Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [physical-access]

The best security measures can be rendered useless if you don't physically protect your systems. An intruder can steal a computer, server, or smartphone, then crack the password at his leisure. (Source: "Physical access". Wikipedia. Citing: Michael Meyers. ISBN 978-0-07-225345-0. McGraw-Hill Education.)

1
vote
1answer
64 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
7
votes
1answer
128 views

risk from USB-C port on locked laptop

If an attacker has access to the USB-C port on my laptop which is in powered on but at the lock screen, what is the risk that they are able to carry out an evil maid attack? Say I'm in the room but ...
4
votes
1answer
97 views

How to Best Minimize Damage After Loss of Computer

Myself and the rest of my coworkers on my (former) employer’s dev team were all just laid off from our jobs, and the employer took our MacBook Pros without letting us clear of our personal information ...
0
votes
0answers
21 views

HIPAA : Writing Policies and Process For Workstation Surroundings

I am writing policies that the company will follow and I am going through the HIPAA compliance check list as a guide. I am trying to make sense of this item though. To me a lot of these seem vague and ...
1
vote
3answers
175 views

Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?

Bruce Schneier Writes Down Passwords. So Can You ... But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...
2
votes
2answers
213 views

Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?

An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did? For example, let ...
2
votes
1answer
158 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
101
votes
19answers
22k views

Defence methods against tailgating

This is a follow-up question to this one: Roles to play when tailgaiting into a residential building How do you protect yourself or your company against tailgaters? What is the best answer when you ...
109
votes
6answers
19k views

Roles to play when tailgaiting into a residential building

Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
2
votes
1answer
199 views

Recommendations for tamper resistance without reasonable access security

I have an off-the-shelf PC with a database on it (CouchDB). The database contains sensitive data. I'm taking this machine to a community with poor/zero data connectivity, where the database will ...
2
votes
1answer
222 views

Are nearby attackers dangerous?

It is a general consensus that physical access can be dangerous. However, I would like to know attack vectors if attackers only get nearby access to the system. I’m assuming that the word access ...
1
vote
1answer
166 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
4
votes
1answer
240 views

How to check for security breach after a potential physical home intrusion

My family member has reason to believe that someone entered their house last night although they cannot be certain because they only have circumstantial evidence: In the morning they found a light ...
1
vote
1answer
232 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
0
votes
0answers
132 views

Are running systems more susceptible than shut-down systems?

Suppose an attacker gained physical access to a device (a smartphone, for example). Would be be harder for the attacker to perform malicious actions on the phone when the phone is shut down? I’m ...
12
votes
2answers
745 views

Securing a Laptop from a Foreign Intelligence Agency

What would be the best practices for securing a single-purpose Windows laptop against a determined foreign intelligence agency from tampering with data on the machine? The machine would be used ...
1
vote
2answers
63 views

Protecting payment mobile app against mobile theft

Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
4
votes
3answers
469 views

What is the real danger of not putting a login password in Windows in a small company except that of allowing anyone to go physicaly on your computer?

My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks ...
1
vote
1answer
137 views

Checking for installed background processes in my phone [closed]

I came from Russia recently. The security officer asked me to open my phone. When I handed it over to them, I saw there was a black screen with Russian writing on my phone when the officer was ...
4
votes
1answer
185 views

Access Control Badges — Plain or Printed IDs?

My question is around best practices and risks regarding labelled employee ID badges and access control systems. My company is moving into a new office, and it has an access control system with ...
8
votes
4answers
427 views

Why would taking my laptop home be encouraged for security reasons?

My company's infosec policy contains a statement to the effect that I am encouraged to bring my laptop home with me to that it never leaves my possession/control. This doesn't seem useful, from a ...
92
votes
8answers
16k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
3
votes
1answer
111 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
2
votes
0answers
92 views

About physical access of notebook computer

Background: I’m a mobile app developer, and I’m using my notebook (a MacBook Air) for writing apps. For some reasons I have to put my notebook at a location that is not completely secure (i.e. I can’...
2
votes
4answers
325 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
0
votes
0answers
22 views

Using Access Readers for software access

Is it possible to use card access readers for something other than physical access? I've been reading about Wiegand and OSDP protocols and it looks like the hardware is all based on that (with some ...
2
votes
1answer
100 views

Possible physical interface attacks on a server [duplicate]

Let's say you have a server at a data centre, but a hacker manages to find a way in and has access to your server. What are the attack possibilities with all the interfaces available? Are there any ...
4
votes
1answer
215 views

What can I do with physical access to a server?

I am taking a Sec Lab class and we've been sectioned into teams and tasked with 'attacking' the other teams while 'defending' against them. Each team is set up with 4 VMs, and we have a few days to ...
40
votes
3answers
8k views

How to safeguard physical keys stored in a fire dept. lockbox?

The workplace has a physical access key stored in a fire department lockbox (sometimes called a Knox Box), how it's possible to mitigate the risk that the Knox Box gets picked, or that an unauthorized ...
2
votes
2answers
129 views

What security standards apply to physical security for an infosec office

I'm looking for actual specific standards that apply to physical access control for Information Security office space. Long story short, our building manager wants an open office concept, and in order ...
2
votes
0answers
130 views

Why would anyone steal a boom-gate access card scanner? [closed]

A card reader was stolen from the boom gates of the building last night. There is another card reader at the roller doors of the garage and then again at every elevator. I was wondering why would ...
2
votes
1answer
148 views

If and why should any personal information be destroyed before putting scrap paper into the recycle container?

Well this question may not be about computers, but it most definitely is about information security, so I'll give it a try... I've been repeatedly told in my life that I should always carefully check ...
2
votes
2answers
109 views

Is it possible to protect a key from an attacker with physical access?

So a colleague and I are having an argument about physical access. We have two devices A and B where A contains a function f(x) whose implementation we want to keep secret. We want to allow users to ...
3
votes
0answers
93 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should only be ...
3
votes
2answers
697 views

How to protect/mitigate IntelME (CSME) JTAG attack over USB?

Two security searchers from ptsecurity.com ( Maxim Goryachy‏ @h0t_max and Mark Ermolov @_markel___ ) have announced on Twitter: Game over! We (I and @_markel___ ) have obtained fully functional ...
5
votes
2answers
475 views

Security for KeePass Emergencey Sheet

KeePass just introduced the concept of an emergency sheet that can be shared with trusted users. This question might go beyond the scope of this site, but suppose you printed one of these sheets, how ...
1
vote
3answers
276 views

Evidence of any large scale data breaches from lack of physical security?

You see far-fetched Hollywood examples of the most unlikely scenario's resulting in a data breach due to a lack of physical security. An example is in Mr Robot where the protagonist gets into a data ...
2
votes
1answer
396 views

Is my IP camera secure?

I have recently bought a cheap £20GBP IP camera from an online store. It is branded as "aobo" but the logo was just stuck on and it appears to be a generic model which I have seen for sale under ...
2
votes
1answer
172 views

What are the physical security features that prevent the cryptographic data on a SIM card being read?

In his excellent answer to "How does a SIM card prevent cloning?", user Lie Ryan explains that SIM cards have their critical data stored in "tamper proof housing", protected by "physical security ...
2
votes
0answers
193 views

Linux selective USB-Locking against evil-maid-attacks [closed]

While the question of completely disabling usb-controllers and -storage to defeat an evil-maid-attack has already been answered here quite often, I have a different solution in mind. Upon locking the ...
5
votes
3answers
899 views

Protect Raspberry Pi's physical sd card to be swapped

Scenario: In a company there are Raspberry Pis which are connected to its network environment. A person with bad intentions could swap the SD card and replace it by his own which makes the Pi to a "...
-1
votes
1answer
100 views

MicroUSB equivilent of the Killer USB drive?

There's something so satisfying about the killer usb drive: https://arstechnica.com/security/2015/10/usb-killer-flash-drive-can-fry-your-computers-innards-in-seconds/ 220 volts straight to the ...
1
vote
0answers
68 views

How can you build a device that gives you remote access to a connected LAN? (Not VPN) [closed]

I was wondering how a device (eg. RPi or similar board could be built/configured in a way that when you plug it to a LAN (or connect Wifi) it let's you remotely access the LAN (like VPN, but without ...
68
votes
5answers
21k views

Why is iPhone's internal storage so hard to crack/decrypt?

I’ve heard about a rule in Information Security, that once a hacker has access to your physical machine, then it’s all over. However, there seems to be a big exception to this rule: iPhones. It was ...
7
votes
3answers
3k views

What countries are at highest risk of espionage on personal devices? [closed]

When co-workers travel internationally for business there seems to be risk of bringing a regular work laptop to some countries: the risk is that the government might try to spy on the dta stored on ...
1
vote
0answers
78 views

Is HID attack via UART (RS-232) possible?

I see there is a recent question about intrusion via USB here. Would it be similar to do an HID attack via the serial port (UART / RS-232)? Are there known examples? I can easily physically conduct ...
1
vote
0answers
92 views

Malicious Actor with Physical Access to Encrypted Machine [duplicate]

Some background: My org is potentially involved in a legal dispute with a securities brokerage in a under-developed country with mediocre rule of law. The broker also is responsible for co-locating a ...
4
votes
4answers
195 views

Could it be possible to hijack physical finger prints in digital form and use them to gain access to other devices and locations?

With more and more devices accepting finger prints in place of passwords, could it be possible to "keylog" these finger prints on mobile devices, for example, by installing a rogue application and ...
4
votes
1answer
2k views

Do fTPM implementations protect against physical attacks?

I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC. As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
1
vote
2answers
80 views

How to find entry points to physical systems

I read an article on wired about a whole transit system getting hacked. The intruder disabled ticket machines and displayed messages on the station displays. I was wondering how an attacker finds an ...