The physical components of an Information Technology system. It can consist of network equipment, servers, CPUs, hardward security module, smartcards, etc. When using this tag, also include an additional tag for the specific type of hardware.

learn more… | top users | synonyms

100
votes
8answers
20k views

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack ...
75
votes
8answers
18k views

How is 'Removing RAM' a security risk?

Today I was watching a video on 'Ethical Hacking' where, while discussing hardware attacks, the narrator said: Removing RAM or components from a desktop or a laptop Here's a screenshot: I ...
66
votes
7answers
22k views

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

I was using my laptop at a Starbucks on a table, and a person was using a laptop on the same table across from me, a couple seats to my side. He flicked some plastic thing across the table towards my ...
65
votes
5answers
38k views

How do you destroy an old hard drive?

How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
63
votes
8answers
17k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
56
votes
7answers
6k views

Closed source binary blobs in chipsets - privacy threat?

I wanted to buy a Librem Purism 13 because I care about my privacy and generally wanted a laptop to test Linux on. However, I was advised against it because it uses Intel i5 processors which contain ...
54
votes
6answers
11k views

Can RAM retain data after removal?

Is it possible for RAM to retain any data after power is removed? I don't mean within a few minutes such as cold boot Attacks but rather 24 hours plus. Working with classified systems the policy ...
46
votes
7answers
9k views

How are GPUs used in brute force attacks?

I have read that GPUs can be used in brute force attacks? But how can this be done and is there a need for any other hardware devices (hard disks for instance)? Note: I'm more interested in web ...
42
votes
11answers
9k views

Is it possible to turn a computer into a bomb?

I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
37
votes
2answers
4k views

How can it be easy to write but “impossible” to extract the private key from a crypto token?

A number of crypto-dongles make the claim that it is impossible to extract the stored private key once written. Yubico: The YubiKey AES Key information can never be extracted from a YubiKey ...
33
votes
7answers
5k views

Is it possible to secretly monitor/backdoor hardware?

I've recently gained an interest in anonymity and the technical aspects of it. Is it possible for hardware to be bugged and monitored? I.e, can a seller of a processor bug it in order to report what ...
33
votes
6answers
65k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
32
votes
6answers
20k views

How reliable is a write protection switch on a USB flash drive?

I'm currently using a USB flash drive with a live distribution. At times I would plug it into terminals I cannot trust. My threat model here is solely the risk of unauthorized modifications to the ...
29
votes
12answers
4k views

Is there a secure way to transfer data outside the Internet?

Since, recently, it has been proven that transferring data through the usb port is fundamentally flawed, I'm wondering if there are 100% secure ways to transfer data without using the Internet. ...
29
votes
3answers
3k views

Can malware be transmitted via a USB charger plugged into a wall socket?

I have a smart phone that I often plug into a wall socket for charging via a small adapter that rectifies the AC to DC power and transforms the voltage from line (120V or 240V) to 5 V DC, probably ...
26
votes
6answers
17k views

Can a hard drive be destroyed by drowning?

These are some ways of disposing of hard drives: Special firms, degaussing, hammering, pulling apart. Can this be accomplished more quickly by drowning it? Fill a bucket with water, maybe add some ...
25
votes
5answers
38k views

How secure is WD MyPassport lock

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the ...
22
votes
2answers
1k views

Aviation security - Lessons to learn from PlaneSploit

A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level. Now we have a presentation by Hugo Teso from n.runs AG ...
20
votes
5answers
11k views

Recover the prior contents of RAM from a turned-off PC?

I've heard that if your PC is turned off, then an attacker can recover the RAM from the last session. I find this hard to believe. How could it be done?
20
votes
2answers
5k views

Wireless keyboard sniffing risk

I've just acquired a wireless keyboard/mouse combo (Microsoft Wireless Desktop 3000). Only after having plugged it in did it get me thinking. How susceptible are those kind of setups to sniffing? Are ...
19
votes
6answers
727 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
17
votes
6answers
2k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
16
votes
3answers
4k views

How should one properly dispose of a printer or fax which is used for sensitive documents?

If you need to dispose of printers or fax machines that have handled sensitive documents, how should they be handled? Should you permit them to be donated or sold for reuse outside the organization? ...
15
votes
5answers
3k views

Are consumer-grade routers any more or less vulnerable? [closed]

I apologize if this is an obvious question, I'm not very familiar with hardware. I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
15
votes
4answers
250 views

How serious are security concerns of wireless healthcare devices?

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
15
votes
2answers
3k views

Tamper-proof BIOS password & settings storage with Trusted Platform Module?

In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS. My question is: On modern PCs equipped with a Trusted Platform Module (TPM)...
14
votes
2answers
2k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
13
votes
7answers
5k views

Strategies against jamming attacks?

We have some devices which are designed to use standard frequencies/protocols, such as GSM, CDMA, GPS, Wifi and Bluetooth, among others. While our focus is not thought to be used for high-profile ...
13
votes
5answers
1k views

Checking if notebook is clean of hardware spyware

Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware? What should be looked for? How should it look? If any visual tutorials with photographs are ...
13
votes
4answers
3k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 &...
13
votes
1answer
574 views

Is the Litecoin Scrypt hashing technique a threat to hashed passwords?

The Bitcoin alternative, Litecoin uses a different algorithm to protect the block chain, namely Scrypt (not Sha256). Given that GPU accelerators exists, and ASICS are due to be released, does the ...
13
votes
2answers
1k views

HSM track records?

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
13
votes
1answer
964 views

SCADA / PLC exploit code was released in metasploit. Now what?

Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities. They say it's so easy, the ...
12
votes
5answers
6k views

What is the benefit with using encrypted RAM Memory?

I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed. Why is RAM Memory needed to be encrypted? and is this done by the hardware, the ...
12
votes
6answers
2k views

Best method of retiring hard drives [duplicate]

What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
12
votes
6answers
5k views

How can mini-computers (like Raspberry Pi) be applied to IT security?

It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more available,...
12
votes
2answers
4k views

What are the differences between TPM and HSM?

TPM (Trusted Platform Module) and HSM (Hardware Security Module) are considered as cryptoprocessor, but what are the differences exactly? Does one of them have more advantages than another?
12
votes
1answer
718 views

Slot machine segfault: what can we determine?

We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
12
votes
3answers
10k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
12
votes
2answers
749 views

USB to Firewire converter is a security issue?

So: https://en.wikipedia.org/wiki/IEEE_1394#Security_issues FireWire has security issues. But what happens if there isn't any FireWire ports on the given machine, and ex.: the Operating system ...
12
votes
2answers
855 views

Is OpenGL a security problem?

Today, almost all desktop and most mobile operating systems and devices support some version of OpenGL. I'm wondering about the security implications of that: In many cases, the GPU has complete and ...
11
votes
6answers
2k views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
11
votes
5answers
3k views

Keyboards immune to signal monitoring?

Reading a couple questions and answers here recently got me to thinking. Wireless keyboards run the inherent risk of exposing their data due to the relatively broad transmission range, and the ease ...
11
votes
5answers
846 views

Can a mobile phone battery contain malware?

It has 3 terminals and is presumably a smart battery. I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50. The ...
11
votes
2answers
4k views

Are TPM chips or the equiavlent required for FIPS 140-2 security level 1 compliance?

A 'TPM chip' is: a secure cryptoprocessor that can store cryptographic keys that protect information FIPS 140-2 requires a cryptographic module, which can be hardware, software, or both that ...
11
votes
3answers
587 views

Sourcing hardware that is least likely to contain backdoors

I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
10
votes
3answers
775 views

OWASP Top 10 style security guide for implementation in hardware devices

I've seen OWASP Top 10 guides for web apps, native apps, etc., but never anything for embedded systems or hardware devices. These usually involve microcontrollers (e.g. Atmega / PIC) or small ...
10
votes
2answers
5k views

“Friend” stole SD card. Tracing an SD card?

First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my ...
10
votes
1answer
263 views

How to make sure that the cryptographic hardware accelerator is being used in am335x?

I want to use the AES hardware accelerator in am335x. I was able to generate the cryptodev.ko and cryptosoft.ko drivers. From my application program I am making use of openssl apis in CBC mode, and I ...
10
votes
2answers
13k views

Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?

I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of. Does anyone have a ...