Questions tagged [physical-access]

The best security measures can be rendered useless if you don't physically protect your systems. An intruder can steal a computer, server, or smartphone, then crack the password at his leisure. (Source: "Physical access". Wikipedia. Citing: Michael Meyers. ISBN 978-0-07-225345-0. McGraw-Hill Education.)

Filter by
Sorted by
Tagged with
0
votes
0answers
59 views

Thoughts on Vaccine Security

Are there any recommendations for the physical security of COVID-19 vaccine? I recently watched this video https://www.youtube.com/watch?v=uoqMA9vAOrQ on covid-19 vaccine distribution. At the 0:40 ...
0
votes
1answer
85 views

Will using super-glue on the screws of my laptop prevent it from being opened unnoticed?

I know someone can break open the case, but what about opening it without leaving evidence? Are there any seals available for securing your laptop from unauthorized access? And sealing the sides of ...
0
votes
1answer
52 views

Does UHF RFID implement any security at all?

Feel free to correct my below logic. As far as I can tell, HF RFID tags (specifically I've tested MiFare Classic 1kb) have a 48-bit encryption key (default to 0xFFFFFFFFFFFF or something) to protect ...
0
votes
0answers
21 views

Are 2FA options available when booting into your laptop? [duplicate]

Are there any 2FA methods that can be used when accessing the BIOS or booting into your Hard Drive? If not now then what about the future?
1
vote
2answers
97 views

Can a BIOS password along with a HDD password prevent evil maid attacks?

By definition evil maid attacks involve altering a device in an undetectable way. So if I lock the BIOS, set the HDD to boot first and put a HDD password will this prevent it? Access to the computer ...
1
vote
2answers
177 views

Is a BIOS password enough to prevent someone from hacking into my laptop if they have physical access?

Would my laptop be secure against physical access if I set up a bios password and full disk encryption ? If not then is there any way to secure your laptop from someone with physical access? How hard ...
0
votes
1answer
70 views

Is there any write-once USB stick/pendrive? [closed]

Is there any Write-once USB stick/Pendrive? I need to submit some files to Authorities and I don't want them to modify on whatsoever. Any suggestion?
1
vote
0answers
45 views

Does authentication for USB keyboards exist?

I think bluetooth has an authentication measure. As a user, when I get a new bluetooth keyboard, I have to: Go to my computer, search for bluetooth devices Put my keyboard in "pairing mode" My ...
55
votes
10answers
12k views

Does the saying “physical access = game over” apply to smartphones, too?

I was surprised to read in the responses to this popular question that it's considered nigh impossible to secure a computer system if intruders have physical access. Does this apply to smartphones ...
1
vote
2answers
155 views

Is there a way to “lock” a YubiKey after a period of inactivity?

I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, ...
1
vote
3answers
298 views

How long does it take to have spyware installed on a laptop?

During my commute from an airport located in a country whose government is known for intrusions into the privacy of its citizens and non-citizens, I had my laptop taken from me during a routine ...
0
votes
0answers
20 views

When they make physical locks, do they really just make a few variations of the keys and then mix them together and sell? [duplicate]

I always assumed that each lock is unique and can only be opened with the keys it was sold with (or any copies made later from those originals). But the truth seems to be that they just make "a few" ...
41
votes
9answers
9k views

What are the potential risks of leaving a device in public, but locked? [closed]

Let's say you're in a public café, or conference, where you trust your device won't be stolen if you go to the bathroom for 5 minutes, but you don't trust it might not be tampered with. What are the ...
33
votes
8answers
6k views

If password expiration is applied, should door-lock expiration be applied too?

After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
1
vote
1answer
100 views

What is it called when someone glides through a building's external door behind you? [duplicate]

One form of social engineering is the practice of running up to a building's external door just as an employee is entering. The employee often holds the door open for the intruder, bypassing security ...
0
votes
0answers
60 views

How far can a malicious USB device get you on a server?

If the device is plugged in when the user is already logged in, then of course the device can just pretend to be a keyboard, open a terminal, and run a compromising command. (shortcuts for terminals ...
95
votes
3answers
10k views

What is the purpose of the rotating plate in front of the lock?

I am now in Poland and see these everywhere: The plate can rotate freely,when you insert the key, matching the groove, you rotate the key so it is aligned with the lock and then insert the key. What ...
19
votes
3answers
7k views

Stolen MacBook: should I worry about my data?

Unfortunately, someone stole my laptop (a MacBook) and I did not realize that for 48 hours. Now, this was a work laptop and my company's security team is going to wipe the laptop remotely as soon as ...
0
votes
1answer
44 views

Interpreting this F-Secure Video of a DMA-Attack

I'm trying to interpret this video demonstration by F-Secure of the big cold-boot attack discovered last year. What is happening at the 50-second mark? Why does he insert the USB boot-device before ...
1
vote
1answer
198 views

Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?

I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
23
votes
5answers
7k views

Selecting a secure PIN for building access

What are the general criteria for rejecting an insecure PIN to access a building? There has been a lot of discussion about password selection security. Minimum length requirements, mandatory classes ...
8
votes
6answers
658 views

I am a political activist, its likely that my computer will be compromised in the future, how can I secure my data?

I have sensitive data to secure. My computer may likely be compromised physically in the future. How can I secure my date from various attacks like Evil Maid attacks and so forth. I have some basic ...
1
vote
2answers
241 views

Device security in IOT

I am working on an IOT device that sends data to the server after authenticating itself to the server. Is there a way to safely store my device's credentials for logging onto the main server and ...
1
vote
1answer
107 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
10
votes
2answers
333 views

risk from USB-C port on locked laptop

If an attacker has access to the USB-C port on my laptop which is in powered on but at the lock screen, what is the risk that they are able to carry out an evil maid attack? Say I'm in the room but ...
4
votes
1answer
164 views

How to Best Minimize Damage After Loss of Computer

Myself and the rest of my coworkers on my (former) employer’s dev team were all just laid off from our jobs, and the employer took our MacBook Pros without letting us clear of our personal information ...
1
vote
4answers
562 views

Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?

Bruce Schneier Writes Down Passwords. So Can You ... But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...
2
votes
2answers
265 views

Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?

An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did? For example, let ...
3
votes
1answer
247 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
106
votes
19answers
23k views

Defence methods against tailgating

This is a follow-up question to this one: Roles to play when tailgaiting into a residential building How do you protect yourself or your company against tailgaters? What is the best answer when you ...
111
votes
6answers
20k views

Roles to play when tailgaiting into a residential building

Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
2
votes
1answer
229 views

Recommendations for tamper resistance without reasonable access security

I have an off-the-shelf PC with a database on it (CouchDB). The database contains sensitive data. I'm taking this machine to a community with poor/zero data connectivity, where the database will ...
2
votes
1answer
253 views

Are nearby attackers dangerous?

It is a general consensus that physical access can be dangerous. However, I would like to know attack vectors if attackers only get nearby access to the system. I’m assuming that the word access ...
2
votes
1answer
184 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
5
votes
1answer
312 views

How to check for security breach after a potential physical home intrusion

My family member has reason to believe that someone entered their house last night although they cannot be certain because they only have circumstantial evidence: In the morning they found a light ...
2
votes
1answer
288 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
13
votes
2answers
981 views

Securing a Laptop from a Foreign Intelligence Agency

What would be the best practices for securing a single-purpose Windows laptop against a determined foreign intelligence agency from tampering with data on the machine? The machine would be used ...
1
vote
2answers
72 views

Protecting payment mobile app against mobile theft

Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
6
votes
4answers
1k views

What is the real danger of not putting a login password in Windows in a small company except that of allowing anyone to go physicaly on your computer?

My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks ...
1
vote
1answer
150 views

Checking for installed background processes in my phone [closed]

I came from Russia recently. The security officer asked me to open my phone. When I handed it over to them, I saw there was a black screen with Russian writing on my phone when the officer was ...
4
votes
1answer
403 views

Access Control Badges — Plain or Printed IDs?

My question is around best practices and risks regarding labelled employee ID badges and access control systems. My company is moving into a new office, and it has an access control system with ...
9
votes
4answers
530 views

Why would taking my laptop home be encouraged for security reasons?

My company's infosec policy contains a statement to the effect that I am encouraged to bring my laptop home with me to that it never leaves my possession/control. This doesn't seem useful, from a ...
92
votes
8answers
16k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
3
votes
1answer
136 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
2
votes
0answers
98 views

About physical access of notebook computer

Background: I’m a mobile app developer, and I’m using my notebook (a MacBook Air) for writing apps. For some reasons I have to put my notebook at a location that is not completely secure (i.e. I can’...
2
votes
4answers
571 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
0
votes
0answers
30 views

Using Access Readers for software access

Is it possible to use card access readers for something other than physical access? I've been reading about Wiegand and OSDP protocols and it looks like the hardware is all based on that (with some ...
2
votes
1answer
152 views

Possible physical interface attacks on a server [duplicate]

Let's say you have a server at a data centre, but a hacker manages to find a way in and has access to your server. What are the attack possibilities with all the interfaces available? Are there any ...
4
votes
1answer
304 views

What can I do with physical access to a server?

I am taking a Sec Lab class and we've been sectioned into teams and tasked with 'attacking' the other teams while 'defending' against them. Each team is set up with 4 VMs, and we have a few days to ...
40
votes
3answers
9k views

How to safeguard physical keys stored in a fire dept. lockbox?

The workplace has a physical access key stored in a fire department lockbox (sometimes called a Knox Box), how it's possible to mitigate the risk that the Knox Box gets picked, or that an unauthorized ...