New answers tagged

1

What are you describing is an EMP emitter. If the EMP emitter is not strong enough it will not destroy the device, it will only cause an interruption. The EMP pulse power depends on the number of wire wraps, wire thickness and voltage so the EMP power can range. Best way to protect against it is by creating a Faraday cage, this will not provide a full ...


3

It sounds like you're trying to cause/prevent a resettable denial of service condition. If you are ruling out network access to attack the software running on the system, you might consider interfering with the data going through the various devices on the mother board. I'm not an RF engineer or an EE (Electrical Engineer), but it seems though it might be ...


2

Electromagnetic radiation? Many parts of computers (such as Hard Disks) rely on magnets. Provide a sufficient amount of electromagnetic radiation, and the computer is bound to stop working. If the exposure to these waves isn't for too long, there (probably) wouldn't be any permanent damage, the computer would just crash as soon as the hard disk started ...


11

Removing RAM may force a system to swap more so maybe there's a small but higher chance that sensitive information that is stored in RAM is written to a hard drive where it is much easier to recover.


0

I have personally performed the Cold Boot Attack before, it definitely works. I mainly referred to the actual Princeton paper (google princeton cold boot)as well as the McGrew link I used dry ice instead, have to beware of condensation (use tissue to wipe) since the RAM is colder than surrounding air. The time frame in which to pull and plug in the RAM is ...


0

It is possible to steal data from RAM. In the condition that 1) you have external connection to the RAM data and address bus; 2) you will have the way that allow all data to be send to data bus of the RAM (Only possible to have a program to do that without affect the system running); 3) the program should be running at the same level of kernel; In short, ...


0

Just to reiterate what others have said, not only could you shut down a server or device by removing all of its ram, you could steal cryptographic keys. The process generally looks like freezing the ram, removing it, and then placing it into a different machine where it can be analized. This works because while usually when ram loses power, all data is lost, ...


2

The slide mentions that these are physical attack vectors. I don't know the full context of the slide deck, but even just removing RAM from a system can bring an application or system to its knees. The goal of most attacks, physical or cyber, is to disrupt service, steal information, or gain backdoor access for long-term shenanigans (botnets, etc.). ...


4

Depending on what the system was doing, there might be a lot of value in freezing the RAM and dumping it to analyze it. RAM takes many shapes--many types of servers have special RAM that have parity bits in them, so on top of the RAM not immediately 'forgetting' the last thing recorded in a block, it's actually much more likely if you really really cared ...


16

Without more context it's not completely clear, but combined with the line above ("stealing equipment", not "...storage devices/computers") they could be referring to simple theft. This was an issue a few years ago when RAM prices were high - it's very portable. Alternatively DOS-by-theft could be an issue. The same slide refers to "Cutting a fibre ...


110

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to dump the contents - often with the aid of liquid nitrogen. For more information, see the Wikipedia article for Cold Boot Attack.


26

If you log in somewhere (say in a browser, or some application), the password you typed in is temporarily stored in RAM for comparison against the correct password. Most applications assume the RAM is secure and don't clear everything, so it could (and often does) happen that your RAM memory contains passwords and privacy-sensitive data. Now RAM is said to ...


0

As your aim is to "prevent" such an attack, I would focus on physically bolting the case inside a suitable tamper-resistant enclosure and then to the (ideally concrete) wall/floor, with tamperproof fixing. With the power cable inside the housing and not exposed, ventilation made inaccessible, and ideally steel in the enclosure against electromagnetic ...


7

Several motherboards have overheating protection, if the computer or especially the CPU / graphics card gets too hot, the computer will switch off. So ... turn up the heat in the room (with a big heat-source) until the computer starts rebooting indefinetly. It will be hard not to damage other components I think. In order not to target other nearby ...


2

For wireless attacks, you're limited by having to induce currents in the machine, and it's nigh impossible to do that predictably, without going overboard (i.e. EMP style) and causing permanent damage. You could try doing something the (maybe) installed wireless card, but you'd have to know something of the software, and you'd basically be attacking using ...


1

What you are asking about for your storage is often called Air Gap. You can build it quite easily in a number of ways. But there are plenty of drawbacks: Whenever you want to do something with your data, you will have to connect your Memory. Anyone attacking you will simply wait for that moment. Stuxnet seems to have worked that way. Computer viruses ...


1

This is an excellent question. While the obvious answer would be no, there are caveats. "Mechanical switch" is an ambiguous term. Let's assume for a moment that a mechanical switch is one that is actuated by a broad movement (as opposed to pressure). Let's take a look at a typical PSU switch: See those thick prongs? The electrical current that powers ...


2

Maybe If the only power to the external drive comes from the power cord, and it is physically isolated, then no. The malware wouldn't be able to switch it on. However, it is also possible that the drive is able to receive power from the USB connector and, while this is not guaranteed to power it (and thus an external power supply was needed), under the ...


2

Depends Okay so how those switches work depends on the installation of decision of the external drive manufacturer, so we need too look at a few cases: Switch controls the connection of power to the device entirely and uses air gaps Switch controls a circuit that is overseen by the mobo/firmware and is just a serial connection. Wake from USB is possible ...


5

No. The power switch is almost always a mechanical device which cuts off the incoming power from the logic board. When it is off the connection is physically broken - a complete airgap. Malware cannot subvert this. The only case that malware might be able to bypass a "power off" state is when the state is soft, e.g. standby. The device would have to leave ...


0

PhotoRec is a tool that can be used to recover "accidentally" deleted photos and files. This tool can also be used to recover data after a drive was reformatted. A malicious buyer could use this tool to recover your old files. In a defensive tactic, you could use the tool on your own future machine prior to selling it, in order to determine which files ...


3

I'll be using modern Intel CPUs as an example of hardware. For most other hardware, you can identify bugs, but often you cannot patch it, but only work around it by trying to avoid the buggy behavior. Hardware bugs are identified similarly to the ways bugs are identified in closed source software. Internal audits and reports in the wild are mostly ...


0

The only accepted way to erase data from a hard drive using magnetism is through a process called degaussing, which involves using an extremely powerful electromagnet which alternates its polarity thousands of times a second. It is the changing magnetic field which erases data, not the presence of magnetism itself. A human being cannot rotate a magnet fast ...


0

DiskCryptor will likely not benefit from the hardware FDE stuff on the SSD. The best information I can find is that the drive always encrypts, it's just a question of whether or not the key is password protected, as it should be to actually be relevant. If your BIOS/EFI supports it, you can actually enable it there: Security > Password on boot > HDD ...



Top 50 recent answers are included