New answers tagged

0

It sounds like you're trying to cause/prevent a resettable denial of service condition. If you are ruling out network access to attack the software running on the system, you might consider interfering with the data going through the various devices on the mother board. I'm not an RF engineer or an EE, but it seems though it might be possible to disrupt ...


1

For mag stripe, as answered by Thomas. But note that most countries implement EMV differently and may allow mag stripe purchase if the chip fails to read. The actual chip area of an IC card is very small. (If you look carefully at a well-used card, you may be able to see the location of the actual chip.) If the cut is not right through the chip, the chip ...


1

Electromagnetic radiation? Many parts of computers (such as Hard Disks) rely on magnets. Provide a sufficient amount of electromagnetic radiation, and the computer is bound to stop working. If the exposure to these waves isn't for too long, there (probably) wouldn't be any permanent damage, the computer would just crash as soon as the hard disk started ...


2

I'm quite sure you will be able to recover "some data" from the magnet stripe - likely even all the data that's on there. However, you won't be able to withdraw any cash with a copy of that stripe because nowadays use the information on the chip, which is much safer as it is much harder - close to impossible, I would guess - to copy that. The only thing you ...


2

First of all, it is possible (especially for the owner of the hotel) to edit the CCTV footage. However, I don't think this was the case. In fact, you haven't yet seen the CCTV footage and you just relied on what the security personnel told you. As such, it's more likely that the owner simply disabled the CCTV cameras, than he edited the footage either ...


9

Removing RAM may force a system to swap more so maybe there's a small but higher chance that sensitive information that is stored in RAM is written to a hard drive where it is much easier to recover.


0

It is possible to steal data from RAM. In the condition that 1) you have external connection to the RAM data and address bus; 2) you will have the way that allow all data to be send to data bus of the RAM (Only possible to have a program to do that without affect the system running); 3) the program should be running at the same level of kernel; In short, ...


0

Just to reiterate what others have said, not only could you shut down a server or device by removing all of its ram, you could steal cryptographic keys. The process generally looks like freezing the ram, removing it, and then placing it into a different machine where it can be analized. This works because while usually when ram loses power, all data is lost, ...


2

The slide mentions that these are physical attack vectors. I don't know the full context of the slide deck, but even just removing RAM from a system can bring an application or system to its knees. The goal of most attacks, physical or cyber, is to disrupt service, steal information, or gain backdoor access for long-term shenanigans (botnets, etc.). ...


4

Depending on what the system was doing, there might be a lot of value in freezing the RAM and dumping it to analyze it. RAM takes many shapes--many types of servers have special RAM that have parity bits in them, so on top of the RAM not immediately 'forgetting' the last thing recorded in a block, it's actually much more likely if you really really cared ...


15

Without more context it's not completely clear, but combined with the line above ("stealing equipment", not "...storage devices/computers") they could be referring to simple theft. This was an issue a few years ago when RAM prices were high - it's very portable. Alternatively DOS-by-theft could be an issue. The same slide refers to "Cutting a fibre ...


104

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to dump the contents - often with the aid of liquid nitrogen. For more information, see the Wikipedia article for Cold Boot Attack.


26

If you log in somewhere (say in a browser, or some application), the password you typed in is temporarily stored in RAM for comparison against the correct password. Most applications assume the RAM is secure and don't clear everything, so it could (and often does) happen that your RAM memory contains passwords and privacy-sensitive data. Now RAM is said to ...


0

As your aim is to "prevent" such an attack, I would focus on physically bolting the case inside a suitable tamper-resistant enclosure and then to the (ideally concrete) wall/floor, with tamperproof fixing. With the power cable inside the housing and not exposed, ventilation made inaccessible, and ideally steel in the enclosure against electromagnetic ...


6

Several motherboards have overheating protection, if the computer or especially the CPU / graphics card gets too hot, the computer will switch off. So ... turn up the heat in the room (with a big heat-source) until the computer starts rebooting indefinetly. It will be hard not to damage other components I think. In order not to target other nearby ...


2

For wireless attacks, you're limited by having to induce currents in the machine, and it's nigh impossible to do that predictably, without going overboard (i.e. EMP style) and causing permanent damage. You could try doing something the (maybe) installed wireless card, but you'd have to know something of the software, and you'd basically be attacking using ...


0

Generally speaking, storing that information in the DB, encrypted is the better choice. Is there any reason you are not doing this? I would be less worried about an attacker trying to attack the Laptop via a leaked Local IP since most laptops don't allow incoming connections, I would be more concerned about a person clicking a link which compromises the ...


1

I think it would be possible to somewhat significantly reduce the search set, but it largely depends on the resolution of the picture and the worn state of the keyboard. With a visibly worn or dirty keyboard (dirt on the edge of keys could serve the same purpose), you would first establish the possible alphabet, with each key weighted at 1.0. Then establish ...


7

Only if the sole purpose of the keyboard is to type one password. Otherwise, you'll find that more frequently used keys such as vowels, WASD, and modifiers will also have oil stains and signs of wear. It becomes especially more difficult if the password is a passphrase containing natural language.


3

The biggest difference is in scale. A keypad on a lock is generally only used to type the password, so the password keys are the only ones being used and worn. "Any given keyboard" is generally used for much more than only typing passwords. There are many other attacks used on keypads: video cameras watch you enter your pin, heat sensing (flir), or even ...


0

Keyboards wise, I'd consider this a minor concern unless I was using the same password for everything. If you're using a different password for everything and changing them reasonably regularly, you're probably fine. Add this to the fact that if you're using the keypad for other things you're going to get a much different wear pattern than just P A S W O R D ...


2

You need to clarify the term "keyboard". If you take a pic of my keyboard I am writing this text. You will surely notice some patterns and missing letters from my typing. But be aware that most of the time such keyboards are not used to enter passwords at all. Typically you rather get a heat map of the frequently used chars for a certain natural language. ...


49

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is faded. But most people don't use the keyboard for just their passwords, and the wear pattern is also influenced by the stroke direction, angle and pressure - ...


18

There are two different scenarios. This would be a valid question if the keyboard is used only for password typing. A numeric keypad on a door, that's something you shouldn’t post on social media. But you can argue this by saying that there are special characters on your keyboard which may be included in your credentials, because normally we don’t use those ...


0

The instances I know of that use quick-erase are built into special purpose, tamper-detecting hardware. If someone attempts to open the case, cut a hole in the case, disassemble the case, or even drill a hole through the printed circuit board, the detectors trigger. This sends a signal to a small special purpose CPU. Its only job is to wait for a tamper ...


3

A smartcard with encrypted storage might be able to satisfy your requirement. While not being used, the smartcard will have the key encrypted in its persistent storage, it is inaccessible in its encrypted form. You enter the decryption key once when you plug the smartcard into a computer. When you unplug the card, the smartcard loses power and this wipes ...


-2

You could setup with your usb/SD card or any memory device make sure your machine would recognize device. In windows, use Bitlocker and it also share key with removable device and printer too. You could do this, and setup your own security make sure it would not erase for that you could disable write pin from device In pendrive 4 pins: 1 pin 5v power ...


4

Try to make your own key from ATMega/STM32 ARM chip: you make it as an USB slave (peripherial) device it has an EEPROM with the key, so you have a jumper you're removing after storing the key it has a battery inside an "emergency wipe button* starts an EEPROM filling with random data circuitry (optional) after some wiping cycles it uses an overvoltage ...


2

You compare the callcenter to Starbucks in how they're required to handle credit cards. The big difference is that Starbucks handles credit cards in an entirely different way compared to a callcenter. Starbucks barristas do not handle your credit card data in any way. What happens is that you insert your credit card into a machine that's provided by ...


11

Short version: The PCI-DSS does not explicitly call out the steps you describe. However, those are common sense steps that are reasonably encompassed by several PCI-DSS requirements. They are not at all uncommon and I have seen them as requirements to non-PCI-DSS contractual agreements by third parties in a card processing environment. Long version: ...


1

What you are hearing is about a security policy of the company or call-center as a precaution to prevent loss of card-holder data. I've heard of other companies that do the same thing around slightly different data sets. There are many arrests each year of call-center workers taking credit cards so this is likely simply a security control to help reduce ...


-1

For a given length, the multiple numbers per button make it significantly harder, though by no means hard, for a casual soulder-surfer to memorize the password as they see being typed.


1

Wouldn't it depend on what actually happens when you want to input the second number on each button (I assume you press it twice)? Case 1: Two keystrokes on the same button simply outputs two of the same digit, similar to pressing the same button twice on a single number button keypad, then the result is just a reduced number of buttons, but longer code. ...


11

No, assuming equally long passcodes, having fewer buttons cannot increase security in any way. Depending on how the passcodes are chosen, and whether or not the buttons are regularly cleaned to remove smudges*, it (might or) might not decrease security significantly, but reducing the number of buttons certainly cannot make the lock more secure. So you're ...


1

Not by itself. The total number of combination is XY where X is the number of buttons, and Y is the length of the combination. For example: a 6 digits combination of 5 buttons is 56 = 15 625 combinations. a 4 digits combination of 10 buttons is 104 = 10 000 combinations. If you don't know the length of the combination, the number of buttons is ...


25

Think about the technical implementation, not about the user or what's painted on the buttons: it's a keypad with 5 buttons. In order to unlock the device, it needs a sequence of those 5 buttons (however many presses of those 5 button it allows). More buttons would make it harder to brute-force the combination. Imagine having only 2 buttons, or imagine ...


1

Ideally you would use 2FA where one factor is something physical that you must possess, and the other factor is something that is stored in your head and cannot easily be lost or stolen. Door codes are great for this if they are short and easy to remember, and also used in conjunction with another form of authentication such as a physical key fob. Imagine ...


0

Generally speaking, this is a question of authentication: How do I know who you are, and how can you prove it to me? Within that, the answers fall into a few categories: Something you have Something you know Something you are There are many different ways to take apart these categories. For example, "something you have" could be a 2FA token, a smart ...


33

As a general rule to remember: Don't make it to hard to use! If it's to hard to use and you keep forgetting, all you've done is shown that you need a different security method to make your door usable. Things mentioned in this post: Private/Public authentication (keys) UUID pre-authentication (fobs) MFA(specifically 2, fob and code gen) Things mentioned ...


1

Biometry is an option. A sensor identifies a physical attribute of your body like your face, your voice or your fingerprint. Pros: Your physical attributes are something you always have with you and can not forget Cons: Physical attributes actually can change over the course of your life, both slowly through natural aging or quickly in case of an ...


4

With a weak kitchen magnet this can take many passes and a fair amount of time. In fact if all you have is a fridge magnet you may be better off scraping the strip off. However a more powerful magnet can erase the card fairly quickly. See http://www.creditcards.com/credit-card-news/video-magnets-make-credit-card-mag-stripe-not-work-1457.php for details. ...



Top 50 recent answers are included