Tag Info

Hot answers tagged

139

No, you are just being paranoid. You were probably already connected to him over WiFi. There are many attacks he could have run this way without additional devices. Also if he would have wanted to hack you, he would not have thrown his strange hacking device in your face. He would have hidden it below the table. Side note: I feel like most of the people ...


115

Perhaps he was using one of these wireless chargers that are built into the tables. It certainly fits your description.


77

In 2011 the news was reporting on HP Printers catching fire. HP Responded saying that there was a hardware element called a "thermal breaker" to prevent this from happening. The researcher never produced a burning pile of printer. Also in 2011 Charlie Miller was researching the firmware on Apple's batteries trying to get them to explode or catch fire. ...


69

Overview First, I learned a lot of my information from a combination of my amateur radio experience and an awesome talk I sat in at DEFCON 18. The majority of satellite systems are simple repeaters. The signal that comes in on a transponder is cleaned, amplified, and retransmitted. If you know the location and input frequency, and you pump more effective ...


67

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


36

I don't know what that gizmo is, but unless you've got a really bizarre laptop, it wouldn't be useful for attacking your computer. Outside of a laboratory setting, attacking a computer means using its standard input or output capabilities. An ordinary wifi or Bluetooth antenna can reach your laptop from anywhere in the room; a directional antenna can ...


32

Special firms either degauss, destroy or melt the harddrives. Harddrives are magnetic data. Magnetism can be destroyed by either: Degaussing (changing the magnetism) Heating the drive (melting) (which destroys/changes the magnetism) Hammering (shock) (shock damages magnetism somewhat, but the denting of the drive makes it very difficult to read the ...


25

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces. After that, you can optionally degauss the drive to erase the firmware itself. Lots ...


23

It's taking me a few minutes to come up with something beyond, "That's patently damn absurd!" But... I guess like many things, nobody would write it if somebody didn't buy it. My first thought from the formatting and related image is that this was sensationalist crud from a few decades ago. After all, that machine has a 5 1/4" floppy... but they're talking ...


21

What would be required to hack a satellite (in general terms, any hack really)? When it comes to satellites, the word general does not apply. Almost every satellite, with very few exceptions is custom. Even the currently orbiting GPS satellites are not all the same: there are GPS IIA, GPS IIR, GPS IIR-M, and GPS IIF. I would venture that even satellites ...


21

TL:DR - Yes, routers CAN be vulnerable. Misconfigured/Unconfigured routers - A ton of people just install their routers and leave the default accounts turned on without modification. Thus allowing attackers easy access. Vulnerable built in scripts - http://www.reddit.com/r/netsec/comments/1xy9k6/that_new_linksys_worm/ See: What is the ...


20

What isn't documented, is not documented. All we can do is infer. From the documentation, we see that the password must be re-entered in a number of conditions (drive unplugged, computer shut down, computer put to sleep...) which boil down to: the drive was not powered at some time. This hints at a security feature done on the drive itself, not in software ...


15

1. Backdoor testing accounts. Engineers often include backdoor mechanisms and testing accounts in hardware for debugging purposes, with trivial or no security measures put in place to protect them. Unfortunately, a large number of devices make it to market without having these mechanisms and accounts disabled, allowing attackers to gain illegitimate access ...


14

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully. From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once ...


14

There is an element of truth to this one - an attack was discovered which took advantage of data remanence in RAM, allowing an attacker to grab data from the RAM in a machine. There was a very short timeframe (a matter of seconds or minutes) in which to do this, but it wasn't a hack of the PC as such. Simple Wikipedia link to Cold Boot Attack here And the ...


14

You don't. Some vendors do indeed ship backdoors with their products, and many computers come with "crapware" pre-installed as a source of revenue for the manufacturers. Even apps that don't contain a backdoor can cause other damage (e.g. Browser toolbars that track browsing). Same concerns apply with hardware, especially in networking equipment. What you ...


13

@ewanm89 is entirely correct. Securing the connection between ground control and a plane should be no different from securing any regular connection. The main issue is that the protocol designers are relying on security by obscurity. Obscurity through the relatively unknown protocol being used. Obscurity through what used to be relatively difficult to ...


13

No. Litecoin uses an algorithm called scrypt which has variables that determine the amount of CPU/RAM required to compute hash. Litecoin's scrypt parameters are fixed at N = 1024; p = 1; r = 1. (http://cryptocur.com/litecoin/) Users of Scypt for password hashing purposes should have the parameters set much, much higher which will put password cracking out ...


13

Other answers have been given to answer whether routers are secure: your router likely has unpatched vulnerabilities. A recommendation for making things more secure would be to put a real Linux box in front of your router. Configure it for automatic security updates every 10-30 minutes so your patches come quickly. For kernel vulnerabilities, you could use ...


12

The key here is what you define as "every day use" - if you work in an environment where the data is sensitive, your security policy should take into account the risk from wireless interception and if appropriate, the use of wireless devices should be forbidden. Faraday cage equivalents, such as shielded rooms/buildings may be appropriate but are obviously ...


12

There was a presentation at BlackHat yesterday where they used a Arduino to open hotel rooms that are using a certain kind of lock: http://www.h-online.com/security/news/item/Arduino-used-as-master-key-for-hotel-rooms-1652281.html As devices get smaller and more powerful, that are getting better suited to be used as pentesting drop boxes. Examples are: ...


12

In lieu of waxing elequent in a topic that I am only briefly versed, I will defer my response to a DEFCON talk I saw last year that will do at least three things: Blow your mind Expose vulnerabilities in Sats Enlighten your knowledge on the subject in painstaking detail (see item one) Here is the archived talk with video. This is a very nice guy (Matt ...


12

A USB device with "manipulated firmware" can sure do evil things. For an extreme case, see this answer: the USB device may tell to the OS "hey, I am the FireWire-to-USB converter X.Y, please download my driver from your vendor, then grant me full DMA access when I say so". Though theoretical yet, this is not science-fiction, and it sure is scary. For more ...


12

Given a sufficiently smart adversary with significant resources, you can't. There are five potential attack vectors: Malware on the disk within a partition. Malware within the boot sector. Malformed partition or filesystem structures that exploit bugs in your OS (example) Malware within disk firmware. Modified hardware (e.g. replace the firmware PROM with ...


11

This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation. Realize that your system is malfunctioning. It is not operating the the way it was intended to. Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care ...


11

A few observations: It's a 32-bit Linux OS. Difficult to tell which distro - might be something custom. They're running the latest version of Bash shell. It contains an NVRAM device, such as an onboard EEPROM, which failed to initialise due to corruption. These are often used as tamper-proof storage modules that contain the game code. It's on the network ...


11

This should be sufficient at least for the moderately to quite paranoid: Change BIOS settings to boot only from the harddisk, so you can't boot from other devices. Make sure to disable network boot, which is usually in the same menu. Set up a password for changing BIOS settings and for startup, so nobody can get past the BIOS loading screen without ...


11

I'm no pilot, or an aviation expert, but I'm going to stick my neck out on this one and call it a zero substance FUD and an attempt at using our general ignorance on avionic systems as a cheap way of advertising one's so called security expetise. I've read through the presentation (if reading is a proper term for browsing through a few only seemingly ...


11

As @cremefraiche said, the object fits the profile of an wireless iPod/iPhone charger. As the coil works as an antenna, it could theoretically be used to send data from the device. To investigate if this device is charger or a surveillance bug, you can try to pry it open. If the 30-pin connector has anything else than the power-lines connected, it is ...



Only top voted, non community-wiki answers of a minimum length are eligible