Tag Info

Hot answers tagged

138

No, you are just being paranoid. You were probably already connected to him over WiFi. There are many attacks he could have run this way without additional devices. Also if he would have wanted to hack you, he would not have thrown his strange hacking device in your face. He would have hidden it below the table. Side note: I feel like most of the people ...


116

Perhaps he was using one of these wireless chargers that are built into the tables. It certainly fits your description.


36

I don't know what that gizmo is, but unless you've got a really bizarre laptop, it wouldn't be useful for attacking your computer. Outside of a laboratory setting, attacking a computer means using its standard input or output capabilities. An ordinary wifi or Bluetooth antenna can reach your laptop from anywhere in the room; a directional antenna can ...


11

As @cremefraiche said, the object fits the profile of an wireless iPod/iPhone charger. As the coil works as an antenna, it could theoretically be used to send data from the device. To investigate if this device is charger or a surveillance bug, you can try to pry it open. If the 30-pin connector has anything else than the power-lines connected, it is ...


7

Although I agree with the other posters that the device in question probably was not a hack attempt, I disagree with their conclusion that he was not trying to hack you. In fact, I recommend adopting the strategy that everybody is trying to hack your equipment. That sounds paranoid, but it leads to the type of security that is more difficult (i.e. ...


6

You are asking the wrong question. EMP and "magnetic stuff" is not your true concern. First, "EMP/magnetic stuff" will not wipe your harddisks, unless something really unexpected happens, such as a nuclear bomb going off in the stratosphere (and that will likely destroy the circuits, but not likely wipe the platters), or you putting the harddisk onto an ...


6

Trusted Platform Modules A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic keys used for encryption. Many laptop computers include a TPM, but if the system doesn’t include it, it is not feasible to add one. Once enabled, the Trusted Platform Module provides full disk encryption capabilities. It ...


5

From a security perspective, you can achieve the same security either through a review of the component (which you want to achieve with an open-source baseband through the many-eyes-principle), or proper isolation. Open source The first appproach is very hard, as regulatory authorities need to certify your baseband firmware. Because of this certification ...


5

If your laptop has an RFID/NFC reader (some Dell laptops have them) then yes an antenna can be used to "talk" to the laptop and exploit a vulnerability in the reader's driver, but readers are usually placed near the touchpad rather than behind the laptop, and while this antenna can most likely send any data to the reader, I doubt it's sensitive enough to ...


4

In theory, no. The outer shell is a Faraday Cage, so the radiation from the microwave will not penetrate the shell to do anything to the plates. But it will render most of the control board unusable. The radiation can damage the controller chips, and arcing can damage the board tracks and passive components. But swapping the control board could make the ...


4

Non-executable memory regions are an example of a hardware-based countermeasure: the non-executability of the memory is enforced by the memory management unit. Heap overflow protection can also be implemented at the hardware level (by placing non-readable memory pages at the ends of a heap allocation), but usually isn't, because it greatly reduces the ...


4

No, doesn't seem to be anything. Understandable: there is almost zero consumer demand for such a product and it would be very expensive to develop (because of the expensive certification you need from Telecom regulatory authorities). By the way, you're probably worrying about the wrong thing. The main concern with baseband processors is not that the ...


4

The AES competition received 15 candidates, two of which suffered from "academic breaks" (weaknesses that are only theoretical, but still demonstrate that the underlying block cipher is not "optimally secure"). The remaining 13 are, to my knowledge, still unbroken to this day. Therefore, the choice of Rijndael had to be done for reasons other than security. ...


4

The microcontroller (a really tiny computer) in the HSM prevents it - your computer (or whatever device is talking to the HSM) can't directly interact with the memory chip that holds the keys, it has to go through the microcontroller which will allow you to do some operations using the keys (that microcontroller will do the operation and just give you the ...


4

One solution is to require all firmware to be signed and have the device check the signature before writing that firmware image to its memory; my current laptop has an option to enable this in its BIOS (the option is permanent - if I enable it now I can't disable it anymore, that's why I didn't enable it). There are many drawbacks however : induces a ...


4

The following is a possible series of steps you could take. I'm considering that you have a secondary, online HSM for the period during which the affected HSM is removed from service for repair. Destroy all key material on the HSM Notify vendor of device problem and serial number Return device in tamper evident packaging to vendor address using secure ...


4

When you're installing an OS you'll almost always be creating partitions and formatting them anyway, so any previous data left on the drive shouldn't be an issue, unless this "data" is actually malicious and designed to exploit a vulnerability in the filesystem creation tool, but I haven't heard of such flaws yet. The only exception would be Windows which ...


3

Here's a whitepaper from logitech on the technology. They seem to believe it is secure, and apparently the two devices are paired at the factory. The actual key never gets broadcast. It has a short range of about 33 feet. It certainly isn't 100%, but if you're worried about the NSA... I doubt this is your biggest problem. A regular keyboard is most likely ...


3

It's not Android[1] but I'm really excited about the Neo900. I loved my old Nokia N900 and thought it was years ahead of it's time. The Neo900 upgrades the internals with fully open source software and hardware. They don't have open source base band firmware but they do specifically address that in their FAQs. I suspect that's as close as you can get. ...


3

The name of $TxfLog.blf is self-explanatory: The extension blf indicates a CLFS log file, and TxF stands for Transactional NTFS. You can see that TxF is just a temporary file that backs up transactions to help against sudden crashes, just like similar precautions in modern databases. There can exist some leakage from this file, but it only would consist of ...


3

Many copy machines and all-in-one scan/print/copy/fax machines (especially from HP) have internal hard drives they use for temporary storage. It's been in the news from time to time that people have recovered sensitive data from these drives, either using data-recovery software or by simply reading the drive filesystem.


3

Is it common for scanners to somehow cache or log documents they scan (on the scanner machine itself)? Yes, probably nearly all which aren't specially designed to be hightly confidential Does scanner driver/software often have temporary folders which end up leaving a trace of the document? Yes also. Can a networked scanner maliciously or ...


3

You are somehow thinking that dead tree docs are less secure than digital copies. I may venture to say you are mistaken in this belief. Digital data may be stolen in a myriad different ways. The scanner may be reporting to HP or other companies/agencies, while your computer may be already compromised. Your computer will have vestigial data on the hard ...


3

Can This be done? I would say yes, but with some caveats. Depending on the cable and the data, you would need some very expensive / sensitive equipment to pull this off. To me this is a similar issue to the old Van Eck Phreaking (http://en.wikipedia.org/wiki/Van_Eck_phreaking). Intel has some tech to circumvent this kind of attack: ...


3

BSI: Application Notes and Interpretation of the Scheme (AIS) 31 – Functionality Classes and Evaluation Methodology for Physical Random Number Generators, Version 1 (25.09.2001), English translation. BSI's AIS site is here. Standard is here.


3

I don't know for you but I always felt like Android especially is not safe. Is somebody - the government or other - able to listen to my microphone, or access my hard drive remotely? Why do you think Android might be especially vulnerable? I expect the NSA has the tools to snoop in on practically anything connected to the Internet. I'm wondering if ...


2

I was curious (and perhaps board) so I just ran a quick test to see... I took an old flash drive (4gb was my smallest one), did a quick reformat (to NTFS) and tossed a simple text file on there. Using FTK Imager, I took a before and after image of my drive (just the raw data dump). I used disk wipe to wipe (using the defaults and basic wipe settings) my ...


2

I don't know exactly if Disk Wipe works by overwriting the partition data, or the disk data. If it only overwrites partition data, there can be files left on hidden partitions. If you are confortable with Linux, it's very easy to nuke out a disk. Assuming your disk is on /dev/sdb, you could do this: sudo dd if=/dev/zero of=/dev/sdb bs=65536 oflag=direct ...


2

For a “normal” computer (eg. may be infected but has no extra malice), booting from CD/usb, wiping the disk and performing a complete reinstall should be enough. Now, if the CIA is (knowingly) selling you the hardware where you will be storing the location of Russian submarines, you better throw that hardware away. It could do anything from sinply giving ...


2

The usual computations on password entropy take place in the context of a dictionary attack, especially an offline dictionary attack, where the attacker can try passwords at will without locking anything. When there is an auto-locking tamper-resistant hardware, the context changes. Conceptual view: there are N possible passwords (to simplify the exposition, ...



Only top voted, non community-wiki answers of a minimum length are eligible