The physical components of an IT system.
10
votes
2answers
517 views
“Friend” stole SD card. Tracing an SD card?
First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my ...
3
votes
2answers
84 views
Disk Erasing Security - Odd Number of Writes
As one can find in the Disk Utility/Erase/Security Options section, there are two options for erasing disks securely - zero out 7 times or zero out 35 times. Where these numbers come from?
11
votes
1answer
141 views
Is OpenGL a security problem?
Today, almost all desktop and most mobile operating systems and devices support some version of OpenGL. I'm wondering about the security implications of that:
In many cases, the GPU has complete and ...
2
votes
1answer
128 views
TrueCrypt External Multimedia Hard Drive
Hi Guys i am in a bit of a Bind and cant find the Answer on the WWW so her is my question
I have a external Multi Media Hard Drive (1.36tb) so i made 4 partition a 350 gb
Then i shredded the free ...
19
votes
2answers
348 views
Aviation security - Lessons to learn from PlaneSploit
A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level.
Now we have a presentation by Hugo Teso from n.runs AG ...
2
votes
1answer
54 views
What devices/types of devices typically have unique associated ID numbers?
Background (not necessary to read; just what makes me ask):
Say someone's computer has either been hacked, or is running software run by $LARGE_EVIL_CORPORATION, and the hacker/$L wants to collect as ...
3
votes
4answers
373 views
Is it ok to cut some digits from the front-face of a credit/debit card?
I'm a European expat living in Asia. I usually hide my credit card at my apartment. However, I'm a bit scared about losing it when I carry it (wallet robbed or lost).
That's why I already scrubbed ...
1
vote
1answer
96 views
Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer
I am looking for keyboards with a built in SmartCard reader, where the Smartcard can be unlocked directly without going via the computer. The keyboards I found so far connect the SmartCard reader via ...
5
votes
2answers
189 views
Software security V.S Hardware security
In theory, perfect software applications are possible but in real life, they don't exist. When attackers know the software, they can send payloads to exploit vulnerabilities and run any arbitrary code ...
0
votes
0answers
23 views
Secure delete with urandom? [duplicate]
What recovery techniques (if any) exist that can recover data from a mechanical HDD if the user has filled the disk with a single run of dd if=/dev/urandom of=/dev/[disk]?
Or in other words: is this ...
0
votes
3answers
385 views
Best practices for firewall hardware
I'm planning to implement a linux based firewall/router with at least 6 x 1Gb NIC's (network with ~300 computers/server with >=8 VLANs)
Can anybody recommend hardware best practices (reference to ...
3
votes
1answer
99 views
Is this a security risk for us to lost TPM or others to access to reset BIOS ?
In the previous post Physically secure the system case it is recommended to physically protect the system. But in case stolen laptops where intruder have physical access to TPMs. What are the security ...
4
votes
2answers
194 views
How is hibernation supported, on machines with UEFI Secure Boot?
I've been learning about UEFI Secure Boot, which attempts to prevent "bootkits" by locking down the boot process so that only signed bootloaders and kernels can be loaded.
Hibernation seems like a ...
3
votes
1answer
227 views
How does UEFI Secure Boot prevent “evil twin” spoofing attacks?
I've been learning about UEFI Secure Boot. It is designed to prevent malware from infecting the boot process and overwriting the bootloader. It has hardware-level protections to ensure that only a ...
5
votes
2answers
147 views
How do you know a computer is not compromised when you first get it?
How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?
0
votes
2answers
294 views
Encrypted flash drives
I have searched the web for information on secure encrypted USB flash drives. I have found that the most secure encryption is hardware-based like Kingstom DT4000 for example.
Why is a simple USB ...
1
vote
1answer
160 views
File system history on USB drives
I want to find out who deleted a specific file from a USB disk.
The disk is formatted as NTFS. The file was deleted while the disk was plugged into a Windows 7 system. However, while I do have ...
1
vote
0answers
112 views
Embedded hardware training courses in the UK? [closed]
To be honest I struggled a little to find an appropriate exchange to put this question..!
I like to study 'hardware hacking' i.e. reverse engineering of both the hardware components and the firmware ...
10
votes
1answer
233 views
Slot machine segfault: what can we determine?
We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
5
votes
3answers
186 views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
2
votes
2answers
167 views
3
votes
4answers
252 views
Malware via power outlet
This is perhaps a very dumb question, but as I have no knowledge nor experience of IT security I have no option but to ask here.
Is it possible to get malware onto your computer or smartphone by ...
5
votes
1answer
151 views
How does virtualisation (IaaS) protect from CPU microcode updates and firmware changes?
Is it safe to assume that it's impossible for CPU Microcode updates and firmware updates to be initiated from a guest VM?
What software or hardware technologies protect my guest OS from altering or ...
3
votes
3answers
173 views
Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?
It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
5
votes
3answers
347 views
Does any tablet support remote attestation?
Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
8
votes
3answers
442 views
OWASP Top 10 style security guide for implementation in hardware devices
I've seen OWASP Top 10 guides for web apps, native apps, etc., but never anything for embedded systems or hardware devices. These usually involve microcontrollers (e.g. Atmega / PIC) or small ...
0
votes
2answers
151 views
Bypassing Trusted Computing
I have not been able to find any information about trusted computing, scourge of freedom, on the Internet. I am reasonably sure that it's software manifestation can be bypassed by a Linux live disk, ...
7
votes
3answers
289 views
Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?
According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
6
votes
4answers
354 views
Keyboard sniffing through audio recorded typing patterns
I've been thinking about this for a while; I know people are aware of wireless wiretapping of keyboards. However, has there been research on how to wiretap keyboards based on typing patterns? I'm ...
7
votes
3answers
1k views
Does a working JTAG diagnostics port on Android phone add unnecessary risk?
Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it.
...
7
votes
2answers
218 views
Can a webcam be turned on when disabled in Windows' device manager?
In addition to whether a webcam can be turned on without the indicator light, I was wondering if disabling the device in Windows' device manager is a good option.
Of course when your system is ...
4
votes
5answers
360 views
Securing the hardware of my computer against remote exploits
How can I secure the BIOS, video card, network card, PCI, etc. of the computer against remote exploit? I have heard that it is possible to remotely exploit a computer using vulnerabilities in these ...
0
votes
1answer
103 views
How far beyond using Shred should I go when deleting files? [duplicate]
Possible Duplicate:
How can I reliably erase all information on a hard drive?
I'm looking to securely erase my files. Is shred the best option besides ditching the hardware? To what lengths ...
1
vote
1answer
238 views
What kind of hashing is generally used in log-in modules?
Do operating systems hash the log-in password?
What hash function is used in Windows XP, 7, 8,Linux Ubuntu, Debian, MAC Lion OS X ,...?
Where should I look to know these security considerations of an ...
4
votes
3answers
311 views
VGA/HDMI Based Attack
Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side?
How about HDMI or DVI?
And if so, are there known malware or PoCs to do that? or is it theoretically ...
2
votes
2answers
244 views
Seeking advice on how to build a box to brute force hashes? [closed]
I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
10
votes
4answers
1k views
How can mini-computers (like Raspberry Pi) be applied to IT security?
It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more ...
2
votes
2answers
239 views
Electromagnetic induction attacks - reverse TEMPEST?
I know that electromagnetic emissions from a device can be used to extract information from a system, e.g. TEMPEST or Van Eck phreaking.
I also know it's possible to induce a signal into a ...
5
votes
3answers
402 views
How to destroy old credit card?
What is the best (in terms of security) way to destroy old (but still working) credit card?
3
votes
1answer
127 views
Equipment required for sniffing data / address buses via EM emission
What kind of equipment would be required to sniff data from the electromagnetic emissions of data / address buses on an average motherboard?
I'd imagine a sensitive hall probe, a faraday cage and ...
0
votes
1answer
296 views
What kind of network tapping/sniffing hardware can be used to install NIDS or examine networks? [closed]
I'm looking for a device that can be plugged in between a client computer and a switch and records all ethernet packets and puts it into a pcap file or similar in order to analyse it with wireshark.
...
4
votes
2answers
273 views
Can I use hardware random number generation on my computer? Am I already using it?
A lot of computer security depends on encryption: SSL connections, TCP packet sequencing, encrypted files, etc. These depend on random number generation to ensure that attackers can't guess the ...
2
votes
1answer
424 views
EMV Security? How is it possible that it's secure?
I recently read some articles on EMV and the various ways in which it has been improved over the years. I then read this which shows that it has been possible for some time to exploit EMV via a man ...
2
votes
2answers
238 views
How do hard-wired backdoors work?
How can a vulnerability be hardwired?
Just read this article, which got me thinking. Is there simply vulnerable software running on a piece of hardware that is read/write only or..?
3
votes
1answer
253 views
Trial version security
I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system.
I have handled most ...
2
votes
1answer
757 views
good product to physical lock down a mac mini server?
Since recent theft of a mac mini and macbook pro Im looking into products to lock down the mac mini server 2011 model. There are many cable solutions out there like kensington but the mac mini has no ...
6
votes
3answers
567 views
Have hardware trojans been seen in the wild?
Military and intelligence organizations have spent a lot of resources guarding against the possibility of hardware trojans, unauthorized modifications to hardware circuits that leak information or ...
28
votes
12answers
3k views
Is it possible to turn a computer into a bomb?
I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
8
votes
2answers
10k views
Can wiped SSD data be recovered?
I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
4
votes
2answers
129 views
What aspects of hardware configuration are significant from a security perspective?
What is worth keeping in mind (security-wise) when choosing a set of hardware?
For example, might a cheap (or obscure) setup like a Raspberry Pi make for a less secure server than a more standard ...
