Traveler’s Protection Guide: Low Tech Physical OPSEC for a High Tech Job

### Overview Presented at the RSA Conference by Dan and Marco from Kaspersky's Global Research and Analysis Team (GReAT), this talk outlines operational security (OPSEC) best practices derived from over a decade of travel and threat investigations. The presenters stress the core asymmetric defense principle: while an attacker can make numerous attempts, a defender needs only a single mistake to be compromised. To counter risks such as border device seizures, intercepted network traffic, and hotel room burglaries, the session details practical safeguards across both digital and physical realms.

### Key Topics - **Digital OPSEC Foundations**: Defending operating systems, encrypted storage, and secure messaging channels against eavesdropping and data extraction. - **Authentication and Key Management**: Protecting cryptographic keys and accounts using hardware security tokens and two-factor authentication. - **Physical Device Security**: Countering unauthorized physical access, malicious hardware implants, and untrusted peripherals while in transit. - **Hotel and Room Security**: Identifying and neutralizing hidden audio bugs, two-way mirrors, and concealed cameras using accessible techniques.

### Technical Details - **Storage Encryption**: Emphasizes using software-level full-disk encryption rather than relying solely on SSD hardware options. Recommended solutions include BitLocker for Windows, FileVault for macOS, LUKS for Linux, and VeraCrypt for open-source cross-platform usage and plausible deniability via hidden containers. - **Secure Communication**: Recommends GPG email encryption with minimum 4096-bit RSA keys (noting smaller 1024-bit or 2048-bit keys may be susceptible to cracking), storing private keys on hardware tokens. For instant messaging and calls, recommended tools include Signal, Threema (which does not mandate a phone number), Session, Wire, Ricochet (routing over Tor), and self-hosted Jitsi Meet servers. Paid VPN services are recommended over free providers when connecting to public networks. - **Hardware Security Tokens**: Highlights hardware authenticators (such as YubiKeys and nano models) with physical touch confirmation enabled for two-factor authentication and SSH/account administration. - **Physical Countermeasures & Implants**: Cautions against USB/keystroke injection tools (like USB Rubber Ducky), malicious cables (such as O.MG cables), and RF-manipulated adapters. Recommends using USB condoms to physically sever data lines and allow power only, checking device SMART data to detect unauthorized power-on events (evil maid attacks), and shielding RFID/NFC cards. - **Surveillance Countermeasures**: Demonstrates techniques to spot two-way mirrors (fingertip and knock tests), mask acoustic eavesdropping with white noise (e.g., running bathroom water or radio noise), detect spy cameras using reflected lens light or smartphone cameras without infrared filters, locate hidden electronics using portable thermal imagers, and inspect local Wi-Fi MAC addresses and SSIDs using standalone Wi-Fi tools.

### Takeaways - Never leave operational equipment unattended while traveling, even briefly. - Ensure reciprocal security: transmitting data over a hardened channel is ineffective if the receiving endpoint is compromised. - Establish proactive response plans for compromised accounts or lost credentials before embarking on travel. - Implement layered, low-cost physical checks—such as "Do Not Disturb" door signs, stickers over lenses, and power-only charging adapters—to substantially raise the bar for potential adversaries.