Security Review: Laptop Locks
Most modern laptops have a slot in them that allows the user to affix a lock to the chassis. The locks usually come in the form of metal cables with a combination or keyed lock on one end which fits into the side of the laptop. The mechanism locks around a metal bar inside the computer, which is attached securely to the frame. While these locking mechanisms do succeed in deterring mild, spontaneous theft, they are definitely not safe to be used in many scenarios.
The most obvious asset being protected in this case is the laptop itself. Computer hardware is expensive, so they are often a target for theft. They can easily be wiped clean and resold for profit. The second important asset protected by computer locks is the data and software on the computer. Many laptops hold important private information or expensive software that cannot easily be replaced. Thieves can take advantage of personal information, such as credit card or social security numbers for their own benefit.
There are many adversaries that would want to steal a laptop. These include petty thieves looking to redistribute stolen electronics for profit, identity thieves who use personal information to obtain credit cards in other peoples’ names, and intelligence operatives stealing government secrets. In the last two cases, the information or data on the laptop is more important to the thieves than the value of the laptop itself.
Laptop locks have many vulnerabilities. Firstly, the metal cable used to secure the laptop to an immobile object can be cut using special clippers or electronic cutting tools. Another major weakness is user error–a person can attach the lock correctly to the laptop, but fail to attach it correctly to a sturdy object, or in some cases the anchoring object may be moved or compromised in some way to circumvent the locking mechanism. Finally, laptop locks do not prevent a laptop from being used or prevent data from being taken off of the laptop (physically or electronically). An adversary could dismantle the laptop and remove the hard drive without worrying about the lock.
The bottom line is that laptop locks should only be used for specific purposes–when someone needs to leave a laptop unattended for a short amount of time and where the laptop does not contain incredibly sensitive information. In many cases, laptop locks are used as part of a larger defense-in-depth scheme (i.e. locking a laptop to a desk inside a locked office) to provide extra protection. The locks definitely do work to deter mild theft, where a potential adversary identifies an opportunity to steal a laptop, but decides that it is not worth the effort. It is also important for the user to ensure that the lock is used properly and that it is attached to an appropriate immobile anchor.