Questions tagged [physical]

The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
0answers
50 views

Is there such a thing as a “privacy helmet”? [closed]

I have given up the idea of ever talking people out of carrying around surveillance devices or to influence the global society to remove all these surveillance cameras, mics, sensors, etc. I no longer ...
-1
votes
0answers
73 views

How did (in particular) Americans just go along with the concept of having to own and show “photo id” everywhere? [closed]

I remember hearing or seeing a documentary or something a "long" time ago, likely in the early 2000s, about how a lot of Americans (USAians) refused to show an "id" even when voting, where it might ...
3
votes
2answers
103 views

“Digital” signatures on real life objects

Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree. As an ...
1
vote
1answer
118 views

Can I safely sell a used keyboard without risk of new owner recovering previous inputs?

As far as of my knowledge goes, keyboard don't store keystrokes in their memory by default (excluding those bundled with keyloggers). The thing that comes to my mind though is that some keyboards do ...
1
vote
1answer
127 views

Physical mechanical examples of “M-of-N” locks?

Arbitrary "M-of-N" secret-sharing protocols are a well-studied topic in cryptography, and are apparently so useful that Bitcoin Script devoted a whole opcode to them. In this blog post, I write: ...
0
votes
0answers
20 views

When they make physical locks, do they really just make a few variations of the keys and then mix them together and sell? [duplicate]

I always assumed that each lock is unique and can only be opened with the keys it was sold with (or any copies made later from those originals). But the truth seems to be that they just make "a few" ...
0
votes
2answers
78 views

Recreating the Half Coins of Jin-Qua [closed]

In the Asian Saga series by James Clavell, the Struan family gave away the half-coins of Jin-qua: in exchange for a desperately needed loan, the pirate Dirk Struan received 4 halves of 4 coins. The ...
2
votes
1answer
80 views

Strategies to protect SANs in branch offices in risky places

A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is ...
2
votes
2answers
253 views

What is the physical security (Evil Maid) threat model of a modern hardened laptop?

Why I believe this question is not a duplicate: There are multiple questions dealing with the exploitation of a locked computer on this site, but most of the answers are focused on exploiting a non-...
0
votes
1answer
77 views

Household attack vectors and mitigations [closed]

Hopefully this question won't come across too closely to a which product is best as that is not my intention. I am moving into a larger property and I would like to setup some home security now i'm ...
-2
votes
1answer
57 views

Do large companies keep a detailed “company log” book/database? [closed]

In my life, I have spent a lot of time thinking and wondering about many things related to larger businesses, even though I have no direct connection to that world. By "larger", I mean "not just a ...
2
votes
1answer
150 views

What do I do if I catch someone doing a physical pentest? [duplicate]

This question was primarily inspired by this (related) question, but is about the other side of the equation. I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a ...
-2
votes
1answer
71 views

Can employees' personal properties be part of the scope? [closed]

Let's assume the customer (target) wants to have a full physical pentest done. (I'm a student and have 0 exp in actual Pentesting and Red Teaming Properties of topic: Cars (in the car park) ...
34
votes
1answer
5k views

How to deal with third parties in physical pentests?

From my previous question, I've seen that a "Permission to Attack" slip is crucial in ANY Penetration Test. However, that question and its answers and comments have only discusses interactions between ...
129
votes
2answers
22k views

What to do if caught in a physical pentest?

I've seen a lot of people talk about how to pentest and how NOT to get caught during engagements but have a hard time finding "How to behave when caught during a Red Team engagement". Red Teams are ...
3
votes
1answer
127 views

When a closed-source company hires somebody to audit their code, is the auditor forced to do it in the company's office?

Let's say that ACME, Inc. is making closed-source software. It's closed for a reason (they don't want it leaving their building other than in compiled form). Now, they are hiring some company/person ...
41
votes
3answers
7k views

Why are my plastic credit card and activation code sent separately?

Capital One recently sent my plastic credit card by post mail and its activation code by a separate post mail. What security problem does this mitigate? If a rogue element has access to my mail box ...
0
votes
1answer
80 views

External hard drive

It's possible the external hard drives have been compromised in the company I work for. It would be a huge waste of money to replace them all without detection and if the current ones are compromised, ...
0
votes
3answers
246 views

Is it safe to throw away debit card receipts in the bin?

In relation to this question about credit card receipts, is it safe to just throw away receipts where I have used a debit card? In addition, would it be any more worth while burning/shredding ...
94
votes
3answers
9k views

What is the purpose of the rotating plate in front of the lock?

I am now in Poland and see these everywhere: The plate can rotate freely,when you insert the key, matching the groove, you rotate the key so it is aligned with the lock and then insert the key. What ...
0
votes
0answers
35 views

Are the security basics of a non-wifi router different from securing your desktop? [duplicate]

I have studied much about securing a desktop from enabling firewall to browsing internet safely among other things. I also know that many steps can be taken to improve the security of wifi routers. ...
0
votes
1answer
388 views

Requiring hardware key at boot-up on normal laptop

I am sure that a question like this already exists and has probably been answered. I just couldn't find any results (probably due to my inability to word my question correctly). We use laptops at ...
1
vote
1answer
167 views

Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?

I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
1
vote
2answers
77 views

Mobile phone is picking up 13 bluetooth devices and not sure what they are?

I have a particular problem with a potential security breach. I bought a new device today that connects to my phone via Bluetooth. Nothing strange about that. Surprisingly when I turned Bluetooth on ...
1
vote
0answers
195 views

An advanced adversary is targeting you - now what? - so what? [closed]

Consider the following: An advanced adversary is targeting you. He has the ability to watch most if not all of your network connections and the ones in the neighbourhood. He is sitting on numerous ...
0
votes
0answers
55 views

Phoenix/Samsung BIOS/HDD security

I have a laptop bought in 2011. I want to protect its BIOS and HDD (data is already encrypted anyway). But I have seen these vulnerabilities: After 3 incorrect tries, I see "System Disabled" with ...
9
votes
1answer
420 views

What steps should I take to ensure there are no unpleasant surprises in a recently purchased home?

After buying a house from another party (i.e. not new construction) what steps should I take to ensure the previous residents have not left behind anything unpleasant for me? I'm not worrying about ...
2
votes
1answer
392 views

How to mitigate the new malicious USB cable USBHarpoon (NOT BadUSB) threat in an enterprise? [duplicate]

In this case, the victims may think they are using a generic USB cable, but the PC will recognize the cable as a Human Interface Device, much like it would a mouse or keyboard, giving the attacker ...
1
vote
1answer
545 views

Why should I leave a U2F device always plugged in to a computer?

Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
2
votes
2answers
111 views

Security and thumb drive [duplicate]

If my laptop is locked, can a thumb drive be able to still infect my computer, or create a backdoor, or any other security risk if it's plugged into it. If so what are some example
0
votes
1answer
59 views

Does the number of fingerprints we leave represent a security threat to the banking system?

A number of major banks are allowing users to log in to their bank accounts with only fingerprints. It was occurring to me, though: how many fingerprints does the average person leave per day? How ...
2
votes
1answer
215 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
1
vote
2answers
82 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
3
votes
2answers
251 views

Is there any way somebody could hack into my brain?

Before you close this, I'm actually serious. Could somebody, in theory, have conked me out behind a Chiles, cirucular-sawed my brain out, and plugged me up to a machine capable of brain simulation? ...
106
votes
19answers
22k views

Defence methods against tailgating

This is a follow-up question to this one: Roles to play when tailgaiting into a residential building How do you protect yourself or your company against tailgaters? What is the best answer when you ...
0
votes
4answers
118 views

Assessing risks Physical security of devices

I have several devices and flash drives that need to be secured. I haven't been able to find any good physical security measures to protect those devices. What are my options? What do you use, if ...
44
votes
7answers
13k views

How resistant are barcodes and QR-codes against attempts to change stored data?

Assume we want to protect a document against manipulating and forging. So, we encode some sensitive information of the document and store it in a QR-code inserted in the document. Can we be sure that ...
12
votes
2answers
899 views

Securing a Laptop from a Foreign Intelligence Agency

What would be the best practices for securing a single-purpose Windows laptop against a determined foreign intelligence agency from tampering with data on the machine? The machine would be used ...
4
votes
1answer
271 views

If rowhammer only results in capacitor discharge, how can it flip 0 to 1?

In rowhammer, why will changing the voltage on one row cause the other row to open/close? Is it related to induction? How can it change bits from 0 to 1? I understand from 1 to 0 - voltage discharge, ...
1
vote
1answer
180 views

Are unbranded home security camera secure? [closed]

I plan on buying a couple of cheap cameras for my home. I plan to put them just inside the doors like the laundry door, I won't be putting them in the bedroom or living room. My major concern is how ...
4
votes
2answers
150 views

resource on physical security that calls out doorknobs as being more secure than door handles

A manager invited me to try and test the physical security of his office door lock (by non-destructive means, i.e. not ramming the door down). I found that since the door opened from inside by a ...
6
votes
1answer
1k views

How does full memory encryption in newer processes protect against DMA attacks?

Upcoming Intel CPUs have TME, current AMD processors have SME. These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks. Both support encrypting the ...
1
vote
2answers
3k views

Why is an HSM required to protect CA certificates (rather than a regular USB token)?

Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on. The same vendors also offer distinct products called HSMs (...
0
votes
0answers
166 views

Feasibility of using serial port/cable to act as a simple data diode?

I'm trying to determine the feasibility of using a serial port/cable to act as a simple and cheap data diode. I'll be connecting 2 Windows PCs (1 of which is on a secured network) using a 1-way null ...
8
votes
4answers
494 views

Why would taking my laptop home be encouraged for security reasons?

My company's infosec policy contains a statement to the effect that I am encouraged to bring my laptop home with me to that it never leaves my possession/control. This doesn't seem useful, from a ...
3
votes
1answer
132 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
3
votes
1answer
2k views

Is it possible to bypass USB access restriction placed by the Active Directory? [closed]

I've been tasked with an onsite engagement to see what I can find from one of their laptops. They have a policy in place to block USB access through the Active Directory, e.g. When you try to access ...
129
votes
5answers
26k views

Is momentary physical access dangerous?

I’m asking the question with these conditions: The device (computer or mobile phone) is in a running state. “Momentary” refers to a reasonably short period of time, such as 5 to 10 seconds. The ...
4
votes
1answer
320 views

Can an air-gapped PC receive malicious code even when completely clean, apart from all physically attacks?

The Basic question is in the title there are more questions bellow but it is in context of the question in the title...hopefully What i have read is that it can eavesdrop the Airgap PC via acoustic ...
1
vote
0answers
40 views

How to secure unique identification of physical resources in a distributed system?

I'm attempting to build a mechanism to prevent frauds and provide traceability of physical resources in a distributed system. The idea is straightforward: the resource travels hop-by-hop on a network ...

1 2 3 4 5 8