Questions tagged [physical]

The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.

Filter by
Sorted by
Tagged with
44 votes
7 answers
16k views

Methods for protecting computer systems from physical attacks

I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures. Consider the ...
rook's user avatar
  • 47.2k
30 votes
7 answers
4k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
Jonas's user avatar
  • 5,193
14 votes
3 answers
5k views

How can I prevent someone from accessing a Windows XP system via boot disk?

Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one: http://www.raymond.cc/blog/...
Django Reinhardt's user avatar
132 votes
5 answers
27k views

Is momentary physical access dangerous?

I’m asking the question with these conditions: The device (computer or mobile phone) is in a running state. “Momentary” refers to a reasonably short period of time, such as 5 to 10 seconds. The ...
tonychow0929's user avatar
  • 2,257
30 votes
7 answers
2k views

Protecting critical state infrastructure from the aftermath of a nuclear blast

Countries rely on computer infrastructure for a huge percentage of communications and military management, as well as utilities like electricity. Unfortunately, nuclear attacks release massive ...
Polynomial's user avatar
  • 135k
6 votes
2 answers
6k views

Safely disable firewire/thunderbolt, patching up DMA exposure

I understand that Firewire 400/800 and Thunderbolt have DMA enabled, and a malicious hardware device can easily read and manipulate system memory at will. If I disable the software drivers for these ...
directedition's user avatar
131 votes
2 answers
24k views

What to do if caught in a physical pentest?

I've seen a lot of people talk about how to pentest and how NOT to get caught during engagements but have a hard time finding "How to behave when caught during a Red Team engagement". Red Teams are ...
ChocolateOverflow's user avatar
99 votes
13 answers
14k views

Why do we lock our computers?

It's common knowledge that if somebody has physical access to your machine they can do whatever they want with it1. So why do we always lock our computers? If somebody has physical access to my ...
Tom Marthenal's user avatar
89 votes
9 answers
16k views

Secure USB cable for charging in untrusted environments

On a long haul flight, I imagine that charging a phone (in flight mode) with the inbuilt USB port on the head rest would be a security risk. Could I mitigate that risk by taking a regular USB cable ...
DarcyThomas's user avatar
  • 1,298
73 votes
8 answers
70k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
v15's user avatar
  • 1,771
56 votes
13 answers
19k views

Is it possible to turn a computer into a bomb?

I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
rook's user avatar
  • 47.2k
34 votes
2 answers
8k views

Can a connected USB device read all data from the USB bus?

Is it possible for a (malicious) (hardware) USB device to access all the data that is transferred through the USB bus and then read/store this information, essentially sniffing all transferred data? ...
user1049697's user avatar
  • 1,147
27 votes
13 answers
14k views

Is it possible to prevent unauthorized copying or recording of data by photographing screens?

I am thinking on a way which would prevent unauthorized copying or recording of data by photographing screens. I also think, if the content of a screen is understable for an eye of a living human, it ...
peterh's user avatar
  • 3,023
24 votes
7 answers
2k views

Securing the security guy's home office: what should we do?

I read an article in the latest InfoSecurity magazine (an infosec trade rag by Elsevier) saying that us security professionals aren't necessarily taking the correct steps to protect our own home ...
user avatar
13 votes
2 answers
6k views

Write-protection at hardware level for security

It seems to me that to maximise server security, one ought - in addition to the usual security measures implemented in software - to prevent the overwriting of certain parts of the server system, such ...
sampablokuper's user avatar
13 votes
1 answer
3k views

How does full memory encryption in newer processes protect against DMA attacks?

Upcoming Intel CPUs have TME, current AMD processors have SME. These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks. Both support encrypting the ...
nh2's user avatar
  • 583
12 votes
2 answers
2k views

Is it possible to reliably derive a key from a biometric fingerprint?

Many products (e.g. notebooks, security doors and now smartphones) support some form of fingerprint authentication. That seems simple enough: A trusted system compares a stored representation of a ...
lxgr's user avatar
  • 4,243
11 votes
3 answers
1k views

Sourcing hardware that is least likely to contain backdoors

I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
makerofthings7's user avatar
9 votes
3 answers
3k views

Is it possible to determine if the BIOS has been modified between two points in time?

Is it possible to determine if the BIOS of a computer has been modified between two points in time from that computer while it's running ? Effectively I'd like to be able to gather the equivalent of ...
Trey Blalock's user avatar
  • 14.2k
6 votes
2 answers
11k views

I am always Hibernating my System, is there any risk for my Encrypted drive with BitLocker?

I am Always Hibernating my Laptop, for faster booting, I encrypted sensitive drive by BitLocker, what if my Laptop stolen and attacker knew that it was in hybernate mode, can he decrypt my hard?
Akam's user avatar
  • 1,357
42 votes
9 answers
8k views

Is physical security less important with disks on a server being encrypted?

If you could get physical access to a server, you could change the root/admin password even if you did not know the current password. However with encrypted disks, I don't think this is possible (...
user93353's user avatar
  • 2,022
35 votes
2 answers
112k views

Disabling/Destroying CCTV/IP Cameras with Lasers?

@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical ...
Lex's user avatar
  • 4,257
19 votes
9 answers
49k views

Is there any virus that can cause physical damage?

Like damaging a chip on the motherboard, increase the fan's speed till something explodes, or anything similar to that. I am not an IT guru, but I never came across a malicious code that couldn't be ...
Ulkoma's user avatar
  • 8,773
14 votes
2 answers
14k views

Attacks via physical access to USB (DMA...?)

I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or a laptop attached to a desk. Obviously, the boot sequence should be secure (...
Franklin Piat's user avatar
9 votes
5 answers
1k views

How to share passwords *only* after death?

I am looking for a modern, password manager-based way to share my passwords with certain parties (partner, executor of my will) within a week or so of my death, but no sooner. The scenario I wish to ...
Tom's user avatar
  • 199
8 votes
3 answers
10k views

What can a hacker do when he has physical access to a system?

I mean, I'm a tech guy here in my region (not a hacker...). When I sit in the front of another person's PC, I notice a little fear about what I can do in the system. It's obvious that I will not ...
Click Ok's user avatar
  • 369
3 votes
1 answer
492 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
WayToDoor's user avatar
  • 573
3 votes
1 answer
7k views

What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]

I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed out)...
makerofthings7's user avatar
3 votes
3 answers
868 views

Risk when attacker has only physical access to a computer's USB port

Attacker has only access to USB port and can either attach a device or pen-drive to a computer, that can be on or off. Imagine a scenario where non-reliable people have access to offices, either ...
Quora Feans's user avatar
  • 1,891
2 votes
4 answers
2k views

Is there such thing as a password enforced write protected flash drive?

We would like to provide a flash drive to a client, that they can boot to, which includes a read-only operating system of our own customization, probably Linux. Every boot, it starts from clean slate. ...
700 Software's user avatar
2 votes
1 answer
244 views

Possible physical interface attacks on a server [duplicate]

Let's say you have a server at a data centre, but a hacker manages to find a way in and has access to your server. What are the attack possibilities with all the interfaces available? Are there any ...
Kevin C's user avatar
  • 151
-5 votes
6 answers
24k views

Will antivirus detect all keyloggers?

Our company schedules Security Training courses for our personnel. In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
saber tabatabaee yazdi's user avatar
84 votes
5 answers
8k views

Somebody bumped into me, next day my storage unit was burglarized

While I was walking in the street, somebody carrying a laptop bag bumped into me, and the next day I found out that my storage unit was burglarized and some important items were stolen. My storage ...
Green Fly's user avatar
  • 1,957
52 votes
6 answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public-key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
Alex's user avatar
  • 819
34 votes
7 answers
6k views

What are the real physical risks of casual social media publishing?

aka "how to scare my family into stopping publishing their life online?" I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
WoJ's user avatar
  • 9,018
33 votes
1 answer
5k views

How to deal with third parties in physical pentests?

From my previous question, I've seen that a "Permission to Attack" slip is crucial in ANY Penetration Test. However, that question and its answers and comments have only discusses interactions between ...
ChocolateOverflow's user avatar
32 votes
2 answers
56k views

Is there any way to tell if CCTV is on or not?

Is there any way that an attacker can identify if a CCTV camera is on/operational without direct physical access to the cable/camera? If it is on, is there any way an attacker can tell if its being ...
NULLZ's user avatar
  • 11.5k
25 votes
5 answers
4k views

How does a clean desk policy provide security benefits?

I'm starting to study for Security+ using Darril Gibson's book. I took the pre-exam and one of the questions is “What is the most important security benefit of a clean desk policy?” The choices are: ...
user avatar
24 votes
2 answers
6k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
Nicolas Raoul's user avatar
22 votes
3 answers
12k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
Mawg says reinstate Monica's user avatar
15 votes
3 answers
59k views

How many unique house keys can possibly exist?

A Yahoo! answers user suggested that there are 5^5 possible unique configurations for a physical key, but the answer wasn't sourced. I wondered if anyone had similar numbers for how many possible key ...
Lou's user avatar
  • 315
14 votes
3 answers
3k views

In what cases can overly strict security policies be detrimental to organisations?

In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone? I've worked at some companies where ...
Celeritas's user avatar
  • 10.2k
13 votes
1 answer
908 views

How to apply IT Security knowledge to Home Security?

Today my car got stolen from my house, and it is possible the person who did it has access to my home. I try to take secure measures online to maintain security, yet it seems I never paid attention to ...
Rick Rhodes's user avatar
  • 1,102
10 votes
2 answers
1k views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
Terrel Shumway's user avatar
10 votes
4 answers
2k views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks unique ...
makerofthings7's user avatar
10 votes
5 answers
1k views

Best practices for physically securing a notebook

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
Strapakowsky's user avatar
  • 3,089
8 votes
4 answers
1k views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
Christopher King's user avatar
8 votes
7 answers
14k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
zuallauz's user avatar
  • 141
6 votes
5 answers
2k views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...
makerofthings7's user avatar
6 votes
2 answers
286 views

How to handle decomissioned/donated/RMAed printers?

Printers, nowadays, almost always include some form of non-volatile storage that keep tracks of pretty much everything that went through the device. In the case of larger, "departmental" system that ...
Stephane's user avatar
  • 18.7k