Tag Info

Hot answers tagged

56

Best stop doing that. Never overwrite an SSD/flash storage device completely in order to erase it, except as a last resort. NVRAM has a limited amount of write cycles available. At some point, after enough writes to an NVRAM cell, it will completely stop working. For modern versions, we're in the ballpark of an estimated lifespan of 3,000 write cycles. ...


53

You’re misunderstanding what BitLocker is supposed to protect against. The goal of BitLocker is to protect your data from cold boot attacks (as explained in a Technet blog entry). When you unlock a volume protected by BitLocker, the system gains access to the keys necessary to decrypt the drive and behaves as if it was a regular drive. That is necessary to ...


30

You effectively can't. If you're on somebody else's machine and they have administrative rights to it, then that's the game. The quite fancy answer be mandatory access control systems like SELinux which hold a concept higher than root that would at least require a reboot and direct system access to change the settings.


20

Once you enter your password the drive behaves just like any other unencrypted drive, as the encryption becomes transparent to the OS. If you share your drive and other users/computers have the required permissions to access it, they will be able to do so and won't even know the drive was encrypted. Full disk encryption is designed to protect from offline ...


14

The standard approach is to fill the USB ports with epoxy resin. Of course, this must be combined with similar approaches to seal the case, so the attacker can't get in via the PCI bus, etc. Note that even if you do this, law 3 still applies: if a bad guy has unrestricted physical access to your computer, it's not your computer anymore. EDIT: reflecting ...


13

When you plug a USB key in, a considerable amount of things happen. The OS first talks to the USB device to know what kind of device it is and what it can do. Then, if the device says that it is a kind of disk, the OS will look for a filesystem on it, then mount it, and explore some of the files. Depending on what files were found and their name, the OS will ...


13

There are several known ways that a malicious USB device can compromise your computer: Autorun. The USB device can contain software that Windows will automatically run when you plug in the USB device, if you have autorun enabled. Input device emulation. As @TobyS says, the malicious USB dongle might physically look like a small flash storage device (a ...


13

USB devices talk to the computer, not to each other. During the file copy, all the data went through the RAM of the laptop -- and, precisely, through both the OS kernel and the RAM of the file explorer application. The file explorer should not have written a copy of that data anywhere on the laptop disk. However, a copy of the data has been kept in RAM by ...


13

Yes there's a way to hide the a file from Windows' and Linux's file explorers, which is to start the file name with a dot . and set the h and s flags. In Windows that can be done by using the command line ren file .file attrib +h +s .file Now the file cannot be seen by File Explorer, Nautilus, or Konqueror in their default settings on clean machines. ...


12

A USB device with "manipulated firmware" can sure do evil things. For an extreme case, see this answer: the USB device may tell to the OS "hey, I am the FireWire-to-USB converter X.Y, please download my driver from your vendor, then grant me full DMA access when I say so". Though theoretical yet, this is not science-fiction, and it sure is scary. For more ...


11

It all depends on the configuration of your OS, be it USB "stick-ed" or not. If your live system enable you to write in one way or an other to the physical disk of your home computer, then there is a non null probability that the computer could get infected. Take for example a virus that would copy itself on the MBR of your main disk. Concerning infection ...


11

Seems pretty obvious that you could just disconnect the network cable. Plug in the USB, Dump/Upload files, eject the USB, then reconnect to the network. This should prevent them from having any kind of access to the drive (read or write) Unless they own the computers AND have some mechanism to download everything on any connected usb device (which is ...


10

A combination of two USB drives and a hub might be a good solution Use the write-protected USB drive for any data that you dont want to get sabotaged and the other USB drive for anything you want to save and take with you home.


9

If you remove the boot from CD and USB from your BIOS boot order it does increase security. Anyone cant easily drive by boot your machine when you are not there and copy all your hashes and sensitive information. If you lose your BIOS password there is usually mechanisms to reset the BIOS back to default. Usually this involves opening the machine and using ...


9

Truecrypt, with an executable of the installer in the thumb drive (unencrypted ofc) so you can install it on any computer you plug your thumb drive. If it's possible encrypt with a pass in the form of HA&%^&G^ARELIBSFhahdjag62r&^^^5129380y. Drawback of this is that you'll have to carry another thumb drive with you to contain your password in ...


9

USB drives allow the propagation of data without control from the network firewall -- so any reason why such a firewall was set in the first place is a good reason to ban USB drives. I do not see how you could enforce a policy of no-private usage. People will use USB drives to transfer private data, if only the latest photographs of their dog, and there is ...


9

Using more than one layer of encryption adds more complexity and very little security. Modern encryption ciphers rarely suffer catastrophic failures but software implementations are not that perfect. Using multiple disk encryption tools may decrease your risk in case one of them will have a known flaw or backdoor that will make your stored data vulnerable. ...


9

Actually quantum computers are not that much a threat for symmetric encryption. To put it in simple (and somewhat simplistic) terms: A quantum computer, if it ever exists, will totally break the most used asymmetric encryption and key exchange algorithms (RSA, ElGamal, Diffie-Hellman...) but not all asymmetric algorithms (QC does not break the concept of ...


8

I have built a business case, got funding and implemented removable media controls at a large bank. I wrote about my lessons learned here. The key reasons on why you need removable media controls: Data loss prevention - if you lose a removable device with lots of valuable data on it you don't get fined by the regulator, face data breech reporting and lose ...


8

Physical write protect on a USB drive should work in all cases. The write controller is in the drive itself. Thus, excepting a wholly insane implementation, the physical write protect switch is secure. Physical write protect is always kind of a semi-soft thing, but it's usually at the drive internals. With a floppy drive where the controller is external to ...


8

Formally, yes. You have identified a level of residual risk you are prepared to accept, based on a threat analysis, and have implemented controls to manage the risk down to this level. Informally, as others have pointed out, if a control can be made very much stronger with very little cost, then you should do it anyway. Risk analysis and threat modelling ...


8

There are a few things you should do: Disable autorun, this way you won't start any install scripts Use an updated firewall / virus scanner, for obvious reasons Or you could run a linux live cd and copy the data.


7

It may be possible for a USB device to mimic an input device such as a mouse or keyboard and interact with the operating system without any user interaction. However, I have not seen any proof of concept for this, so in all likelihood disabling autorun will provide adequate protection.


7

If you're using some sort of endpoint protection, they may have the ability to disable USB flash drives. I know the Symantec Endpoint Protection has the ability to disable USB flash while allowing other USB devices.


7

I think this question is asking a bit more about what happens when you encrypt data on a device where that data was previously unencrypted. SSD units and HDD units suffer from different possible compromises related this. This is basically referred to (at least on the venerable Wikipedia) as data remanence. That article offers lots of information about the ...


7

SSD's and Flash drives are an interesting problem... As @Bell pointed out as a response to this question: Yes, the effectiveness of the shredding operation is dependent on a fixed or physical mapping between a block number and piece of non-volatile storage. This works for spinning media but not for SSDs which virtaulise their blocks for performance ...


7

This states truecrypt uses a hash-function like SHA-1 and keystrengthen it by a factor of ~2000 times. So if your attacker knew it was a four digit number; it would take your attacker under 10000 tries to crack, which means they would need about 2000×10000=20 million sha1 hashes. A GPU can generate sha1 hashes at about a billion per second; so your ...


7

You want to distribute the flash drives yourself, and forbid usage of any flash drive which has not been "approved". Reason: there are devices out there, which look like flash drive, but, when inserted, tell to the computer that they really are keyboards, and begin typing things wildly. If only genuine flash drives are ever inserted in the computers you ...


7

I haven't used Rohos before, so I can't say exactly how it works. But I've used TrueCrypt before and it should be capable of this (I would test it, except someone has stolen all my bloody flash drives). TrueCrypt can create an encrypted partition on a drive (such as a flash drive). This partition should appear as complete gibberish to the OS so it should ...


7

Backtrack 5 gives you the option when booting to start in forensic mode which means it will not attempt to mount any drives, unless specifically requested by the user.



Only top voted, non community-wiki answers of a minimum length are eligible