Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [physical-access]

The best security measures can be rendered useless if you don't physically protect your systems. An intruder can steal a computer, server, or smartphone, then crack the password at his leisure. (Source: "Physical access". Wikipedia. Citing: Michael Meyers. ISBN 978-0-07-225345-0. McGraw-Hill ...

40
votes
2answers
5k views

Roles to play when tailgaiting into a residential building

Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
2
votes
1answer
83 views

Recommendations for tamper resistance without reasonable access security

I have an off-the-shelf PC with a database on it (CouchDB). The database contains sensitive data. I'm taking this machine to a community with poor/zero data connectivity, where the database will ...
2
votes
1answer
100 views

Are nearby attackers dangerous?

It is a general consensus that physical access can be dangerous. However, I would like to know attack vectors if attackers only get nearby access to the system. I’m assuming that the word access ...
0
votes
0answers
34 views

physical premise security: what are the risk of having a physical access FOB cloned?

I live in a high rise where we are issued small FOB devices that give access to the building lobby and limit which floors we can access with the elevator. This is a fairly common setup in my city. ...
1
vote
1answer
64 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
4
votes
1answer
116 views

How to check for security breach after a potential physical home intrusion

My family member has reason to believe that someone entered their house last night although they cannot be certain because they only have circumstantial evidence: In the morning they found a light ...
1
vote
1answer
120 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
0
votes
0answers
31 views

Are running systems more susceptible than shut-down systems?

Suppose an attacker gained physical access to a device (a smartphone, for example). Would be be harder for the attacker to perform malicious actions on the phone when the phone is shut down? I’m ...
12
votes
2answers
576 views

Securing a Laptop from a Foreign Intelligence Agency

What would be the best practices for securing a single-purpose Windows laptop against a determined foreign intelligence agency from tampering with data on the machine? The machine would be used ...
0
votes
0answers
78 views

Is my laptop secured and how to secure it more?

I'm working in a pretty sensitive environment and I'd like to know if my config is secure. I got a MSI Laptop. The BIOS is locked out with a password, and is asking it at each boot. I know this can ...
1
vote
2answers
60 views

Protecting payment mobile app against mobile theft

Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
4
votes
3answers
243 views

What is the real danger of not putting a login password in Windows in a small company except that of allowing anyone to go physicaly on your computer?

My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks ...
1
vote
1answer
109 views

Checking for installed background processes in my phone

I came from Russia recently. The security officer asked me to open my phone. When I handed it over to them, I saw there was a black screen with Russian writing on my phone when the officer was ...
4
votes
1answer
81 views

Access Control Badges — Plain or Printed IDs?

My question is around best practices and risks regarding labelled employee ID badges and access control systems. My company is moving into a new office, and it has an access control system with ...
8
votes
4answers
378 views

Why would taking my laptop home be encouraged for security reasons?

My company's infosec policy contains a statement to the effect that I am encouraged to bring my laptop home with me to that it never leaves my possession/control. This doesn't seem useful, from a ...
90
votes
8answers
15k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
3
votes
1answer
105 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
2
votes
0answers
84 views

About physical access of notebook computer

Background: I’m a mobile app developer, and I’m using my notebook (a MacBook Air) for writing apps. For some reasons I have to put my notebook at a location that is not completely secure (i.e. I can’...
2
votes
4answers
213 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
0
votes
0answers
21 views

Using Access Readers for software access

Is it possible to use card access readers for something other than physical access? I've been reading about Wiegand and OSDP protocols and it looks like the hardware is all based on that (with some ...
2
votes
1answer
83 views

Possible physical interface attacks on a server [duplicate]

Let's say you have a server at a data centre, but a hacker manages to find a way in and has access to your server. What are the attack possibilities with all the interfaces available? Are there any ...
4
votes
1answer
210 views

What can I do with physical access to a server?

I am taking a Sec Lab class and we've been sectioned into teams and tasked with 'attacking' the other teams while 'defending' against them. Each team is set up with 4 VMs, and we have a few days to ...
40
votes
3answers
8k views

How to safeguard physical keys stored in a fire dept. lockbox?

The workplace has a physical access key stored in a fire department lockbox (sometimes called a Knox Box), how it's possible to mitigate the risk that the Knox Box gets picked, or that an unauthorized ...
2
votes
2answers
122 views

What security standards apply to physical security for an infosec office

I'm looking for actual specific standards that apply to physical access control for Information Security office space. Long story short, our building manager wants an open office concept, and in order ...
2
votes
0answers
127 views

Why would anyone steal a boom-gate access card scanner? [closed]

A card reader was stolen from the boom gates of the building last night. There is another card reader at the roller doors of the garage and then again at every elevator. I was wondering why would ...
2
votes
1answer
115 views

If and why should any personal information be destroyed before putting scrap paper into the recycle container?

Well this question may not be about computers, but it most definitely is about information security, so I'll give it a try... I've been repeatedly told in my life that I should always carefully check ...
2
votes
2answers
102 views

Is it possible to protect a key from an attacker with physical access?

So a colleague and I are having an argument about physical access. We have two devices A and B where A contains a function f(x) whose implementation we want to keep secret. We want to allow users to ...
3
votes
0answers
82 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should only be ...
3
votes
2answers
619 views

How to protect/mitigate IntelME (CSME) JTAG attack over USB?

Two security searchers from ptsecurity.com ( Maxim Goryachy‏ @h0t_max and Mark Ermolov @_markel___ ) have announced on Twitter: Game over! We (I and @_markel___ ) have obtained fully functional ...
5
votes
2answers
385 views

Security for KeePass Emergencey Sheet

KeePass just introduced the concept of an emergency sheet that can be shared with trusted users. This question might go beyond the scope of this site, but suppose you printed one of these sheets, how ...
1
vote
3answers
246 views

Evidence of any large scale data breaches from lack of physical security?

You see far-fetched Hollywood examples of the most unlikely scenario's resulting in a data breach due to a lack of physical security. An example is in Mr Robot where the protagonist gets into a data ...
2
votes
1answer
338 views

Is my IP camera secure?

I have recently bought a cheap £20GBP IP camera from an online store. It is branded as "aobo" but the logo was just stuck on and it appears to be a generic model which I have seen for sale under ...
2
votes
1answer
143 views

What are the physical security features that prevent the cryptographic data on a SIM card being read?

In his excellent answer to "How does a SIM card prevent cloning?", user Lie Ryan explains that SIM cards have their critical data stored in "tamper proof housing", protected by "physical security ...
2
votes
0answers
156 views

Linux selective USB-Locking against evil-maid-attacks [closed]

While the question of completely disabling usb-controllers and -storage to defeat an evil-maid-attack has already been answered here quite often, I have a different solution in mind. Upon locking the ...
5
votes
3answers
645 views

Protect Raspberry Pi's physical sd card to be swapped

Scenario: In a company there are Raspberry Pis which are connected to its network environment. A person with bad intentions could swap the SD card and replace it by his own which makes the Pi to a "...
-1
votes
1answer
97 views

MicroUSB equivilent of the Killer USB drive?

There's something so satisfying about the killer usb drive: https://arstechnica.com/security/2015/10/usb-killer-flash-drive-can-fry-your-computers-innards-in-seconds/ 220 volts straight to the ...
1
vote
0answers
67 views

How can you build a device that gives you remote access to a connected LAN? (Not VPN) [closed]

I was wondering how a device (eg. RPi or similar board could be built/configured in a way that when you plug it to a LAN (or connect Wifi) it let's you remotely access the LAN (like VPN, but without ...
68
votes
5answers
21k views

Why is iPhone's internal storage so hard to crack/decrypt?

I’ve heard about a rule in Information Security, that once a hacker has access to your physical machine, then it’s all over. However, there seems to be a big exception to this rule: iPhones. It was ...
7
votes
3answers
2k views

What countries are at highest risk of espionage on personal devices? [closed]

When co-workers travel internationally for business there seems to be risk of bringing a regular work laptop to some countries: the risk is that the government might try to spy on the dta stored on ...
1
vote
0answers
74 views

Is HID attack via UART (RS-232) possible?

I see there is a recent question about intrusion via USB here. Would it be similar to do an HID attack via the serial port (UART / RS-232)? Are there known examples? I can easily physically conduct ...
1
vote
0answers
92 views

Malicious Actor with Physical Access to Encrypted Machine [duplicate]

Some background: My org is potentially involved in a legal dispute with a securities brokerage in a under-developed country with mediocre rule of law. The broker also is responsible for co-locating a ...
4
votes
4answers
189 views

Could it be possible to hijack physical finger prints in digital form and use them to gain access to other devices and locations?

With more and more devices accepting finger prints in place of passwords, could it be possible to "keylog" these finger prints on mobile devices, for example, by installing a rogue application and ...
4
votes
1answer
1k views

Do fTPM implementations protect against physical attacks?

I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC. As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
1
vote
2answers
80 views

How to find entry points to physical systems

I read an article on wired about a whole transit system getting hacked. The intruder disabled ticket machines and displayed messages on the station displays. I was wondering how an attacker finds an ...
4
votes
1answer
112 views

Should employees confront people without access cards?

At my place of employment we have recently been discussing our access card policy. We have different access cards for guests and employees, and anyone not wearing an access card is assumed to be an ...
4
votes
3answers
566 views

Is this RFID blocking wallet actually secure?

This question is based on a quick experiment that I ran when questioning the effectiveness of my RFID blocking wallet (this one). In my experiment, I walked out of my office, placed my RFID id card in ...
4
votes
4answers
226 views

What measures exist to protect against an attacker “forcing employees to comply”

Do any measures exist to protect against the kind of attack depicted in this XKCD, and does this kind of attack have a name? Basically I'm referring to a criminal threatening violence against a ...
0
votes
1answer
251 views

What are the disadvantages of a partial encrypted file system?

There are two disks, one with a read-only filesystem, which holds the installation and configuration files (think root, usr, opt). The second disk is encrypted and holds everything dynamic and user ...
7
votes
2answers
621 views

What is the use of TPM-based Bitlocker if the drive gets decrypted automatically?

I am using Bitlocker which uses a TPM to unlock the drive. My question is, although TPM provides security against tampering, how is it useful in defending against attacks that involve physical access? ...
146
votes
23answers
26k views

Hardening Linux desktop machine against people from my household

I am looking to make a clean install of a Debian system on my home desktop. To clarify, I am switching from Windows and wish to use it as my day-to-day home OS - I'm not going to be running any ...