Questions tagged [physical-access]

The best security measures can be rendered useless if you don't physically protect your systems. An intruder can steal a computer, server, or smartphone, then crack the password at his leisure. (Source: "Physical access". Wikipedia. Citing: Michael Meyers. ISBN 978-0-07-225345-0. McGraw-Hill Education.)

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Protect laptop BIOS rootkit when attacker has physical access

My idea is that, what is the point of disk encryption or any other security measures if attacker uses BIOS rootkit when he has physical access to laptop. Until laptop is off it maybe protected against ...
user avatar
  • 207
0 votes
1 answer
112 views

What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?

I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
user avatar
  • 23
0 votes
2 answers
158 views

What are the best steps to take to secure a LINUX PC from physical attack? Evil Maid, Boot Sector Malware?

What would be the best security practice to protect a device from physical attack? For instance an Evil Maid or boot sector malware? For this question we are going to go with a UEFI boot debian linux ...
user avatar
0 votes
1 answer
152 views

Encrypted drives and non-interactive use

I would like to protect the data on my backup system, in case it gets (physically) stolen. I would encrypt the hard drives where the data resides. Since the backup system typically acts non-...
user avatar
0 votes
1 answer
149 views

After EOL, can safety-critical systems be secured when connected to internet-connected components? [Automotive]

NOTE: This was originally asked on the main StackOverflow site, but now moved here because of the security nature of the question. Since internet-connected Infotainment Systems are now connected with ...
user avatar
  • 113
3 votes
1 answer
177 views

Does Intel's vPro TME make a locked screen more secure?

This post seems on point but I didn't understand the answer enough to answer this question. Intel's vPro offers "Total Memory Encryption" (TME), which encrypts RAM and system bus data while ...
user avatar
  • 31
0 votes
1 answer
136 views

Prove someone entered and exited a room at specific times without any biometric authentication [closed]

There is a room. There is a lot of incentive for people to enter this room. This room allows you to enter and exit whenever you want, but for each minute you stay in the room, you get a dollar. ...
user avatar
  • 103
0 votes
3 answers
368 views

How good/bad are these transparent Linux consumer FDE setup options? (e.g. for auto-unlocking LUKS)

UPDATED Summary: I'm looking at Linux FDE options that are transparent to the user (my parents) in that the user doesn't need to enter 2 passwords. I found/thought of several options and tried to ...
user avatar
  • 331
0 votes
0 answers
87 views

Options for Integrating or developing a physical security solution (physical access control via in-house mobile apps [NFC/Bluetooh])

Our team is looking to either integrate or develop a physical security solution for a rather large campus. Requirements: Ability to either integrate (with reader/electronic lock hardware) from our ...
user avatar
0 votes
1 answer
218 views

Security against local attack for remote FDE decryption?

Is there any remote FDE decryption that is resistant to an attacker that has local physical access? Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
user avatar
1 vote
3 answers
156 views

In an enterprise environment, should developers/maintainers be able to look at production logs by accessing the application servers?

I came across this practice, from a big company handling personal customer data, of not allowing developers/maintainers to look straight at the application logs (e.g. good old tail | grep) by ...
user avatar
  • 113
0 votes
0 answers
117 views

Thoughts on Vaccine Security

Are there any recommendations for the physical security of COVID-19 vaccine? I recently watched this video https://www.youtube.com/watch?v=uoqMA9vAOrQ on covid-19 vaccine distribution. At the 0:40 ...
user avatar
  • 1,560
0 votes
1 answer
157 views

Will using super-glue on the screws of my laptop prevent it from being opened unnoticed?

I know someone can break open the case, but what about opening it without leaving evidence? Are there any seals available for securing your laptop from unauthorized access? And sealing the sides of ...
user avatar
1 vote
1 answer
131 views

Does UHF RFID implement any security at all?

Feel free to correct my below logic. As far as I can tell, HF RFID tags (specifically I've tested MiFare Classic 1kb) have a 48-bit encryption key (default to 0xFFFFFFFFFFFF or something) to protect ...
user avatar
1 vote
2 answers
278 views

Can a BIOS password along with a HDD password prevent evil maid attacks?

By definition evil maid attacks involve altering a device in an undetectable way. So if I lock the BIOS, set the HDD to boot first and put a HDD password will this prevent it? Access to the computer ...
user avatar
1 vote
2 answers
774 views

Is a BIOS password enough to prevent someone from hacking into my laptop if they have physical access?

Would my laptop be secure against physical access if I set up a bios password and full disk encryption ? If not then is there any way to secure your laptop from someone with physical access? How hard ...
user avatar
0 votes
1 answer
257 views

Is there any write-once USB stick/pendrive? [closed]

Is there any Write-once USB stick/Pendrive? I need to submit some files to Authorities and I don't want them to modify on whatsoever. Any suggestion?
user avatar
  • 101
1 vote
0 answers
105 views

Does authentication for USB keyboards exist?

I think bluetooth has an authentication measure. As a user, when I get a new bluetooth keyboard, I have to: Go to my computer, search for bluetooth devices Put my keyboard in "pairing mode" My ...
user avatar
  • 3,892
55 votes
10 answers
13k views

Does the saying "physical access = game over" apply to smartphones, too?

I was surprised to read in the responses to this popular question that it's considered nigh impossible to secure a computer system if intruders have physical access. Does this apply to smartphones ...
user avatar
  • 663
1 vote
2 answers
358 views

Is there a way to "lock" a YubiKey after a period of inactivity?

I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, ...
user avatar
  • 1,106
1 vote
3 answers
419 views

How long does it take to have spyware installed on a laptop?

During my commute from an airport located in a country whose government is known for intrusions into the privacy of its citizens and non-citizens, I had my laptop taken from me during a routine ...
user avatar
  • 11
0 votes
0 answers
22 views

When they make physical locks, do they really just make a few variations of the keys and then mix them together and sell? [duplicate]

I always assumed that each lock is unique and can only be opened with the keys it was sold with (or any copies made later from those originals). But the truth seems to be that they just make "a few" ...
user avatar
41 votes
9 answers
10k views

What are the potential risks of leaving a device in public, but locked? [closed]

Let's say you're in a public café, or conference, where you trust your device won't be stolen if you go to the bathroom for 5 minutes, but you don't trust it might not be tampered with. What are the ...
user avatar
  • 529
33 votes
8 answers
6k views

If password expiration is applied, should door-lock expiration be applied too?

After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
user avatar
  • 1,341
1 vote
1 answer
231 views

What is it called when someone glides through a building's external door behind you? [duplicate]

One form of social engineering is the practice of running up to a building's external door just as an employee is entering. The employee often holds the door open for the intruder, bypassing security ...
user avatar
  • 113
0 votes
0 answers
103 views

How far can a malicious USB device get you on a server?

If the device is plugged in when the user is already logged in, then of course the device can just pretend to be a keyboard, open a terminal, and run a compromising command. (shortcuts for terminals ...
user avatar
  • 450
96 votes
3 answers
10k views

What is the purpose of the rotating plate in front of the lock?

I am now in Poland and see these everywhere: The plate can rotate freely,when you insert the key, matching the groove, you rotate the key so it is aligned with the lock and then insert the key. What ...
user avatar
  • 831
20 votes
3 answers
8k views

Stolen MacBook: should I worry about my data?

Unfortunately, someone stole my laptop (a MacBook) and I did not realize that for 48 hours. Now, this was a work laptop and my company's security team is going to wipe the laptop remotely as soon as ...
user avatar
  • 415
0 votes
1 answer
86 views

Interpreting this F-Secure Video of a DMA-Attack

I'm trying to interpret this video demonstration by F-Secure of the big cold-boot attack discovered last year. What is happening at the 50-second mark? Why does he insert the USB boot-device before ...
user avatar
  • 141
1 vote
1 answer
272 views

Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?

I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
user avatar
  • 111
23 votes
5 answers
7k views

Selecting a secure PIN for building access

What are the general criteria for rejecting an insecure PIN to access a building? There has been a lot of discussion about password selection security. Minimum length requirements, mandatory classes ...
user avatar
  • 443
8 votes
6 answers
859 views

I am a political activist, its likely that my computer will be compromised in the future, how can I secure my data?

I have sensitive data to secure. My computer may likely be compromised physically in the future. How can I secure my date from various attacks like Evil Maid attacks and so forth. I have some basic ...
user avatar
  • 81
1 vote
2 answers
365 views

Device security in IOT

I am working on an IOT device that sends data to the server after authenticating itself to the server. Is there a way to safely store my device's credentials for logging onto the main server and ...
user avatar
1 vote
1 answer
165 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
user avatar
10 votes
2 answers
473 views

risk from USB-C port on locked laptop

If an attacker has access to the USB-C port on my laptop which is in powered on but at the lock screen, what is the risk that they are able to carry out an evil maid attack? Say I'm in the room but ...
user avatar
4 votes
1 answer
200 views

How to Best Minimize Damage After Loss of Computer

Myself and the rest of my coworkers on my (former) employer’s dev team were all just laid off from our jobs, and the employer took our MacBook Pros without letting us clear of our personal information ...
user avatar
1 vote
4 answers
812 views

Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?

Bruce Schneier Writes Down Passwords. So Can You ... But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...
user avatar
2 votes
2 answers
324 views

Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?

An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did? For example, let ...
user avatar
  • 2,937
3 votes
1 answer
335 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
user avatar
  • 543
107 votes
19 answers
23k views

Defence methods against tailgating

This is a follow-up question to this one: Roles to play when tailgaiting into a residential building How do you protect yourself or your company against tailgaters? What is the best answer when you ...
user avatar
  • 1,669
114 votes
6 answers
20k views

Roles to play when tailgaiting into a residential building

Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
user avatar
  • 1,817
2 votes
1 answer
269 views

Recommendations for tamper resistance without reasonable access security

I have an off-the-shelf PC with a database on it (CouchDB). The database contains sensitive data. I'm taking this machine to a community with poor/zero data connectivity, where the database will ...
user avatar
  • 131
2 votes
1 answer
295 views

Are nearby attackers dangerous?

It is a general consensus that physical access can be dangerous. However, I would like to know attack vectors if attackers only get nearby access to the system. I’m assuming that the word access ...
user avatar
  • 2,247
2 votes
1 answer
231 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
user avatar
  • 124
5 votes
1 answer
385 views

How to check for security breach after a potential physical home intrusion

My family member has reason to believe that someone entered their house last night although they cannot be certain because they only have circumstantial evidence: In the morning they found a light ...
user avatar
  • 153
3 votes
2 answers
389 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
user avatar
14 votes
2 answers
1k views

Securing a Laptop from a Foreign Intelligence Agency

What would be the best practices for securing a single-purpose Windows laptop against a determined foreign intelligence agency from tampering with data on the machine? The machine would be used ...
user avatar
  • 243
1 vote
2 answers
110 views

Protecting payment mobile app against mobile theft

Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
user avatar
6 votes
4 answers
2k views

What is the real danger of not putting a login password in Windows in a small company except that of allowing anyone to go physicaly on your computer?

My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks ...
user avatar
  • 63
1 vote
1 answer
189 views

Checking for installed background processes in my phone [closed]

I came from Russia recently. The security officer asked me to open my phone. When I handed it over to them, I saw there was a black screen with Russian writing on my phone when the officer was ...
user avatar