantage of the bookstore for its foolishness and quote this article. That isn\u2019t the intent of this review. The intent isn\u2019t to enable attackers; it\u2019s to point out how attackers already are enabled. That said, I don\u2019t see the bookstore implementing new security measures soon unless they see it affecting their bottom line.<\/p>\n<p class=\"MsoNormal\">\n<p class=\"MsoNormal\">While it\u2019s very philanthropic of the bookstore to provide opportunities for students who are less well financially endowed to obtain their sets of four hundred dollar textbooks for free, it\u2019s not in their best interests in this case, and it doesn\u2019t have to be this way. I believe the easiest and most effective ways to increase the determination and ingenuity required to walk out the bookstore with free books are the bag check and receipt check methods together. They would make things much more difficult. Yes, they would also inconvenience the customers, but not enough to deter them from coming. Plus it\u2019s a reasonable to request it of the customers. Think of it this way: at ten dollars an hour, it would cost the bookstore 480 dollars to employ two people to do bag check and two to check receipts for one weekday (twelve hours). That\u2019s not so much to ask; think of the potential for loss when the bookstore is crowded. One person per hour could walk out with a single one hundred dollar book (less than the price of the average math or science textbook) and the store would never notice. That\u2019s twelve hundred dollars in one day that they won\u2019t be seeing again, and with hundreds of people walking past the books each hour, it&#8217;s not too much of a stretch to imagine. The question isn\u2019t can they afford to do it; it\u2019s can they afford not to?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Everyone knows the bookstore sells books only after a tremendous markup. But does that really mean they can afford to employ lax security? Consider the situation of the books department: all of the textbooks for every class in the university &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2009\/01\/16\/security-review-uw-bookstore\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":90,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,5],"tags":[208],"class_list":["post-450","post","type-post","status-publish","format-standard","hentry","category-physicalsecurity","category-security-reviews","tag-security-reviews"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/90"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=450"}],"version-history":[{"count":8,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/450\/revisions"}],"predecessor-version":[{"id":457,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/450\/revisions\/457"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}