Hot answers tagged

230

Obscurity isn't a bad security measure to have in place. Relying upon obscurity, as your sole or most substantial security measure, is more or less a cardinal sin. Kerckhoff's Principle is perhaps the most oft-cited argument against implementing security through obscurity. However, if the system is already properly secure according to that principle, this ...


145

I think the assumption here is wrong. They don't have physical access to the machine. They have supervised access to a very limited control panel for a machine which is built into a bomb-proof safe, bolted to the ground and hooked up to an alarm system with an armed response force. Get the machine out of the vault and away from supervision and then yes... ...


127

ATM are supposed to be tamper resistant, and to actively react upon any detected breach of physical security, notably by marking bills with some highly conspicuous and hard to remove ink, and also by committing honourable seppuku. For that matter, an ATM should be compared with HSM, payment terminals and smart card. You can imagine the ATM as a kind of Davy ...


119

That's what the envelope is (or should be) for: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened. All you need to do is that should your management ever require your password, change the ...


115

In some places they have a saying: "opportunity makes the thief". All you're doing by screen-locking a computer is making the cost of hacking it just a little bit harder. Security is an economic good, with a price and a value. The value of locking is somewhat larger than the price of locking it. Sort of like how in good neighborhoods, you don't need to ...


106

The simple answer is: nothing. This has already been done for many years, with keys being cast or created from blanks using hand drawn copies, photographs, remembered shapes etc all being successfully used, both by locksmiths and criminals. A 3D printed key will do just as well, if strong enough, or it could be used to cast a key if necessary, or as ...


102

Keeping the design secret does not make the door insecure per se; however, believing that it adds to security is a dangerous delusion. If revealing the details of the authentication system would allow breaking it, then that system is pure junk and should be discarded. Therefore, if you did your job properly, then revealing the details should be harmless. If ...


82

As the guys previously said, nothing! Even more, I've been working on such a project myself at the university! (albeit I don't say this as an official target, of course) I am trying to do duplicate a key from a single photo, with some assumptions to make it a realistic problem such as having a coin of a known size next to it for size calibration and ...


80

In 2011 the news was reporting on HP Printers catching fire. HP Responded saying that there was a hardware element called a "thermal breaker" to prevent this from happening. The researcher never produced a burning pile of printer. Also in 2011 Charlie Miller was researching the firmware on Apple's batteries trying to get them to explode or catch fire. ...


77

My advice would be to remove the secrets from the drop-box and store them elsewhere. Your instructions have to be easily human readable by anyone, but they can include instructions on how to get access to the properly secured part of the data. That lets you separate the accessibility side of things from the security side. Once you can think about security ...


72

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks): Theft - An attacker could steal the server or disks, to attack at their pace. This allows an attacker to take their time, and you have no idea if they've actually gained access to data. Physical Modification - If I ...


71

Get a USB device. Put all secrets on the USB, preferably in a KeePass file. In the documentation, tell the new person where the USB is and how to unlock it, but put the device in a secure physical location like the owner's office, the company safe, a secure deposit box, etc. Somewhere out of the reach of the public, and away from the prying eyes of other ...


60

All other answers are fine. I'm going to offer you a classic security perspective. Starting a fire/flood is a textbook scenario for physical penetration/exfiltration. People under stress are less likely to challenge strangers. A fire can be used to destroy forensic evidence, in particular when there's insider involvement. An earthquake or, indeed, any ...


55

Consider getting a software product which fully encrypts your hard drives. Such a software will prompt the user to enter the password used to encrypt the hard drive during boot. Without the correct password, the hard drive (including both the OS and any data) can not be decrypted, the system won't boot and the user won't get any access to the data. In that ...


54

It's a risk management thing, really. An attacker with a short window of opportunity (e.g. whilst you're out getting coffee) must be prevented at minimum cost to you as a user, in such a way that makes it non-trivial to bypass under tight time constraints. Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. Taking the time ...


51

The answer to your question is yes, though whether this will ever actually help them is dependent on the lock and their 'skill'. With a typical (cylinder?) deadbolt repeated attempts can advance an impressioning attack with a key blank (see tylerl's answer for more detail), if using picking tools the extra visits will improve the feel for the lock and in ...


51

It comes down to the classic security triad; Integrity, Confidentiality and Availability. The last of which could certainly suffer from any type of natural disaster, which is why you must include it in your continuity plan.


48

CISSP is an information security certification not a computer security certification. Information security is about the protecting the confidentiality, integrity, availabity of information in general. Information is not only stored on computers. They are printed out and stored in filing cabinets, they are memorized and stored in your employee's brains. ...


45

Yes, there's a classic attack that involves incremental access. The attacker starts out with a blank key and a lighter (or candle, or similar). Before visiting the door, he uses the lighter to put a thin layer of soot on the top edge of the blank key. The attacker approaches the door, puts the key in, jiggles the key a bit, grumbles something about how the ...


44

It sounds unlikely. As @schroeder says - a mag stripe must be physically run through a reader. So if you must "swipe" the card to get access, you must swipe the card to copy it. While a pickpocket can take a card out of your pocket, if the card is still in your possession, it's unlikely that this interaction was part of the theft. Keep in mind, however, ...


43

When you read up on the source quoted in the article, you will notice that it apparently isn't talking about a "real" Farraday cage around the Sistine Chapel (putting a whole building under a wiremesh dome would be ridiculous even for the Catholic church) but rather about a figurative one in form of: the installation of equipment which blocks any ...


42

This would really depend on whether you care or not of being detected in the process and how much you're willing to invest into equipment, but sure. Provided there aren't some other, obvious signs the camera is on, such as the pan and tilt motors working Low-tech approach: This is actually really similar to how doctors test patients for involuntary reflex ...


41

The adage is still accurate. Physical access to the machine is not the same as physical ability to interact with the machine. The vast majority of attacks against a physical box involve actually altering the hardware and there is a limited amount you can do to alter the hardware of an ATM as it is locked in a safe, away from the user. It is, however, ...


41

Stick a little button on the tower itself, which also has to be pressed in order to open the flap. Plate #1 from my pending patent application.


38

Microsoft already has done something like this with their product key alphabet. They selected a subset of characters that are distinctive, and excluded characters that could lead to either confusion or offensive words. The 24 used are: 2346789BCDFGHJKMPQRTVWXY The 12 unused are: 015AEILNOSUZ The hyphen character is used to separate five character groups, ...


38

Absolutely nothing. On one occasion, a convicted killer in Australia actually duplicated a master key of his own prison cell just by looking at the physical keys carried by the guards. He successfully escaped from prison and was on the run for 12 days before being captured. So if a prisoner with only raw metal and a good memory can copy a key, I think ...


38

Like most embedded hardware (routers, etc), their firmware often sucks, and unless you have unlimited time I'm afraid there is no way to thoroughly check every single camera out there. And even if you do find one that's currently secure, what guarantees that you'll get updates for vulnerabilities that will be discovered in the future ? Instead, I suggest ...


37

Mag strips need to be cloned via a mag strip reader, not by close proximity. RFID can easily be cloned by proximity.


37

Here's some academic research on stealing keys from afar with a hi-resolution camera: Our SNEAKEY system correctly decoded the keys shown in the above image that was taken from the rooftop of a four floor building. The inlay shows the image that was used for decoding while the background provides a context for the extreme distances that our system can ...


36

I've experimented with this attack previously. It depends on a few variables. First, the strength in mW of the laser you are using. Second the quality of the camera you are trying to disable. 1 - How does this laser attack apply to cameras? A laser creates a super bright and focused spot on the CCD (camera sensor). This spot can be bright enough to ...



Only top voted, non community-wiki answers of a minimum length are eligible