Tag Info

Hot answers tagged

134

I think the assumption here is wrong. They don't have physical access to the machine. They have supervised access to a very limited control panel for a machine which is built into a bomb-proof safe, bolted to the ground and hooked up to an alarm system with an armed response force. Get the machine out of the vault and away from supervision and then yes... ...


120

ATM are supposed to be tamper resistant, and to actively react upon any detected breach of physical security, notably by marking bills with some highly conspicuous and hard to remove ink, and also by committing honourable seppuku. For that matter, an ATM should be compared with HSM, payment terminals and smart card. You can imagine the ATM as a kind of Davy ...


111

In some places they have a saying: "opportunity makes the thief". All you're doing by screen-locking a computer is making the cost of hacking it just a little bit harder. Security is an economic good, with a price and a value. The value of locking is somewhat larger than the price of locking it. Sort of like how in good neighborhoods, you don't need to ...


100

The simple answer is: nothing. This has already been done for many years, with keys being cast or created from blanks using hand drawn copies, photographs, remembered shapes etc all being successfully used, both by locksmiths and criminals. A 3D printed key will do just as well, if strong enough, or it could be used to cast a key if necessary, or as ...


74

As the guys previously said, nothing! Even more, I've been working on such a project myself at the university! (albeit I don't say this as an official target, of course) I am trying to do duplicate a key from a single photo, with some assumptions to make it a realistic problem such as having a coin of a known size next to it for size calibration and ...


68

In 2011 the news was reporting on HP Printers catching fire. HP Responded saying that there was a hardware element called a "thermal breaker" to prevent this from happening. The researcher never produced a burning pile of printer. Also in 2011 Charlie Miller was researching the firmware on Apple's batteries trying to get them to explode or catch fire. ...


54

It's a risk management thing, really. An attacker with a short window of opportunity (e.g. whilst you're out getting coffee) must be prevented at minimum cost to you as a user, in such a way that makes it non-trivial to bypass under tight time constraints. Hitting WinKey+L or clicking the lock button is next-to-zero cost for you as a user. Taking the time ...


50

The answer to your question is yes, though whether this will ever actually help them is dependent on the lock and their 'skill'. With a typical (cylinder?) deadbolt repeated attempts can advance an impressioning attack with a key blank (see tylerl's answer for more detail), if using picking tools the extra visits will improve the feel for the lock and in ...


43

It sounds unlikely. As @schroeder says - a mag stripe must be physically run through a reader. So if you must "swipe" the card to get access, you must swipe the card to copy it. While a pickpocket can take a card out of your pocket, if the card is still in your possession, it's unlikely that this interaction was part of the theft. Keep in mind, however, ...


41

The adage is still accurate. Physical access to the machine is not the same as physical ability to interact with the machine. The vast majority of attacks against a physical box involve actually altering the hardware and there is a limited amount you can do to alter the hardware of an ATM as it is locked in a safe, away from the user. It is, however, ...


40

Stick a little button on the tower itself, which also has to be pressed in order to open the flap. Plate #1 from my pending patent application.


40

Yes, there's a classic attack that involves incremental access. The attacker starts out with a blank key and a lighter (or candle, or similar). Before visiting the door, he uses the lighter to put a thin layer of soot on the top edge of the blank key. The attacker approaches the door, puts the key in, jiggles the key a bit, grumbles something about how the ...


38

This would really depend on whether you care or not of being detected in the process and how much you're willing to invest into equipment, but sure. Provided there aren't some other, obvious signs the camera is on, such as the pan and tilt motors working Low-tech approach: This is actually really similar to how doctors test patients for involuntary reflex ...


37

Microsoft already has done something like this with their product key alphabet. They selected a subset of characters that are distinctive, and excluded characters that could lead to either confusion or offensive words. The 24 used are: 2346789BCDFGHJKMPQRTVWXY The 12 unused are: 015AEILNOSUZ The hyphen character is used to separate five character groups, ...


36

Mag strips need to be cloned via a mag strip reader, not by close proximity. RFID can easily be cloned by proximity.


35

Today's ATMs may be more secure than yesterday's ATM's, but the track record has been spotty. fake ATMs have been set up by criminals and used to duplicate bank cards and collect PINs. This takes advantage of the fact that whereas ATMs authenticate users via cards and PINs, users simply trust that ATMs are real by their visual appearance and bank logos. ...


35

Absolutely nothing. On one occasion, a convicted killer in Australia actually duplicated a master key of his own prison cell just by looking at the physical keys carried by the guards. He successfully escaped from prison and was on the run for 12 days before being captured. So if a prisoner with only raw metal and a good memory can copy a key, I think ...


33

Here's some academic research on stealing keys from afar with a hi-resolution camera: Our SNEAKEY system correctly decoded the keys shown in the above image that was taken from the rooftop of a four floor building. The inlay shows the image that was used for decoding while the background provides a context for the extreme distances that our system can ...


32

I've experimented with this attack previously. It depends on a few variables. First, the strength in mW of the laser you are using. Second the quality of the camera you are trying to disable. 1 - How does this laser attack apply to cameras? A laser creates a super bright and focused spot on the CCD (camera sensor). This spot can be bright enough to ...


32

The Internet at large is designed to resist nuclear blasts. At least, it was a design goal of its immediate predecessor, ARPANET. There is no secret: to survive loss of components, you must have redundancy. In the context of nuclear blasts, this means that there must exist several paths for data between any two machines, and the paths should be as ...


30

Physical surveillance of millions of miles of buried cables would be preposterously expensive. The US government already fails at efficiently preventing illegal immigration across the Mexican/USA boundary, which is one or two orders of magnitude shorter than the total length of cables. Instead, US government does things like everybody else: with encryption ...


29

Clean desks policies are quite literal. They don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all. So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours. Sensitive data doesn't only include password. ...


29

Logged out to post this just to be safe: I've worked with ATMs in the past. Our test machines are rather insecure indeed; the OS has to be running on verified hardware, but we can get admin rights to the OS easily enough and do whatever we like. We routinely lower the firewall and open the boxes to the network (they won't have internet) so we can run ...


28

Trevor Paglen's book about USA Department of Defense secrecy Blank Spots on the Map has an illuminating incident. During the Manhattan Project, a Los Alamos physicist got in trouble for leaving an orange on his desk after lunch. The Manhattan Project security people had a policy against leaving spherical objects out in the open, probably because the atom ...


28

You choice of lock matters a surprising amount. There exist locks which have not been defeated through "covert" mechanisms (picking, pick guns, etc.) in the open literature. Abloy's disc detainer locks, and one other type (I think it was a plastic lock from a subsidiary of Kaba?) are two such locks. Replacing the lock may be a suitable recourse, if you're ...


27

As other answers say,nothing prevents them... however... As a locksmith I can tell you that some locks have tolerances that are measured in the thousandths of inches, and getting a perfect match isn't always a guarantee. What would actually stop someone? The fact that picking a lock is easier, and quicker (in most cases) than making a key from an image ...


25

Locking your computer prevents surreptitious snooping or alteration. If you don't lock, it is easy for someone to poke around inside your session in such a way that you will not notice it when you return to your machine. The security benefit is real because there is a class of attacker who wants access without leaving any trace whatsoever. For that class of ...


24

This guy shows how he 3D printed a key from a simple photo: http://3dprintboard.com/showthread.php?3397-I-3D-printed-my-house-key-from-a-photo From the site: Hello, I'am new here. I recently bought a replicator 2 and was trying to come up with something interesting things to print after i got tired of making jewelery and toys... I thought it would ...


22

It's taking me a few minutes to come up with something beyond, "That's patently damn absurd!" But... I guess like many things, nobody would write it if somebody didn't buy it. My first thought from the formatting and related image is that this was sensationalist crud from a few decades ago. After all, that machine has a 5 1/4" floppy... but they're talking ...


21

"What's the point of locking a computer besides keeping the average coworker from messing with your stuff?" By protecting your self from average coworker you've protected your self from largest subset of people who'd want to find something personal about you or do you harm.



Only top voted, non community-wiki answers of a minimum length are eligible