Questions tagged [physical]
The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.
401
questions
5
votes
3
answers
11k
views
What is a AUTH-KEY in the security of the computers?
I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
CommunityBot
- 1
1
vote
1
answer
64
views
Since JTAG can be authenticated and encrypted, which key is used? I read that Secure Boot is used, but what is the key?
Since JTAG can be authenticated and encrypted, which key is used? I read that Secure Boot is used, but what is the key? Me, owner of this laptop, how can I know the key to use to access my own laptop ...
- 1,548
4
votes
1
answer
333
views
Physical mechanical examples of "M-of-N" locks?
Arbitrary "M-of-N" secret-sharing protocols are a well-studied topic in cryptography, and are apparently so useful that Bitcoin Script devoted a whole opcode to them.
In this blog post, I ...
- 34.6k
-1
votes
2
answers
227
views
Laptop Repair vs. Evil Maid
Suppose you need a laptop repair, so you bring it to
A big box store where you have some sort of coverage (who will have the computer for 2-3 weeks)
A small chain of repair shops
a small independent ...
36
votes
5
answers
4k
views
Are there any guidelines for passwords that need to be read out loud?
I recently saw the movie Olympus Has Fallen.
Like in many action movies, at the end a missile is launched, and the hero (Mike Banning, played by Gerard Butler) has 60 seconds to recall the launch in ...
- 1,672
0
votes
0
answers
87
views
compatability of Desfire EV1/2 readers and cards with a Doorking access control system
I am getting the idea that Doorking's ProxPlus cards and reader have a pre-defined encryption key in their reader. As these readers are wiegand devices and the software for the Doorking Access systems ...
- 132k
0
votes
2
answers
193
views
Mitigating vulnerabilities in audio libraries that cause physical damage
As I pointed out here in February 2022, people who gained brief direct or remote access to a machine can change the volume step or other things regarding sudden large changes to the sound volume (for ...
- 132k
16
votes
5
answers
10k
views
Can fingerprint readers be trusted?
I've recently obtained a new notebook, specifically a Thinkpad. Now I found out that it has a fingerprint reader integrated into the power button. I am skeptical about biometrics as a security ...
- 121
40
votes
6
answers
10k
views
How "scrambled" is the data on a RAID5 disk?
My concern is the disposal of a replaced disk from a private RAID5 disk array.
I have had to replace a disk from my personal RAID5 disk-array. It had started developing errors, so out it went.
But ...
- 34.8k
3
votes
1
answer
2k
views
Do dial locks have repeated numbers?
Can dial locks, such as the one below, have repeated numbers in their combination? For example, the combination 10-39-10 has the number 10 repeated twice in it. If so how often is this the case?
0
votes
0
answers
808
views
Remotely disable a laptop's ability to power on or charge?
If I loan out laptops to my employees to work remotely, such as Dr's, Nurses and other healthcare workers that generate sensitive information on patients, how can I remotely disable the laptop's ...
- 12.5k
3
votes
0
answers
240
views
Does Windows 10 read/run/care about USB devices plugged in "Lock Screen" mode?
Whenever I leave my computer for the bathroom or anything inside the living space, I press WinKey + L to enter the "Lock Screen" mode. (If I go outside, I turn it off completely.)
Let's say ...
1
vote
1
answer
333
views
Rowhammer mitigations in current hardware and software
I've been looking into rowhammer attacks and mitigations and there are two (what seem to be) mitigations that I've seen that are actually implemented in currently available hardware and software, but ...
- 5,507
6
votes
2
answers
621
views
What value security wise, if any, does a digital handwritten signature have?
Here's an example of what I mean:
(It's basically the same thing as a traditional signature.)
Given I've never seen someone fail this control, it's unclear to me what real security such a system ...
3
votes
3
answers
12k
views
Why is an HSM required to protect CA certificates (rather than a regular USB token)?
Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.
The same vendors also offer distinct products called HSMs (...
- 319
47
votes
7
answers
16k
views
How resistant are barcodes and QR-codes against attempts to change stored data?
Assume we want to protect a document against manipulating and forging. So, we encode some sensitive information of the document and store it in a QR-code inserted in the document.
Can we be sure that ...
- 103
7
votes
5
answers
20k
views
Finding hidden cameras
Let's say Alice, Bob, and Mallory all live together in a house.
Mallory decides to go on vacation, but before leaving, she decides to play a game with Bob and Alice. She makes two claims:
She has ...
- 67.1k
0
votes
3
answers
495
views
What can an attacker do with physical access to a Linux server?
I have physical access to a Linux computer (Ubuntu 20.04). My colleague asked me what an attacker could do if he had physical access to this computer?
I would like to know if, by default (after a ...
- 8,193
54
votes
11
answers
11k
views
Why did they stop adding physical "write protect" mechanism?
Floppy disks used to have a physical means of preventing writing to them. No software could bypass that, no matter what. It had to be flicked physically and manually by a human being.
Modern SD cards ...
- 2,305
1
vote
1
answer
241
views
As a private individual, cleanly destroy a large number of paper documents. Are there alternatives to the consumer shredder?
I need to safely dispose of about 30 federal folders. That means 95% of the documents will be shredded and the rest stored. I bought a small shredder for private people (professional shredders are too ...
- 50.4k
2
votes
2
answers
291
views
What is the name of the box that hackers connect to a router in order to spy on all your traffic?
I watched a documentary where hackers entered a victim's house by pretending to be from the ISP and then connected a box to a router in order to spy on all of the victim's traffic. Later, the hackers ...
15
votes
5
answers
3k
views
Is it possible to prevent a physical attack on full disk encryption?
I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
- 67.1k
3
votes
1
answer
397
views
Is there any way somebody could hack into my brain? [closed]
Before you close this, I'm actually serious. Could somebody, in theory, have conked me out behind a Chiles, circular-sawed my brain out, and plugged me up to a machine capable of brain simulation?
The ...
- 67.1k
0
votes
1
answer
131
views
What type of attacks can be carried against an OS with FDE, if we assume OS and FDE are implemented correctly?
The question is mainly stated in the title. I was wondering what kind of attacks can be launched on such a setup, where someone has access to a running OS with locked screen (needs password for the ...
- 132k
4
votes
1
answer
557
views
Detecting BIOS changes on PC
I've seen this question: Is it possible to determine if the BIOS has been modified between two points in time?
On my Linux PC, I've made a script that checks the MD5 hash of the boot partition to ...
CommunityBot
- 1
1
vote
1
answer
2k
views
Requiring hardware key at boot-up on normal laptop
I am sure that a question like this already exists and has probably been answered. I just couldn't find any results (probably due to my inability to word my question correctly).
We use laptops at ...
CommunityBot
- 1
13
votes
2
answers
6k
views
Write-protection at hardware level for security
It seems to me that to maximise server security, one ought - in addition to the usual security measures implemented in software - to prevent the overwriting of certain parts of the server system, such ...
- 67.1k
-1
votes
3
answers
2k
views
Shutdown vs sleep
From a security point of view, is sleep safer than shutdown in laptops? Shutdown only needs to be done after monthly updates, since shutdown "saves" settings, "changes" etc, then reboots. Sleep only ...
- 67.1k
131
votes
5
answers
27k
views
Is momentary physical access dangerous?
I’m asking the question with these conditions:
The device (computer or mobile phone) is in a running state.
“Momentary” refers to a reasonably short period of time, such as 5 to 10 seconds.
The ...
- 67.1k
0
votes
2
answers
137
views
Sophos Safeguard detecting content of zip files being uploaded
Is it possible to use Sophos safeguard to detect when computers in the network upload certain files online when they are compressed in a zip file? (or 7z or similar).
I've seen it is possible with ...
- 101
5
votes
2
answers
3k
views
Are DVDs vulnerable to firmware malware (and assorted questions)? [closed]
I have a few questions about DVD drives.
Are DVD drives and SATA interfaces vulnerable to issues like BadUSB caused by being able to reprogram firmware of the drive or disk or even spreading to other ...
- 67.1k
2
votes
0
answers
185
views
Allow the use of camera phones in the manufacturing facilities; but then how do I maintain the security of the premises
What are the best practices to be followed to maintain security in the manufacturing site where camera phones are allowed?
I'm working on one of the largest manufacturing facility where few of the R&...
0
votes
0
answers
103
views
Windows 10 Cybersecurity on Stand-Alone Computer
I have been asked to investigate what capabilities exist within Windows 10 where the environment for this system is isolated. I believe it would not be able to benefit from an enterprise security ...
- 255
0
votes
1
answer
154
views
Has there ever been a case of dangerous industrial malware, which would destroy motherboards and similar PC components and how to protect [duplicate]
I heard many years ago from word of mouth that this kind of malware exists, which could for example blow up capacitors in your PC.
Has such malware or something even remotely similar ever existed?
...
- 1,346
38
votes
5
answers
5k
views
Risk of tampering when hardware shipment is delayed
I am currently receiving an order of computer parts in the mail including an SSD. Tracking showed that the package arrived in my town on day X, and was originally scheduled for delivery on day X as ...
- 1
14
votes
2
answers
14k
views
Attacks via physical access to USB (DMA...?)
I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or a laptop attached to a desk.
Obviously, the boot sequence should be secure (...
- 1
14
votes
1
answer
4k
views
How does full memory encryption in newer processes protect against DMA attacks?
Upcoming Intel CPUs have TME, current AMD processors have SME.
These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks.
Both support encrypting the ...
- 67.1k
14
votes
2
answers
1k
views
Securing a Laptop from a Foreign Intelligence Agency
What would be the best practices for securing a single-purpose Windows laptop against a determined foreign intelligence agency from tampering with data on the machine? The machine would be used ...
- 2,275
0
votes
1
answer
217
views
After EOL, can safety-critical systems be secured when connected to internet-connected components? [Automotive]
NOTE: This was originally asked on the main StackOverflow site, but now moved here because of the security nature of the question.
Since internet-connected Infotainment Systems are now connected with ...
- 136k
0
votes
0
answers
256
views
Feasibility of CPU Backdoors
Recently I was thinking of the feasibility of hardware backdoors in the CPU introduced by manufacturers at the behest of three letter agencies. I can think of two potential backdoors that seem ...
7
votes
5
answers
21k
views
Is using Google Voice number for two-factor authentication a big mistake?
Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
52
votes
6
answers
11k
views
Why does one need a strong password on Unix?
SSH Server: I only allow public-key authentication.
Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
- 132k
0
votes
1
answer
431
views
How to prevent copying of digtal (handwritten) signatures? [duplicate]
Assuming that you are not given any other choice than to implement digital handwritten signatures. That is, a signature pad (or even a computer mouse) is used to generate a digital signature which is ...
- 132k
5
votes
1
answer
328
views
In a physical pen test, is there a way to figure out FOV of a tinted dome camera?
With bullet cameras, this is easy. You look which way they are pointing and then either guess their FOV, or even look them up based on how the model they appear to be.
Most dome cameras are behind ...
- 10.6k
4
votes
4
answers
6k
views
Does a commercially available self destructing HDD (set in BIOS) exist?
Does a self destructing HDD (physically destruction) that will destroy after a certain time exist, or when I use some software to initiate its self-destruction?
I guess it need to be set in BIOS or ...
- 1
1
vote
1
answer
306
views
Use of SoftHSM2 in commercial products
I came across SoftHSM2 from OpenDNSSec(BSD license) which is a drop-in replacement for HSM except that SoftHSM2 only lacks physical security. Also, being the fact that PKCS#11 is the standard ...
CommunityBot
- 1
2
votes
2
answers
2k
views
Security and Veracrypt [closed]
I have a few questions about Security and Veracrypt and hope you can clarify it for me.
I don't want the VeraCrypt hidden volume I created to be damaged. If I mount the hidden volume and transfer ...
- 2,275
3
votes
1
answer
251
views
Is there some type of x-ray that can see through HSM or shielded integrated circuit?
I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
- 67.1k
2
votes
1
answer
310
views
Apple's Keychain - good security?
This management system runs under a user's password. Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)? My thoughts are, "No." ...
- 518
6
votes
5
answers
2k
views
Detecting and filtering data over AC power lines?
Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?
I'm not sure how difficult this is ...
- 111