The physical components of an IT system.

learn more… | top users | synonyms

75
votes
9answers
12k views

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack ...
51
votes
4answers
22k views

How do you destroy an old hard drive?

How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
36
votes
8answers
8k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
34
votes
11answers
5k views

Is it possible to turn a computer into a bomb?

I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
23
votes
6answers
4k views

Can a hard drive be destroyed by drowning?

These are some ways of disposing of hard drives: Special firms, degaussing, hammering, pulling apart. Can this be accomplished more quickly by drowning it? Fill a bucket with water, maybe add some ...
23
votes
4answers
11k views

How reliable is a write protection switch on a USB flash drive?

I'm currently using a USB flash drive with a live distribution. At times I would plug it into terminals I cannot trust. My threat model here is solely the risk of unauthorized modifications to the ...
20
votes
2answers
654 views

Aviation security - Lessons to learn from PlaneSploit

A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level. Now we have a presentation by Hugo Teso from n.runs AG ...
17
votes
5answers
548 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
15
votes
3answers
2k views

How should one properly dispose of a printer or fax which is used for sensitive documents?

If you need to dispose of printers or fax machines that have handled sensitive documents, how should they be handled? Should you permit them to be donated or sold for reuse outside the organization? ...
15
votes
2answers
4k views

Wireless keyboard sniffing risk

I've just acquired a wireless keyboard/mouse combo (Microsoft Wireless Desktop 3000). Only after having plugged it in did it get me thinking. How susceptible are those kind of setups to sniffing? Are ...
14
votes
2answers
2k views

Tamper-proof BIOS password & settings storage with Trusted Platform Module?

In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS. My question is: On modern PCs equipped with a Trusted Platform Module ...
13
votes
2answers
29k views

Can wiped SSD data be recovered?

I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
13
votes
6answers
1k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
13
votes
1answer
582 views

SCADA / PLC exploit code was released in metasploit. Now what?

Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities. They say it's so easy, the ...
12
votes
2answers
1k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
12
votes
2answers
511 views

HSM track records?

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
12
votes
2answers
375 views

Is OpenGL a security problem?

Today, almost all desktop and most mobile operating systems and devices support some version of OpenGL. I'm wondering about the security implications of that: In many cases, the GPU has complete and ...
11
votes
5answers
810 views

Checking if notebook is clean of hardware spyware

Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware? What should be looked for? How should it look? If any visual tutorials with photographs are ...
11
votes
5answers
3k views

What is the benefit with using encrypted RAM Memory?

I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed. Why is RAM Memory needed to be encrypted? and is this done by the hardware, the ...
11
votes
6answers
3k views

How can mini-computers (like Raspberry Pi) be applied to IT security?

It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more ...
11
votes
6answers
898 views

Best method of retiring hard drives

What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
11
votes
3answers
168 views

How serious are security concerns of wireless healthcare devices?

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
11
votes
2answers
499 views

USB to Firewire converter is a security issue?

So: https://en.wikipedia.org/wiki/IEEE_1394#Security_issues FireWire has security issues. But what happens if there isn't any FireWire ports on the given machine, and ex.: the Operating system ...
10
votes
3answers
597 views

OWASP Top 10 style security guide for implementation in hardware devices

I've seen OWASP Top 10 guides for web apps, native apps, etc., but never anything for embedded systems or hardware devices. These usually involve microcontrollers (e.g. Atmega / PIC) or small ...
10
votes
2answers
2k views

“Friend” stole SD card. Tracing an SD card?

First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my ...
10
votes
1answer
399 views

Is the Litecoin Scrypt hashing technique a threat to hashed passwords?

The Bitcoin alternative, Litecoin uses a different algorithm to protect the block chain, namely Scrypt (not Sha256). Given that GPU accelerators exists, and ASICS are due to be released, does the ...
10
votes
3answers
1k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
10
votes
1answer
429 views

Slot machine segfault: what can we determine?

We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
9
votes
2answers
283 views

How do you know a computer is not compromised when you first get it?

How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?
9
votes
5answers
626 views

Can a mobile phone battery contain malware?

It has 3 terminals and is presumably a smart battery. I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50. The ...
9
votes
2answers
542 views

Can I use hardware random number generation on my computer? Am I already using it?

A lot of computer security depends on encryption: SSL connections, TCP packet sequencing, encrypted files, etc. These depend on random number generation to ensure that attackers can't guess the ...
9
votes
2answers
2k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
8
votes
4answers
413 views

Best practices for physically securing a notebook

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
8
votes
5answers
2k views

Keyboards immune to signal monitoring?

Reading a couple questions and answers here recently got me to thinking. Wireless keyboards run the inherent risk of exposing their data due to the relatively broad transmission range, and the ease ...
8
votes
2answers
2k views

Are TPM chips or the equiavlent required for FIPS 140-2 security level 1 compliance?

A 'TPM chip' is: a secure cryptoprocessor that can store cryptographic keys that protect information FIPS 140-2 requires a cryptographic module, which can be hardware, software, or both that ...
8
votes
4answers
3k views

How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?

Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
8
votes
1answer
255 views

Cons of disabling live CD in bios

It has been suggested that for security reasons it's a good idea to change the boot order to prevent booting from a live CD or USB. But if you lose the passwords to unlock hard drive and bios, and you ...
8
votes
4answers
674 views

How to track a laptop after theft?

Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible. ...
8
votes
2answers
5k views

Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?

I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of. Does anyone have a ...
8
votes
2answers
759 views

Can a webcam be turned on when disabled in Windows' device manager?

In addition to whether a webcam can be turned on without the indicator light, I was wondering if disabling the device in Windows' device manager is a good option. Of course when your system is ...
8
votes
2answers
492 views

How to implement secure device identification in a for-pay wifi router to prevent usage fraud?

After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be. I know that certain research has focused on ...
7
votes
3answers
108 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
7
votes
2answers
461 views

How to circumvent compromised CPUs in major FOSS operating systems

As Matthew Green puts it, "the NSA has been ... Working with hardware ... vendors to weaken encryption and random number generators." At this stage, however, there is little public knowledge of which ...
7
votes
2answers
991 views

Software security V.S Hardware security

In theory, perfect software applications are possible but in real life, they don't exist. When attackers know the software, they can send payloads to exploit vulnerabilities and run any arbitrary code ...
7
votes
2answers
957 views

Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?

Intel's Haswell architecture has support for several new Bit Manipulation Instructions. In Intel's own words, Bit manipulation instructions are useful for compressed database, hashing , large ...
7
votes
2answers
218 views

Building's server room is unlocked: What danger is my building in?

In one of the buildings I work in, there are lawyers and accountants, web developers and marketers, and numerous other small businesses. Everyone's (shared) internet is routed through the same server ...
7
votes
3answers
2k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
7
votes
4answers
1k views

Keyboard sniffing through audio recorded typing patterns

I've been thinking about this for a while; I know people are aware of wireless wiretapping of keyboards. However, has there been research on how to wiretap keyboards based on typing patterns? I'm ...
7
votes
3answers
399 views

Sourcing hardware that is least likely to contain backdoors

I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
6
votes
4answers
1k views

Is it possible to make one processor look like another?

(aka) Is it possible to hack CPUID instruction or BIOS to make it show wrong CPU information? Yesterday, I was having a chat with computer sales guy. He is little close to me. During the conversation ...