How to Bypass Tamper Evident Wristbands

In 2017, 2018 and 2019 we competed in the Tamper Evident Bypass Challenge at OzSecCon in Melbourne. In 2018, after the conference, we put up a post about the 15 challenges and how to bypass them. In 2018 we also presented on bypassing tamper evident seals, many of which were in the competition. We decided it was time we create a How-To video for each of the bypasses so you will be ready for your next tamper evident bypass competition or just to learn new physical control bypass techniques. Here is the first video which shows you how to remove a tamper evident wristband. The full transcript and pictures are also below the video. Have fun and if you have any questions just leave it in the comments and we will get back to you!!!

Hi there Mos and Boo fans. I’m Boo and this is the first video in a series we are putting together on bypassing tamper evident seals and devices. This should get you ready for your next tamper evident competition at a hacker con or just teach you some new life skills. In this first video, I’ll be showing you bypasses for tamper evident wristbands like this which you often see at concerts and conferences.

So this little band here was one of the first types of tamper evident devices I tried to bypass. That was at the BSides Canberra conference way back in 2017. Wow… I was only 6. What were my parents thinking?

Most of you have probably seen these bands if you have been to a concert or some other event where they need an easy way to spot people who have paid or not paid for a ticket. They are usually made of a material called Tyvek which is waterproof, really strong and doesn’t age.

I know this for a fact because I might have left my OzSecCon wrist band on for a few weeks before my parents made me take it off. So sad.

The bands have a sticky end so you can wrap it around your wrist and attach it, but once they are on they have to be cut or ripped off. If you try and peel the sticky bit off it tears and it’s obvious you have tampered with it. This is so you can’t reuse it.

Today I’ll show you an easy way to remove one of these wrist bands and reattach it to someone else without anyone being able to tell you have tampered with it. You will need a few easy to find supplies:

First, of course, is a tamper evident wrist band. You can get these at office works or off eBay really cheaply. The ones I’m using today are from office works and cost 4 dollars for 10 bands.

Next, you need Shellite. It’s a chemical you can get from the hardware or grocery store. We call it shellite in Australia but for our overseas fans, you can probably find it called naphtha.

You will also need a syringe and needle, though you can use a cotton bud but needle works best.

To help lift the end while you unstick it you will need something thin and flat to lift the sticky part with. A shim, lock pick or thin piece of metal will do.

Lastly, you need a victim, I mean volunteer, to put the band on. Today I’m going to use Mos

Mos: wait, what?

Mos come here. Mos. Mos. Come here! Don’t be shy!

I don’t advise trying it on your own arm first time as its hard to hold the wristband and get the right angle with the needle. It’s best to just try it on a band not attached to anything or wrapped around something. A rolling pin works well. I tried it on dad once when I was first learning and he said getting injected with Shellite wasn’t one of the highlights of his life.

First, attach the wristband to something. In this video I’m using my brother Mos.

Once you have the band attached, suck up some of the shellite into the syringe.

The only real secret to removing these type of tamper evident seals, like wristbands or security stickers, is take it slow and don’t flood it with Shellite. If you use too much, especially when its paper or similar, you can ruin it or leave big marks which make it obvious you’ve tampered. Also with the wristbands, if you look at the sticky bit it’s very thin and fragile and easy to rip. They did this on purpose.

Put the point of the needle where the sticky part starts and squeeze a little bit out. As it soaks into the glue the glue stops being sticky and let’s go. Lift a bit slowly with your piece of metal.

You can now get a little deeper in the band. Move the needle under the bit you have lifted and squeeze out a bit more shellite. Then slowly lift again. Keep doing this slowly until you have the whole end lifted off.

Done! Now you can take it off one person and put it back on someone else. If its a bit wet just dab it with a tissue, or your shirt, and soak up any extra Shellite.

Put it back on really slowly and make sure all the little lines are close together with no gaps. If you do it well you can’t even tell its been tampered with!

If you enjoyed this video, make sure you subscribe to our YouTube channel and also click the bell icon so you don’t miss any of our videos. Also, give us a thumbs up if you liked it.

We would love to hear from you in the comments so if you have any comments or have ideas for any videos you think we should do. Let us know. We will be back soon with another tamper evident bypass!