Tag Info

Hot answers tagged

12

A USB device with "manipulated firmware" can sure do evil things. For an extreme case, see this answer: the USB device may tell to the OS "hey, I am the FireWire-to-USB converter X.Y, please download my driver from your vendor, then grant me full DMA access when I say so". Though theoretical yet, this is not science-fiction, and it sure is scary. For more ...


11

What isn't documented, is not documented. All we can do is infer. From the documentation, we see that the password must be re-entered in a number of conditions (drive unplugged, computer shut down, computer put to sleep...) which boil down to: the drive was not powered at some time. This hints at a security feature done on the drive itself, not in software ...


11

Given a sufficiently smart adversary with significant resources, you can't. There are five potential attack vectors: Malware on the disk within a partition. Malware within the boot sector. Malformed partition or filesystem structures that exploit bugs in your OS (example) Malware within disk firmware. Modified hardware (e.g. replace the firmware PROM with ...


11

No. Litecoin uses an algorithm called scrypt which has variables that determine the amount of CPU/RAM required to compute hash. Litecoin's scrypt parameters are fixed at N = 1024; p = 1; r = 1. (http://cryptocur.com/litecoin/) Users of Scypt for password hashing purposes should have the parameters set much, much higher which will put password cracking out ...


9

Any bug in the handling of USB devices can be exploited by malicious hardware. That's how the PS3 Jailbreak worked. Remember that when you plug a "USB Flash drive" in a machine, you cannot be sure that what you plug is really "just a Flash drive". The machine sees it as a "USB device" which may claim to be a keyboard, a mouse, a network interface... A ...


8

The security issues with FireWire come from Direct Memory Access: the FireWire hardware can read RAM contents directly, and (that's the critical part), the FireWire device gets to tell what parts of the RAM should be read and when. Of course, under normal operations, a FireWire device will not read RAM unless the machine tells it to do it; but a malicious ...


8

The main reason for getting hardware firewall is also not because the computer is directly vulnerable to attacks, it's because you need a fast performing device, which is manageable and has the ability to do complex filtering. Getting a hardware firewall for just one computer is a bit silly. The amount of possible attack vectors is reduced as less various ...


7

Theoretically, to ascertain what a chip does, you break it apart and reverse-engineer it. In practice, this will be nigh impossible to do. Actually, even for software, for which you have the actual source code, you cannot guarantee that the code really always does what you believe it does (otherwise we would be able to produce bug-free code). This is not a ...


7

for example, if my laptop is stolen and my house is exploded I suggest that the initial test run involve renting a safe deposit box at a nearby bank to do your offsite backup storage in. This is probably the best answer as well. If you want to get fancy, get a larger safe deposit box and pack the HD in an anti-static bag, then in a small layer of ...


6

Jamming is the radio equivalent of shouting. The jammer drowns your communications under a lot of noise. Defence against jamming usually is a combination of the following: Power: speak louder. I.e. increase the power of your radio-emitting apparatus, so that it will take more noise to drown it. Of course, this increases energy consumption and heat ...


6

The AES instructions have to produce the proper output. If they were tampered with in a way that changed output, it would be detected very quickly, and there have been no reports of that. This limits the scope of tampering considerably (to side channels and such), and I can't see that being readily exploitable by the NSA. A random number generator is a ...


6

Wikipedia is correct: on SD cards, you have to trust the host system (whatever the card is plugged in to) to honor the physical write protect switch. Here is the relevant text from the publicly available specification documents. Emphasis is mine. SD Specifications Part 1 Physical Layer Simplified Specification Version 4.10 January 22, ...


5

There is no actual evidence of any backdoor and it would be nigh impossible to check anyway, save by "opening" the case and inspecting all the transistors one by one, with an electronic microscope -- there are billions of them, so this is not feasible. Backdoors of that magnitude tend to be revealed by disgruntled insiders, not by external analysis. ...


5

Jamming is used either by fools or by clever professionals. The jammer can be triangulated by professional-level direction-finders (see source of this answer for a sample link) in half no time (unless special steps are taken by the attacker) What is jammed cannot be eavesdropped (okay, it's not as easy as that, but will suffice for the simplest case) ...


5

You are misinterpreting the article. The author never claims the infection came from communication over a microphone, see this passage: For most of the three years that Ruiu has been wrestling with badBIOS, its infection mechanism remained a mystery. A month or two ago, after buying a new computer, he noticed that it was almost immediately infected ...


5

Coin relies on the loophole that they're not a merchant or a middle-man handling payment data; they're just an electronic form of a physical wallet and the data is always with the customer (on the Coin itself). This is apparent in their FAQ: Q. Does Coin have a PCI PA-DSS validation? A. The PCI Security Standards Council PA-DSS program addresses ...


5

There is no way circumvent a malicious CPU. Malware can run at different layers on modern compute systems. From top to bottom; Application level, user-mode, kernel-mode, boot-sector, firmware and finally microcode. To understand the true significance of these levels, a layperson would first need to understand the process which occurs every time their ...


4

The original claim isn't that a computer was infected over the speakers, but rather information was transmitted between infected machines that way. Specifically, he found that the malware evolved over time, changing its behavior in reaction to his reverse-engineering techniques. That alone is quite impressive, but he also found that the infected machines ...


4

It is totally feasible to write appreciable amounts of data in a "covert" fashion under these conditions. What is written on the disc is a filesystem: a sequence of bytes which encodes a number of files and directories. There are two main places where covert data would be hidden: In the "holes" in the filesystem. In particular, files will use an integral ...


4

BIOS Most memory chips I've worked with have a W or R/W pin which selects the write mode. Physically tying that one to appropriate logical level should do the trick. Write-protected USB drives I'm a bit suspicious about this one. I've implemented microcontroller<->SD card interface, and the "write-protect" bit is handled completely in software, so you ...


4

The raspberry pi runs on the ARM1176JZF-S processor. ARM is used in more devices than just the Rpi. ARM exploitation is certainly possible. Have a look at the following papers: A Short Guide on ARM Exploitation Effective and efficient bufferoverflow protection Return Oriented Programming for the ARM Architecture Also have a look at this Defcon 18 ...


4

I did a talk at Blackhat a few years ago (actually 10 now) that revisited Trusting Trust: http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-maynor.pdf I followed up with an article written for Linux Journal in 2005: http://www.linuxjournal.com/article/7839 I've been researching this topic for almost 15 years now and I can tell you the takeaway from ...


4

Non-executable memory regions are an example of a hardware-based countermeasure: the non-executability of the memory is enforced by the memory management unit. Heap overflow protection can also be implemented at the hardware level (by placing non-readable memory pages at the ends of a heap allocation), but usually isn't, because it greatly reduces the ...


4

From a security perspective, you can achieve the same security either through a review of the component (which you want to achieve with an open-source baseband through the many-eyes-principle), or proper isolation. Open source The first appproach is very hard, as regulatory authorities need to certify your baseband firmware. Because of this certification ...


3

Your question is not very clear. If you mean that the main CPU includes some backdoor for eavesdropping, then in principle, all bets are lost. No matter what protections the operating system might include, the CPU could simply not execute them (but pretend to). In practice, if such a backdoor was identified, there might be a way to work around it, because ...


3

Technically no, although it depends on what you mean by "secure". Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, ...


3

Short answer: Yes. Hardware firewalls are vulnerable to infection in similar ways as computers because they are simply just another computer. There is no such thing as a "hardware firewall". These are simply dedicated computers with dedicated operating systems and dedicated software etc. It is still a computer which runs software which therefore could be ...


3

As @Tom_Leek said: make the tool run a local Web server seem to be the way used: I take a look at the indicated URL and find on the first line of main.js: //url for the local server var BASE_DIR = '/inc/support/myheadset/updater/'; var LOCAL_SERVICE_URL = 'http://127.0.0.1:8011/'; The downloaded program run a local web server to interact with browsers.


3

When you install the local tool, anything goes (and it even requires local administrator rights !). The tool can inspect the USB hardware, and just needs a way to "talk" to the Web page. A relatively simple way is to make the tool run a local Web server, and have the page reference that Web server as an iframe. Thus, the user (you) will see the ...


3

PCI-DSS is only required for merchants, but not for clients. The risk of getting access to the device would be the same as loosing your wallet with the 8 cards in it. The one thing which is important to note is that this is not going to work in countries where only Chip&PIN is accepted and swiping is not a possibility anymore. (most European countries ...



Only top voted, non community-wiki answers of a minimum length are eligible