HEART security.tamper-detected H-11005
Tampering detected. Someone may have opened or altered the device or its software.
| Code | HEART security.tamper-detected; inside a message "code": "security.tamper-detected" |
|---|---|
| H-number | H-11005: area 11, code 005 |
| Area | security: Logins, certificates, tampering |
| Typical severity | critical. A product may set another for its own case. |
| Applies to | Devices with a tamper switch, secure boot or signed software |
Likely causes
- The case was opened, and a tamper switch tripped.
- Software changed without a valid signature.
- A debug or service port was used.
- A seal broken during authorised service, which is not tampering but looks the same.
How to fix or prevent it
- Check whether service work explains it.
- If not: take the product off the network.
- Reinstall signed software from the maker.
- Change the passwords and keys it held.
What the HEART does by itself
It raises a critical alert, tells a person at once, and refuses to run unsigned software where the product supports that.
When to call service
Yes, unless authorised service work explains it.
Related codes
security.anomalyH-11007: Security anomalydata.integrity-failedH-10005: Data integrity check failedsoftware.update-failedH-06004: Update failed
Inside a message a code is written bare, "code": "storage.full". In logs, tickets, documents and searches it is written
HEART storage.full. Things that simply happen, such as system.started, are event types, not faults.
The codes are defined in Part 3, Section 5.4, and their H-numbers in Section 5.7.
All of it, as data: fault-codes.json.
All fault codes, by area · All fault codes, by H-number · Problem types (API errors)