Questions tagged [physical]
The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.
69
questions
44
votes
7
answers
16k
views
Methods for protecting computer systems from physical attacks
I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures.
Consider the ...
30
votes
7
answers
4k
views
How to secure a WiFi network?
What do I have to do to secure a WiFi network? Is there any best practices?
I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
14
votes
3
answers
5k
views
How can I prevent someone from accessing a Windows XP system via boot disk?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:
http://www.raymond.cc/blog/...
132
votes
5
answers
27k
views
Is momentary physical access dangerous?
I’m asking the question with these conditions:
The device (computer or mobile phone) is in a running state.
“Momentary” refers to a reasonably short period of time, such as 5 to 10 seconds.
The ...
30
votes
7
answers
2k
views
Protecting critical state infrastructure from the aftermath of a nuclear blast
Countries rely on computer infrastructure for a huge percentage of communications and military management, as well as utilities like electricity. Unfortunately, nuclear attacks release massive ...
6
votes
2
answers
6k
views
Safely disable firewire/thunderbolt, patching up DMA exposure
I understand that Firewire 400/800 and Thunderbolt have DMA enabled, and a malicious hardware device can easily read and manipulate system memory at will. If I disable the software drivers for these ...
131
votes
2
answers
24k
views
What to do if caught in a physical pentest?
I've seen a lot of people talk about how to pentest and how NOT to get caught during engagements but have a hard time finding "How to behave when caught during a Red Team engagement".
Red Teams are ...
99
votes
13
answers
14k
views
Why do we lock our computers?
It's common knowledge that if somebody has physical access to your machine they can do whatever they want with it1.
So why do we always lock our computers? If somebody has physical access to my ...
89
votes
9
answers
16k
views
Secure USB cable for charging in untrusted environments
On a long haul flight, I imagine that charging a phone (in flight mode) with the inbuilt USB port on the head rest would be a security risk.
Could I mitigate that risk by taking a regular USB cable ...
73
votes
8
answers
70k
views
Are powerline ethernet adapters inherently secure?
I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
56
votes
13
answers
19k
views
Is it possible to turn a computer into a bomb?
I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
34
votes
2
answers
8k
views
Can a connected USB device read all data from the USB bus?
Is it possible for a (malicious) (hardware) USB device to access all the data that is transferred through the USB bus and then read/store this information, essentially sniffing all transferred data? ...
27
votes
13
answers
14k
views
Is it possible to prevent unauthorized copying or recording of data by photographing screens?
I am thinking on a way which would prevent unauthorized copying or recording of data by photographing screens.
I also think, if the content of a screen is understable for an eye of a living human, it ...
24
votes
7
answers
2k
views
Securing the security guy's home office: what should we do?
I read an article in the latest InfoSecurity magazine (an infosec trade rag by Elsevier) saying that us security professionals aren't necessarily taking the correct steps to protect our own home ...
13
votes
2
answers
6k
views
Write-protection at hardware level for security
It seems to me that to maximise server security, one ought - in addition to the usual security measures implemented in software - to prevent the overwriting of certain parts of the server system, such ...
13
votes
1
answer
3k
views
How does full memory encryption in newer processes protect against DMA attacks?
Upcoming Intel CPUs have TME, current AMD processors have SME.
These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks.
Both support encrypting the ...
12
votes
2
answers
2k
views
Is it possible to reliably derive a key from a biometric fingerprint?
Many products (e.g. notebooks, security doors and now smartphones) support some form of fingerprint authentication. That seems simple enough: A trusted system compares a stored representation of a ...
11
votes
3
answers
1k
views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
9
votes
3
answers
3k
views
Is it possible to determine if the BIOS has been modified between two points in time?
Is it possible to determine if the BIOS of a computer has been modified between two points in time from that computer while it's running ?
Effectively I'd like to be able to gather the equivalent of ...
6
votes
2
answers
11k
views
I am always Hibernating my System, is there any risk for my Encrypted drive with BitLocker?
I am Always Hibernating my Laptop, for faster booting, I encrypted sensitive drive by BitLocker, what if my Laptop stolen and attacker knew that it was in hybernate mode, can he decrypt my hard?
42
votes
9
answers
8k
views
Is physical security less important with disks on a server being encrypted?
If you could get physical access to a server, you could change the root/admin password even if you did not know the current password.
However with encrypted disks, I don't think this is possible (...
35
votes
2
answers
112k
views
Disabling/Destroying CCTV/IP Cameras with Lasers?
@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical ...
19
votes
9
answers
49k
views
Is there any virus that can cause physical damage?
Like damaging a chip on the motherboard, increase the fan's speed till something explodes, or anything similar to that. I am not an IT guru, but I never came across a malicious code that couldn't be ...
14
votes
2
answers
14k
views
Attacks via physical access to USB (DMA...?)
I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or a laptop attached to a desk.
Obviously, the boot sequence should be secure (...
9
votes
5
answers
1k
views
How to share passwords *only* after death?
I am looking for a modern, password manager-based way to share my passwords with certain parties (partner, executor of my will) within a week or so of my death, but no sooner.
The scenario I wish to ...
8
votes
3
answers
10k
views
What can a hacker do when he has physical access to a system?
I mean, I'm a tech guy here in my region (not a hacker...). When I sit in the front of another person's PC, I notice a little fear about what I can do in the system.
It's obvious that I will not ...
3
votes
1
answer
492
views
What is the fastest way to brute force a hardware code
Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B.
Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
3
votes
1
answer
7k
views
What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]
I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed out)...
3
votes
3
answers
868
views
Risk when attacker has only physical access to a computer's USB port
Attacker has only access to USB port and can either attach a device or pen-drive to a computer, that can be on or off. Imagine a scenario where non-reliable people have access to offices, either ...
2
votes
4
answers
2k
views
Is there such thing as a password enforced write protected flash drive?
We would like to provide a flash drive to a client, that they can boot to, which includes a read-only operating system of our own customization, probably Linux. Every boot, it starts from clean slate.
...
2
votes
1
answer
244
views
Possible physical interface attacks on a server [duplicate]
Let's say you have a server at a data centre, but a hacker manages to find a way in and has access to your server. What are the attack possibilities with all the interfaces available?
Are there any ...
-5
votes
6
answers
24k
views
Will antivirus detect all keyloggers?
Our company schedules Security Training courses for our personnel.
In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
84
votes
5
answers
8k
views
Somebody bumped into me, next day my storage unit was burglarized
While I was walking in the street, somebody carrying a laptop bag bumped into me, and the next day I found out that my storage unit was burglarized and some important items were stolen.
My storage ...
52
votes
6
answers
11k
views
Why does one need a strong password on Unix?
SSH Server: I only allow public-key authentication.
Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
34
votes
7
answers
6k
views
What are the real physical risks of casual social media publishing?
aka "how to scare my family into stopping publishing their life online?"
I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
33
votes
1
answer
5k
views
How to deal with third parties in physical pentests?
From my previous question, I've seen that a "Permission to Attack" slip is crucial in ANY Penetration Test. However, that question and its answers and comments have only discusses interactions between ...
32
votes
2
answers
56k
views
Is there any way to tell if CCTV is on or not?
Is there any way that an attacker can identify if a CCTV camera is on/operational without direct physical access to the cable/camera?
If it is on, is there any way an attacker can tell if its being ...
25
votes
5
answers
4k
views
How does a clean desk policy provide security benefits?
I'm starting to study for Security+ using Darril Gibson's book. I took the pre-exam and one of the questions is “What is the most important security benefit of a clean desk policy?”
The choices are:
...
24
votes
2
answers
6k
views
How do Travel Sentry locks work? (supposedly openable only by security agencies)
Apparently Travel Sentry locks can only be opened:
by their owner,
by the TSA, CATSA and "other security agencies".
How do they work technically?
Is there some electronics embedded with ...
22
votes
3
answers
12k
views
How can vending machines be hacked? And how can I prevent it?
I am developing a vending machine and want to make it secure.
In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
15
votes
3
answers
59k
views
How many unique house keys can possibly exist?
A Yahoo! answers user suggested that there are 5^5 possible unique configurations for a physical key, but the answer wasn't sourced. I wondered if anyone had similar numbers for how many possible key ...
14
votes
3
answers
3k
views
In what cases can overly strict security policies be detrimental to organisations?
In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone?
I've worked at some companies where ...
13
votes
1
answer
908
views
How to apply IT Security knowledge to Home Security?
Today my car got stolen from my house, and it is possible the person who did it has access to my home. I try to take secure measures online to maintain security, yet it seems I never paid attention to ...
10
votes
2
answers
1k
views
How do I report a vulnerability to a large organization that doesn't believe it has a problem?
This issue is more political than technical.
The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
10
votes
4
answers
2k
views
What risks are there with a Bluetooth based door lock, and are there any mitigations?
There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this
E0 Encryption flaws
Risks during pairing
Attacks unique ...
10
votes
5
answers
1k
views
Best practices for physically securing a notebook
If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
8
votes
4
answers
1k
views
Must a system be insecure against physical access? If so, why?
Inspired by: Why don't OSes protect against untrusted USB keyboards?
Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.)
There ...
8
votes
7
answers
14k
views
Physical computer security, how to disable USB ports when the computer is 'locked'?
Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
6
votes
5
answers
2k
views
Detecting and filtering data over AC power lines?
Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?
I'm not sure how difficult this is ...
6
votes
2
answers
286
views
How to handle decomissioned/donated/RMAed printers?
Printers, nowadays, almost always include some form of non-volatile storage that keep tracks of pretty much everything that went through the device.
In the case of larger, "departmental" system that ...