Questions tagged [physical]

The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.

Filter by
Sorted by
Tagged with
41
votes
7answers
14k views

Methods for protecting computer systems from physical attacks

I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures. Consider the ...
29
votes
7answers
4k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
14
votes
3answers
5k views

How can I prevent someone from accessing a Windows XP system via boot disk?

Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one: http://www.raymond.cc/blog/...
130
votes
5answers
26k views

Is momentary physical access dangerous?

I’m asking the question with these conditions: The device (computer or mobile phone) is in a running state. “Momentary” refers to a reasonably short period of time, such as 5 to 10 seconds. The ...
55
votes
13answers
16k views

Is it possible to turn a computer into a bomb?

I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
29
votes
7answers
2k views

Protecting critical state infrastructure from the aftermath of a nuclear blast

Countries rely on computer infrastructure for a huge percentage of communications and military management, as well as utilities like electricity. Unfortunately, nuclear attacks release massive ...
6
votes
2answers
5k views

Safely disable firewire/thunderbolt, patching up DMA exposure

I understand that Firewire 400/800 and Thunderbolt have DMA enabled, and a malicious hardware device can easily read and manipulate system memory at will. If I disable the software drivers for these ...
129
votes
2answers
22k views

What to do if caught in a physical pentest?

I've seen a lot of people talk about how to pentest and how NOT to get caught during engagements but have a hard time finding "How to behave when caught during a Red Team engagement". Red Teams are ...
96
votes
13answers
13k views

Why do we lock our computers?

It's common knowledge that if somebody has physical access to your machine they can do whatever they want with it1. So why do we always lock our computers? If somebody has physical access to my ...
68
votes
8answers
54k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
31
votes
2answers
6k views

Can a connected USB device read all data from the USB bus?

Is it possible for a (malicious) (hardware) USB device to access all the data that is transferred through the USB bus and then read/store this information, essentially sniffing all transferred data? ...
24
votes
7answers
2k views

Securing the security guy's home office: what should we do?

I read an article in the latest InfoSecurity magazine (an infosec trade rag by Elsevier) saying that us security professionals aren't necessarily taking the correct steps to protect our own home ...
27
votes
13answers
11k views

Is it possible to prevent unauthorized copying or recording of data by photographing screens?

I am thinking on a way which would prevent unauthorized copying or recording of data by photographing screens. I also think, if the content of a screen is understable for an eye of a living human, it ...
10
votes
2answers
2k views

Is it possible to reliably derive a key from a biometric fingerprint?

Many products (e.g. notebooks, security doors and now smartphones) support some form of fingerprint authentication. That seems simple enough: A trusted system compares a stored representation of a ...
11
votes
3answers
866 views

Sourcing hardware that is least likely to contain backdoors

I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
6
votes
2answers
9k views

I am always Hibernating my System, is there any risk for my Encrypted drive with BitLocker?

I am Always Hibernating my Laptop, for faster booting, I encrypted sensitive drive by BitLocker, what if my Laptop stolen and attacker knew that it was in hybernate mode, can he decrypt my hard?
33
votes
2answers
105k views

Disabling/Destroying CCTV/IP Cameras with Lasers?

@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical ...
89
votes
9answers
15k views

Secure USB cable for charging in untrusted environments

On a long haul flight, I imagine that charging a phone (in flight mode) with the inbuilt USB port on the head rest would be a security risk. Could I mitigate that risk by taking a regular USB cable ...
41
votes
9answers
7k views

Is physical security less important with disks on a server being encrypted?

If you could get physical access to a server, you could change the root/admin password even if you did not know the current password. However with encrypted disks, I don't think this is possible (...
13
votes
2answers
4k views

Write-protection at hardware level for security

It seems to me that to maximise server security, one ought - in addition to the usual security measures implemented in software - to prevent the overwriting of certain parts of the server system, such ...
8
votes
3answers
7k views

What can a hacker do when he has physical access to a system?

I mean, I'm a tech guy here in my region (not a hacker...). When I sit in the front of another person's PC, I notice a little fear about what I can do in the system. It's obvious that I will not ...
3
votes
1answer
232 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
2
votes
1answer
6k views

What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]

I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed out)...
-6
votes
6answers
22k views

Will antivirus detect all keyloggers?

Our company schedules Security Training courses for our personnel. In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
3
votes
3answers
725 views

Risk when attacker has only physical access to a computer's USB port

Attacker has only access to USB port and can either attach a device or pen-drive to a computer, that can be on or off. Imagine a scenario where non-reliable people have access to offices, either ...
2
votes
4answers
2k views

Is there such thing as a password enforced write protected flash drive?

We would like to provide a flash drive to a client, that they can boot to, which includes a read-only operating system of our own customization, probably Linux. Every boot, it starts from clean slate. ...
2
votes
1answer
141 views

Possible physical interface attacks on a server [duplicate]

Let's say you have a server at a data centre, but a hacker manages to find a way in and has access to your server. What are the attack possibilities with all the interfaces available? Are there any ...
82
votes
5answers
7k views

Somebody bumped into me, next day my storage unit was burglarized

While I was walking in the street, somebody carrying a laptop bag bumped into me, and the next day I found out that my storage unit was burglarized and some important items were stolen. My storage ...
34
votes
7answers
6k views

What are the real physical risks of casual social media publishing?

aka "how to scare my family into stopping publishing their life online?" I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
51
votes
7answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
34
votes
1answer
5k views

How to deal with third parties in physical pentests?

From my previous question, I've seen that a "Permission to Attack" slip is crucial in ANY Penetration Test. However, that question and its answers and comments have only discusses interactions between ...
31
votes
2answers
55k views

Is there any way to tell if CCTV is on or not?

Is there any way that an attacker can identify if a CCTV camera is on/operational without direct physical access to the cable/camera? If it is on, is there any way an attacker can tell if its being ...
11
votes
2answers
9k views

Attacks via physical access to USB (DMA…?)

I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or a laptop attached to a desk. Obviously, the boot sequence should be secure (...
22
votes
3answers
11k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
6
votes
7answers
11k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
26
votes
5answers
4k views

How does a clean desk policy provide security benefits?

I'm starting to study for Security+ using Darril Gibson's book. I took the pre-exam and one of the questions is “What is the most important security benefit of a clean desk policy?” The choices are: ...
14
votes
3answers
2k views

In what cases can overly strict security policies be detrimental to organisations?

In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone? I've worked at some companies where ...
14
votes
3answers
41k views

How many unique house keys can possibly exist?

A Yahoo! answers user suggested that there are 5^5 possible unique configurations for a physical key, but the answer wasn't sourced. I wondered if anyone had similar numbers for how many possible key ...
13
votes
1answer
823 views

How to apply IT Security knowledge to Home Security?

Today my car got stolen from my house, and it is possible the person who did it has access to my home. I try to take secure measures online to maintain security, yet it seems I never paid attention to ...
10
votes
5answers
842 views

Best practices for physically securing a notebook

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
24
votes
2answers
6k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
10
votes
2answers
1k views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
6
votes
2answers
223 views

How to handle decomissioned/donated/RMAed printers?

Printers, nowadays, almost always include some form of non-volatile storage that keep tracks of pretty much everything that went through the device. In the case of larger, "departmental" system that ...
3
votes
4answers
2k views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...
10
votes
4answers
2k views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks unique ...
8
votes
4answers
893 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
5
votes
1answer
863 views

Security differences between Passive and Active RFID tags

Most people are aware there are two types of RFID tags, active tags (ones that contain a power source of some kind) and passive tags (ones that are powered by the RF field). I'd like to know if ...
4
votes
5answers
4k views

How should I store a physical written copy of my password? [duplicate]

I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, then....
3
votes
3answers
900 views

Any solutions out there to counter shoulder surfing?

I'm talking about an unknown or undetected physical presence who may be looking over your shoulder as you view or type in sensitive information or passwords. Most likely to happen when you are ...
2
votes
4answers
454 views

Help to account all the points of physical access to a rack server to steal software

Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)... The limitation for their ...