The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
30 views

Altering assembly without affecting digital signature

I have discovered a software crack where the license check assembly (.NET) has been altered but the digital signature and the strong name are both still perfectly intact. Strong naming is easy to ...
5
votes
2answers
154 views

Mitigating forensic memory acquisition when an attacker has physical access to a workstation

My question regards whether or not the mitigations I use are appropriate for my threat model. Please don't jump to conclusions and say "you need to use locks" or "you can't leave your computer ...
1
vote
2answers
114 views

Don't encrypt the hard drive, but make it impossible to change things without a password?

I recently bought an SSD drive and realized that my CPU (Celeron 1007U - has no AES instructions) cannot really keep up encrypting it and the SSD doesn't have hardware encryption built in. This made ...
7
votes
4answers
225 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
36
votes
8answers
4k views

How to know whether a textfile has been edited or tampered with?

Is it possible to know whether a textfile, e.g. in XML format, has been edited or tampered with over time? The context to my question follows: I am a scientist in industry using a technology called ...
1
vote
2answers
89 views

How could an hard-token be packaged such that the recipient could trust it?

I purchased a Yubikey NEO, which arrived in a small plastic thing, inside of a padded envelope. An attacker with access in transit would have had basically unlimited ability to manipulate it. Which ...
37
votes
2answers
4k views

How can it be easy to write but “impossible” to extract the private key from a crypto token?

A number of crypto-dongles make the claim that it is impossible to extract the stored private key once written. Yubico: The YubiKey AES Key information can never be extracted from a YubiKey ...
3
votes
3answers
458 views

Tamper proof hardware - not resistant

Can you make a TPM (or any piece of hardware) Completely tamper-proof? The “regular” tamper resistant hardware has various physical attacks http://www.milinda-perera.com/pdf/EKKLP12a.pdf I have been ...
4
votes
1answer
40 views

safely changing distribution, is there a strategy to get an distro iso image untampered?

I can check that an Ubuntu iso file is indeed untampered using the public keys already present and trusted in my Ubuntu system. Now I want to switch from Ubuntu to Arch and I wonder how I can start ...
2
votes
3answers
109 views

is there a way to indirectly uncharge rapidly a coin cell to defeat an anti tampering mechanism?

An anti tampering mechanism of a device relay on detect tampering mechanism when the device is powered down using the energy provided internally by a coin cell. Is there a way to uncharge rapidly a ...
2
votes
2answers
1k views

Protecting hidden form fields

The scenario is as follows: An application has a web interface through which data can be configured. The data to consider for this question is Users with a many-to-many relationship with Groups. ...
9
votes
1answer
250 views

Physical security - responsible disclosure

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...
0
votes
6answers
157 views

If I want to protect a string from modification, is it enough to salt and hash it?

There is a particular string (URL) that I need to send from my webserver to the browser. The browser will need to inspect the string and later send it back unmodified (aka request the resource that ...
7
votes
2answers
879 views

Is there any Linux distro or kernel patch that wipes a process memory space after the process exits?

An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, ...
9
votes
2answers
1k views

How does one evaluate tamper-resistant envelopes/packaging?

In contrast to digital cryptographic algorithms and protocols where many qualified high-IQ individuals dig into the details and specifics, physical tamper resistance for low-tech packages is not ...