The physical components of an IT system.

learn more… | top users | synonyms

35
votes
8answers
7k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
12
votes
2answers
1k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
13
votes
2answers
28k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
51
votes
4answers
21k views

How do you destroy an old hard drive?

How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
11
votes
2answers
474 views

USB to Firewire converter is a security issue?

So: https://en.wikipedia.org/wiki/IEEE_1394#Security_issues FireWire has security issues. But what happens if there isn't any FireWire ports on the given machine, and ex.: the Operating system ...
6
votes
3answers
1k views

SSD (Flash Memory) security when data is encrypted in place

I'm surveying current techniques on flash memory security. I've learned that the non-in-place update of flash memories prevent us from adapting the same encryption techniques that we used on hard ...
15
votes
2answers
3k views

Wireless keyboard sniffing risk

I've just acquired a wireless keyboard/mouse combo (Microsoft Wireless Desktop 3000). Only after having plugged it in did it get me thinking. How susceptible are those kind of setups to sniffing? Are ...
14
votes
2answers
2k views

Tamper-proof BIOS password & settings storage with Trusted Platform Module?

In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS. My question is: On modern PCs equipped with a Trusted Platform Module ...
8
votes
2answers
469 views

How to implement secure device identification in a for-pay wifi router to prevent usage fraud?

After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be. I know that certain research has focused on ...
7
votes
3answers
389 views

Sourcing hardware that is least likely to contain backdoors

I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
75
votes
9answers
12k views

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack ...
23
votes
4answers
10k views

How reliable is a write protection switch on a USB flash drive?

I'm currently using a USB flash drive with a live distribution. At times I would plug it into terminals I cannot trust. My threat model here is solely the risk of unauthorized modifications to the ...
11
votes
6answers
882 views

Best method of retiring hard drives

What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
2
votes
1answer
816 views

Is hardware based disk encryption more secure that software based?

As a spin-off of my question on "Advice on buying an encrypted disk" -- and in an effort to address the question "how is hardware based disk encryption better?" -- I've started a new question. My ...
8
votes
4answers
3k views

How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?

Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
4
votes
4answers
651 views

VGA/HDMI Based Attack

Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side? How about HDMI or DVI? And if so, are there known malware or PoCs to do that? or is it theoretically ...
12
votes
2answers
365 views

Is OpenGL a security problem?

Today, almost all desktop and most mobile operating systems and devices support some version of OpenGL. I'm wondering about the security implications of that: In many cases, the GPU has complete and ...
9
votes
2answers
2k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
10
votes
3answers
579 views

OWASP Top 10 style security guide for implementation in hardware devices

I've seen OWASP Top 10 guides for web apps, native apps, etc., but never anything for embedded systems or hardware devices. These usually involve microcontrollers (e.g. Atmega / PIC) or small ...
13
votes
6answers
1k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
11
votes
5answers
2k views

What is the benefit with using encrypted RAM Memory?

I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed. Why is RAM Memory needed to be encrypted? and is this done by the hardware, the ...
4
votes
3answers
8k views

How secure is WD MyPassport lock

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the ...
10
votes
3answers
1k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
8
votes
4answers
410 views

Best practices for physically securing a notebook

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
7
votes
2answers
438 views

How to circumvent compromised CPUs in major FOSS operating systems

As Matthew Green puts it, "the NSA has been ... Working with hardware ... vendors to weaken encryption and random number generators." At this stage, however, there is little public knowledge of which ...
6
votes
3answers
3k views

Recover the prior contents of RAM from a turned-off PC?

I've heard that if your PC is turned off, then an attacker can recover the RAM from the last session. I find this hard to believe. How could it be done?
6
votes
2answers
528 views

WORM media types

Why types of media are Write Once Read Many (WORM) other than CD-R, and DVD-R, say, something in the 100GB range? Are there such devices? What would it take to read them? Are the devices like this ...
6
votes
4answers
1k views

Is it possible to make one processor look like another?

(aka) Is it possible to hack CPUID instruction or BIOS to make it show wrong CPU information? Yesterday, I was having a chat with computer sales guy. He is little close to me. During the conversation ...
6
votes
3answers
999 views

Secure hard drive disposal: How to erase confidential information

When it comes to disposing of hardware that may contain PII, confidential, or other sensitive material, how do you determine what needs special handling? What process do you use? I'd like to expand ...
2
votes
1answer
430 views

Are there GPS tracker for laptops?

Are there location tracker hardware (GPS receiver) which can be fitted inside of a laptop and it sends live location data to a remote location ? If yes, how to detect such trackers ?
2
votes
2answers
297 views

Literature about IT security from a hardware standpoint

Can you point me to any book, blog, paper, anything about IT security on the lowest possible level (hardware)? I'm primary interested in the motherboard, CPU & GPU, however, if you know any good ...
6
votes
2answers
701 views

Do Flash memory (SSD) architecture impacts encryption techniques?

I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique? What are the problems I might ...
5
votes
3answers
303 views

An OS that does not trust its RAM?

I wonder if it is possible to write a kernel that would keep all of its RAM encrypted, storing the key in the CPU cache, so that the machine would be resistant to cold-boot attacks?
4
votes
3answers
169 views

Disk Erasing Security - Odd Number of Writes

As one can find in the Disk Utility/Erase/Security Options section, there are two options for erasing disks securely - zero out 7 times or zero out 35 times. Where these numbers come from?
4
votes
2answers
639 views

How is hibernation supported, on machines with UEFI Secure Boot?

I've been learning about UEFI Secure Boot, which attempts to prevent "bootkits" by locking down the boot process so that only signed bootloaders and kernels can be loaded. Hibernation seems like a ...
4
votes
2answers
385 views

Are there volatile memory chips which dont retain data after power off?

It was demonstrated that dram modules can retain information up to 10 min after power off in certain conditions. My question - are there memory types which will retain data 10 sec at max even if being ...
3
votes
3answers
545 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
2
votes
1answer
190 views

Can linux (be made to) detect foreign connections to the ram bus?

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
2
votes
1answer
125 views

What devices/types of devices typically have unique associated ID numbers?

Background (not necessary to read; just what makes me ask): Say someone's computer has either been hacked, or is running software run by $LARGE_EVIL_CORPORATION, and the hacker/$L wants to collect as ...