The physical components of an IT system.
58
votes
9answers
8k views
What would one need to do in order to hijack a satellite?
I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites.
What would be required to hack a satellite (in general terms, any hack ...
39
votes
5answers
6k views
How do you destroy an old hard drive?
How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
28
votes
12answers
3k views
Is it possible to turn a computer into a bomb?
I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
21
votes
5answers
1k views
Can a hard drive be destroyed by drowning?
These are some ways of disposing of hard drives: Special firms, degaussing, hammering, pulling apart.
Can this be accomplished more quickly by drowning it? Fill a bucket with water, maybe add some ...
19
votes
2answers
364 views
Aviation security - Lessons to learn from PlaneSploit
A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level.
Now we have a presentation by Hugo Teso from n.runs AG ...
18
votes
6answers
3k views
How can I reliably erase all information on a hard drive?
As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also.
Methods for flash drives ...
16
votes
5answers
470 views
What should I do when classified information stayed on a unauthorized laptop?
Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?
How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
16
votes
4answers
5k views
How reliable is a write protection switch on a USB flash drive?
I'm currently using a USB flash drive with a live distribution. At times I would plug it into terminals I cannot trust.
My threat model here is solely the risk of unauthorized modifications to the ...
14
votes
2answers
2k views
Wireless keyboard sniffing risk
I've just acquired a wireless keyboard/mouse combo (Microsoft Wireless Desktop 3000). Only after having plugged it in did it get me thinking. How susceptible are those kind of setups to sniffing? Are ...
13
votes
3answers
913 views
How should one properly dispose of a printer or fax which is used for sensitive documents?
If you need to dispose of printers or fax machines that have handled sensitive documents, how should they be handled? Should you permit them to be donated or sold for reuse outside the organization?
...
12
votes
6answers
651 views
How can the impact of cold boot attacks be minimized?
Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
11
votes
5answers
514 views
Checking if notebook is clean of hardware spyware
Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware?
What should be looked for? How should it look?
If any visual tutorials with photographs are ...
11
votes
2answers
323 views
HSM track records?
What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
11
votes
1answer
148 views
Is OpenGL a security problem?
Today, almost all desktop and most mobile operating systems and devices support some version of OpenGL. I'm wondering about the security implications of that:
In many cases, the GPU has complete and ...
10
votes
6answers
2k views
How can mini-computers (like Raspberry Pi) be applied to IT security?
It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more ...
10
votes
6answers
619 views
Best method of retiring hard drives
What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
10
votes
2answers
710 views
“Friend” stole SD card. Tracing an SD card?
First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my ...
10
votes
1answer
249 views
Slot machine segfault: what can we determine?
We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
10
votes
1answer
386 views
SCADA / PLC exploit code was released in metasploit. Now what?
Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities.
They say it's so easy, the ...
10
votes
2answers
981 views
Tamper-proof BIOS password & settings storage with Trusted Platform Module?
In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS.
My question is: On modern PCs equipped with a Trusted Platform Module ...
9
votes
3answers
463 views
OWASP Top 10 style security guide for implementation in hardware devices
I've seen OWASP Top 10 guides for web apps, native apps, etc., but never anything for embedded systems or hardware devices. These usually involve microcontrollers (e.g. Atmega / PIC) or small ...
9
votes
3answers
128 views
How serious are security concerns of wireless healthcare devices?
Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
8
votes
2answers
11k views
Can wiped SSD data be recovered?
I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
8
votes
5answers
1k views
What is the benefit with using encrypted RAM Memory?
I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed.
Why is RAM Memory needed to be encrypted? and is this done by the hardware, the ...
8
votes
4answers
339 views
Best practices for physically securing a notebook
If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
8
votes
5answers
809 views
Keyboards immune to signal monitoring?
Reading a couple questions and answers here recently got me to thinking.
Wireless keyboards run the inherent risk of exposing their data due to the relatively broad transmission range, and the ease ...
8
votes
2answers
553 views
Protecting cellphones from USB attacks (a.k.a. Juice Jacking)
We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB.
The visual assumption ...
8
votes
1answer
189 views
Cons of disabling live CD in bios
It has been suggested that for security reasons it's a good idea to change the boot order to prevent booting from a live CD or USB. But if you lose the passwords to unlock hard drive and bios, and you ...
8
votes
4answers
508 views
How to track a laptop after theft?
Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible.
...
8
votes
2answers
333 views
How to implement secure device identification in a for-pay wifi router to prevent usage fraud?
After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be. I know that certain research has focused on ...
7
votes
5answers
526 views
Can a mobile phone battery contain malware?
It has 3 terminals and is presumably a smart battery.
I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50.
The ...
7
votes
3answers
337 views
Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?
According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
7
votes
3answers
1k views
Does a working JTAG diagnostics port on Android phone add unnecessary risk?
Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it.
...
7
votes
2answers
232 views
Can a webcam be turned on when disabled in Windows' device manager?
In addition to whether a webcam can be turned on without the indicator light, I was wondering if disabling the device in Windows' device manager is a good option.
Of course when your system is ...
6
votes
3answers
139 views
Is it safe to attach a potentially malicious hard drive to a Solaris machine?
We bring in hard drives from un-trusted sources and would like to ensure that they will not contain any harmful content.
What kind of risk is there for Solaris? As in, if Solaris is running, and I ...
6
votes
3answers
834 views
SSD (Flash Memory) security when data is encrypted in place
I'm surveying current techniques on flash memory security. I've learned that the non-in-place update of flash memories prevent us from adapting the same encryption techniques that we used on hard ...
6
votes
3answers
591 views
Have hardware trojans been seen in the wild?
Military and intelligence organizations have spent a lot of resources guarding against the possibility of hardware trojans, unauthorized modifications to hardware circuits that leak information or ...
6
votes
2answers
877 views
Are TPM chips or the equiavlent required for FIPS 140-2 security level 1 compliance?
A 'TPM chip' is:
a secure cryptoprocessor that can store cryptographic keys that
protect information
FIPS 140-2 requires a cryptographic module, which can be hardware, software, or both that ...
6
votes
2answers
571 views
Do Flash memory (SSD) architecture impacts encryption techniques?
I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique?
What are the problems I might ...
6
votes
4answers
2k views
How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?
Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
6
votes
2answers
2k views
Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?
I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of.
Does anyone have a ...
6
votes
1answer
91 views
Building's server room is unlocked: What danger is my building in?
In one of the building I work in, there are lawyers and accountants, web developers and marketers, and numerous other small businesses. Everyone's (shared) internet is routed through the same server ...
6
votes
4answers
388 views
Keyboard sniffing through audio recorded typing patterns
I've been thinking about this for a while; I know people are aware of wireless wiretapping of keyboards. However, has there been research on how to wiretap keyboards based on typing patterns? I'm ...
6
votes
1answer
218 views
Epson Projector security threats
I have an EPSON PROJECTOR (model EB-824H)
And I would like to use it in our company.
As I know (but not sure) this kind of projector has no WIFI,no network card and there is no HD in this PROJECTOR
It ...
6
votes
3answers
213 views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
5
votes
3answers
503 views
Is it possible to make one processor look like another?
(aka) Is it possible to hack CPUID instruction or BIOS to make it show wrong CPU information?
Yesterday, I was having a chat with computer sales guy. He is little close to me. During the conversation ...
5
votes
3answers
448 views
How to destroy old credit card?
What is the best (in terms of security) way to destroy old (but still working) credit card?
5
votes
5answers
730 views
Is there any way to write-protect a USB or hide its contents from deletion without hardware modifications?
Data on external storage devices are not secure, I understand that. Despite hardware modifications they can still be hacked etc. However files can be hidden (steganography) or encrypted.
I'm ...
5
votes
3answers
656 views
vt-d Virtualisation and Trusted Execution Technology
Being a long time VirtualBox user and having recently purchased a new laptop equipped with an intel i7 720QM I discovered that it supported vt-d.
In the meantime I've found out that vt-d comes with ...
5
votes
2answers
163 views
How do you know a computer is not compromised when you first get it?
How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?
