Hot answers tagged

234

Obscurity isn't a bad security measure to have in place. Relying upon obscurity, as your sole or most substantial security measure, is more or less a cardinal sin. Kerckhoff's Principle is perhaps the most oft-cited argument against implementing security through obscurity. However, if the system is already properly secure according to that principle, this ...


147

I think the assumption here is wrong. They don't have physical access to the machine. They have supervised access to a very limited control panel for a machine which is built into a bomb-proof safe, bolted to the ground and hooked up to an alarm system with an armed response force. Get the machine out of the vault and away from supervision and then yes... ...


131

ATM are supposed to be tamper resistant, and to actively react upon any detected breach of physical security, notably by marking bills with some highly conspicuous and hard to remove ink, and also by committing honourable seppuku. For that matter, an ATM should be compared with HSM, payment terminals and smart card. You can imagine the ATM as a kind of Davy ...


121

That's what the envelope is (or should be) for: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened. All you need to do is that should your management ever require your password, change the ...


117

In some places they have a saying: "opportunity makes the thief". All you're doing by screen-locking a computer is making the cost of hacking it just a little bit harder. Security is an economic good, with a price and a value. The value of locking is somewhat larger than the price of locking it. Sort of like how in good neighborhoods, you don't need to ...


111

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to dump the contents - often with the aid of liquid nitrogen. For more information, see the Wikipedia article for Cold Boot Attack.


108

The simple answer is: nothing. This has already been done for many years, with keys being cast or created from blanks using hand drawn copies, photographs, remembered shapes etc all being successfully used, both by locksmiths and criminals. A 3D printed key will do just as well, if strong enough, or it could be used to cast a key if necessary, or as ...


104

Keeping the design secret does not make the door insecure per se; however, believing that it adds to security is a dangerous delusion. If revealing the details of the authentication system would allow breaking it, then that system is pure junk and should be discarded. Therefore, if you did your job properly, then revealing the details should be harmless. If ...


86

As the guys previously said, nothing! Even more, I've been working on such a project myself at the university! (albeit I don't say this as an official target, of course) I am trying to do duplicate a key from a single photo, with some assumptions to make it a realistic problem such as having a coin of a known size next to it for size calibration and ...


81

In 2011 the news was reporting on HP Printers catching fire. HP Responded saying that there was a hardware element called a "thermal breaker" to prevent this from happening. The researcher never produced a burning pile of printer. Also in 2011 Charlie Miller was researching the firmware on Apple's batteries trying to get them to explode or catch fire. ...


77

My advice would be to remove the secrets from the drop-box and store them elsewhere. Your instructions have to be easily human readable by anyone, but they can include instructions on how to get access to the properly secured part of the data. That lets you separate the accessibility side of things from the security side. Once you can think about security ...


73

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks): Theft - An attacker could steal the server or disks, to attack at their pace. This allows an attacker to take their time, and you have no idea if they've actually gained access to data. Physical Modification - If I ...


72

Get a USB device. Put all secrets on the USB, preferably in a KeePass file. In the documentation, tell the new person where the USB is and how to unlock it, but put the device in a secure physical location like the owner's office, the company safe, a secure deposit box, etc. Somewhere out of the reach of the public, and away from the prying eyes of other ...


61

All other answers are fine. I'm going to offer you a classic security perspective. Starting a fire/flood is a textbook scenario for physical penetration/exfiltration. People under stress are less likely to challenge strangers. A fire can be used to destroy forensic evidence, in particular when there's insider involvement. An earthquake or, indeed, any ...


57

Consider getting a software product which fully encrypts your hard drives. Such a software will prompt the user to enter the password used to encrypt the hard drive during boot. Without the correct password, the hard drive (including both the OS and any data) can not be decrypted, the system won't boot and the user won't get any access to the data. In that ...


55

It's a risk management thing, really. An attacker with a short window of opportunity (e.g. whilst you're out getting coffee) must be prevented at minimum cost to you as a user, in such a way that makes it non-trivial to bypass under tight time constraints. Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. Taking the time ...


53

Could I mitigate that risk by taking a regular usb cable and cutting the data (but not the power) cables? Or does the usb protocol needs a data handshake to begin charging? Such a cable does exist, so a data handshake must not be required. Such cords are discussed on some Stack Exchange sites: Micro USB cables that only charge but no data, no ...


52

The answer to your question is yes, though whether this will ever actually help them is dependent on the lock and their 'skill'. With a typical (cylinder?) deadbolt repeated attempts can advance an impressioning attack with a key blank (see tylerl's answer for more detail), if using picking tools the extra visits will improve the feel for the lock and in ...


51

It comes down to the classic security triad; Integrity, Confidentiality and Availability. The last of which could certainly suffer from any type of natural disaster, which is why you must include it in your continuity plan.


50

Yes, there's a classic attack that involves incremental access. The attacker starts out with a blank key that fits into the lock in question. The attacker approaches the door, puts the key in, jiggles the key a bit, grumbles something about how the office numbers changing, and leaves. Then in private he examines the impression pattern on the key. Where ...


49

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is faded. But most people don't use the keyboard for just their passwords, and the wear pattern is also influenced by the stroke direction, angle and pressure - ...


48

CISSP is an information security certification not a computer security certification. Information security is about the protecting the confidentiality, integrity, availabity of information in general. Information is not only stored on computers. They are printed out and stored in filing cabinets, they are memorized and stored in your employee's brains. ...


44

It sounds unlikely. As @schroeder says - a mag stripe must be physically run through a reader. So if you must "swipe" the card to get access, you must swipe the card to copy it. While a pickpocket can take a card out of your pocket, if the card is still in your possession, it's unlikely that this interaction was part of the theft. Keep in mind, however, ...


43

When you read up on the source quoted in the article, you will notice that it apparently isn't talking about a "real" Farraday cage around the Sistine Chapel (putting a whole building under a wiremesh dome would be ridiculous even for the Catholic church) but rather about a figurative one in form of: the installation of equipment which blocks any ...


42

This would really depend on whether you care or not of being detected in the process and how much you're willing to invest into equipment, but sure. Provided there aren't some other, obvious signs the camera is on, such as the pan and tilt motors working Low-tech approach: This is actually really similar to how doctors test patients for involuntary reflex ...


41

The adage is still accurate. Physical access to the machine is not the same as physical ability to interact with the machine. The vast majority of attacks against a physical box involve actually altering the hardware and there is a limited amount you can do to alter the hardware of an ATM as it is locked in a safe, away from the user. It is, however, ...


41

Stick a little button on the tower itself, which also has to be pressed in order to open the flap. Plate #1 from my pending patent application.


39

Absolutely nothing. On one occasion, a convicted killer in Australia actually duplicated a master key of his own prison cell just by looking at the physical keys carried by the guards. He successfully escaped from prison and was on the run for 12 days before being captured. So if a prisoner with only raw metal and a good memory can copy a key, I think ...


38

Microsoft already has done something like this with their product key alphabet. They selected a subset of characters that are distinctive, and excluded characters that could lead to either confusion or offensive words. The 24 used are: 2346789BCDFGHJKMPQRTVWXY The 12 unused are: 015AEILNOSUZ The hyphen character is used to separate five character groups, ...


38

Like most embedded hardware (routers, etc), their firmware often sucks, and unless you have unlimited time I'm afraid there is no way to thoroughly check every single camera out there. And even if you do find one that's currently secure, what guarantees that you'll get updates for vulnerabilities that will be discovered in the future ? Instead, I suggest ...



Only top voted, non community-wiki answers of a minimum length are eligible