Questions tagged [physical]
The use of physical measures (such as locks and tamper-proofing) or policies (such as Clean Desk) in order to protect sensitive information from unauthorized access.
400
questions
131
votes
2
answers
24k
views
What to do if caught in a physical pentest?
I've seen a lot of people talk about how to pentest and how NOT to get caught during engagements but have a hard time finding "How to behave when caught during a Red Team engagement".
Red Teams are ...
3
votes
1
answer
282
views
When a closed-source company hires somebody to audit their code, is the auditor forced to do it in the company's office?
Let's say that ACME, Inc. is making closed-source software. It's closed for a reason (they don't want it leaving their building other than in compiled form). Now, they are hiring some company/person ...
42
votes
3
answers
7k
views
Why are my plastic credit card and activation code sent separately?
Capital One recently sent my plastic credit card by post mail and its activation code by a separate post mail. What security problem does this mitigate?
If a rogue element has access to my mail box ...
0
votes
1
answer
180
views
External hard drive
It's possible the external hard drives have been compromised in the company I work for. It would be a huge waste of money to replace them all without detection and if the current ones are compromised, ...
0
votes
3
answers
3k
views
Is it safe to throw away debit card receipts in the bin?
In relation to this question about credit card receipts, is it safe to just throw away receipts where I have used a debit card?
In addition, would it be any more worth while burning/shredding ...
96
votes
3
answers
11k
views
What is the purpose of the rotating plate in front of the lock?
I am now in Poland and see these everywhere:
The plate can rotate freely,when you insert the key, matching the groove, you rotate the key so it is aligned with the lock and then insert the key.
What ...
1
vote
1
answer
2k
views
Requiring hardware key at boot-up on normal laptop
I am sure that a question like this already exists and has probably been answered. I just couldn't find any results (probably due to my inability to word my question correctly).
We use laptops at ...
3
votes
1
answer
369
views
Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?
I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
1
vote
2
answers
748
views
Mobile phone is picking up 13 bluetooth devices and not sure what they are?
I have a particular problem with a potential security breach. I bought a new device today that connects to my phone via Bluetooth. Nothing strange about that.
Surprisingly when I turned Bluetooth on ...
1
vote
0
answers
254
views
An advanced adversary is targeting you - now what? - so what? [closed]
Consider the following:
An advanced adversary is targeting you.
He has the ability to watch most if not all of your network connections and the ones in the neighbourhood. He is sitting on numerous ...
10
votes
1
answer
509
views
What steps should I take to ensure there are no unpleasant surprises in a recently purchased home?
After buying a house from another party (i.e. not new construction) what steps should I take to ensure the previous residents have not left behind anything unpleasant for me?
I'm not worrying about ...
2
votes
1
answer
787
views
How to mitigate the new malicious USB cable USBHarpoon (NOT BadUSB) threat in an enterprise? [duplicate]
In this case, the victims may think they are using a generic USB cable, but the PC will recognize the cable as a Human Interface Device, much like it would a mouse or keyboard, giving the attacker ...
1
vote
1
answer
2k
views
Why should I leave a U2F device always plugged in to a computer?
Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
2
votes
2
answers
186
views
Security and thumb drive [duplicate]
If my laptop is locked, can a thumb drive be able to still infect my computer, or create a backdoor, or any other security risk if it's plugged into it. If so what are some example
0
votes
1
answer
114
views
Does the number of fingerprints we leave represent a security threat to the banking system?
A number of major banks are allowing users to log in to their bank accounts with only fingerprints. It was occurring to me, though: how many fingerprints does the average person leave per day? How ...
3
votes
1
answer
494
views
What is the fastest way to brute force a hardware code
Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B.
Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
1
vote
2
answers
155
views
Liquid security scenario
I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
3
votes
1
answer
379
views
Is there any way somebody could hack into my brain? [closed]
Before you close this, I'm actually serious. Could somebody, in theory, have conked me out behind a Chiles, circular-sawed my brain out, and plugged me up to a machine capable of brain simulation?
The ...
107
votes
19
answers
24k
views
Defence methods against tailgating
This is a follow-up question to this one: Roles to play when tailgaiting into a residential building
How do you protect yourself or your company against tailgaters? What is the best answer when you ...
0
votes
4
answers
218
views
Assessing risks Physical security of devices
I have several devices and flash drives that need to be secured. I haven't been able to find any good physical security measures to protect those devices. What are my options? What do you use, if ...
47
votes
7
answers
15k
views
How resistant are barcodes and QR-codes against attempts to change stored data?
Assume we want to protect a document against manipulating and forging. So, we encode some sensitive information of the document and store it in a QR-code inserted in the document.
Can we be sure that ...
14
votes
2
answers
1k
views
Securing a Laptop from a Foreign Intelligence Agency
What would be the best practices for securing a single-purpose Windows laptop against a determined foreign intelligence agency from tampering with data on the machine? The machine would be used ...
5
votes
1
answer
546
views
If rowhammer only results in capacitor discharge, how can it flip 0 to 1?
In rowhammer, why will changing the voltage on one row cause the other row to open/close? Is it related to induction?
How can it change bits from 0 to 1? I understand from 1 to 0 - voltage discharge, ...
1
vote
1
answer
294
views
Are unbranded home security camera secure? [closed]
I plan on buying a couple of cheap cameras for my home. I plan to put them just inside the doors like the laundry door, I won't be putting them in the bedroom or living room.
My major concern is how ...
4
votes
2
answers
376
views
resource on physical security that calls out doorknobs as being more secure than door handles
A manager invited me to try and test the physical security of his office door lock (by non-destructive means, i.e. not ramming the door down). I found that since the door opened from inside by a ...
13
votes
1
answer
3k
views
How does full memory encryption in newer processes protect against DMA attacks?
Upcoming Intel CPUs have TME, current AMD processors have SME.
These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks.
Both support encrypting the ...
3
votes
3
answers
11k
views
Why is an HSM required to protect CA certificates (rather than a regular USB token)?
Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.
The same vendors also offer distinct products called HSMs (...
0
votes
0
answers
511
views
Feasibility of using serial port/cable to act as a simple data diode?
I'm trying to determine the feasibility of using a serial port/cable to act as a simple and cheap data diode. I'll be connecting 2 Windows PCs (1 of which is on a secured network) using a 1-way null ...
9
votes
4
answers
716
views
Why would taking my laptop home be encouraged for security reasons?
My company's infosec policy contains a statement to the effect that I am encouraged to bring my laptop home with me to that it never leaves my possession/control.
This doesn't seem useful, from a ...
3
votes
1
answer
237
views
Is there some type of x-ray that can see through HSM or shielded integrated circuit?
I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
3
votes
1
answer
7k
views
Is it possible to bypass USB access restriction placed by the Active Directory? [closed]
I've been tasked with an onsite engagement to see what I can find from one of their laptops. They have a policy in place to block USB access through the Active Directory, e.g. When you try to access ...
132
votes
5
answers
27k
views
Is momentary physical access dangerous?
I’m asking the question with these conditions:
The device (computer or mobile phone) is in a running state.
“Momentary” refers to a reasonably short period of time, such as 5 to 10 seconds.
The ...
4
votes
1
answer
467
views
Can an air-gapped PC receive malicious code even when completely clean, apart from all physically attacks?
The Basic question is in the title there are more questions bellow but it is in context of the question in the title...hopefully
What i have read is that it can eavesdrop the Airgap PC via
acoustic
...
1
vote
0
answers
102
views
How to secure unique identification of physical resources in a distributed system?
I'm attempting to build a mechanism to prevent frauds and provide traceability of physical resources in a distributed system. The idea is straightforward: the resource travels hop-by-hop on a network ...
2
votes
1
answer
244
views
Possible physical interface attacks on a server [duplicate]
Let's say you have a server at a data centre, but a hacker manages to find a way in and has access to your server. What are the attack possibilities with all the interfaces available?
Are there any ...
-1
votes
1
answer
141
views
International communications after nuclear fallout [closed]
Is there a (nuclear fallout) scenario imaginable where international communications are thrown back to the stone age?
Meaning:
Satellites are EMP'd out of the sky
Transoceanic cables are cut
...
34
votes
7
answers
6k
views
What are the real physical risks of casual social media publishing?
aka "how to scare my family into stopping publishing their life online?"
I do not publish personal photos / opinions publicly online as a rule. I never gave hard thoughts about that but I believe ...
7
votes
1
answer
442
views
What are good methods of visual security?
What are good methods of visually securing sensitive information that might appear on your screen from the outside world?
An example to illustrate my question would be the following:
You're sat in ...
-2
votes
2
answers
702
views
Creating portable bash terminal & cmd to USB [closed]
Developing my toolkit and I want to have a safe edition of cmd.exe and bash on a usb. Why? These can be tampered with by attackers and I want a version I know is safe from manipulation. Any ...
2
votes
2
answers
2k
views
Security and Veracrypt [closed]
I have a few questions about Security and Veracrypt and hope you can clarify it for me.
I don't want the VeraCrypt hidden volume I created to be damaged. If I mount the hidden volume and transfer ...
157
votes
12
answers
36k
views
4-dial combination padlock: Is it more secure to zero it out or to blindly spin the dials after locking?
I am partially responsible for some resources protected by a 4-dial combination lock like this one:
There are two things that people will usually do after they've locked it:
reset all the digits to ...
2
votes
2
answers
237
views
What security standards apply to physical security for an infosec office
I'm looking for actual specific standards that apply to physical access control for Information Security office space. Long story short, our building manager wants an open office concept, and in order ...
4
votes
2
answers
870
views
Securely storing account credentials/information for critical company services - the bus factor
Question:
I'm trying to figure out best practices for storing authentication credentials for critical company services - hosting services, domain registration services, recruiting portals, etc... To ...
0
votes
2
answers
280
views
What would 'best practice' look like in protecting critical infrastructure against state actor cyber attack?
I was reading this article from the New York Times, which details the alarming degree to which the IT systems running critical civic infrastructure have allegedly been compromised by Russian cyber ...
5
votes
1
answer
280
views
If and why should any personal information be destroyed before putting scrap paper into the recycle container?
Well this question may not be about computers, but it most definitely is about information security, so I'll give it a try...
I've been repeatedly told in my life that I should always carefully check ...
-3
votes
1
answer
344
views
Why are mailboxes unsecure? [closed]
Why can anyone go up to a mailbox and just take the mail out of it? Some mailboxes, like at townhouses and apartments, have locks, but the mailboxes at single family homes that I have seen do not. Isn’...
2
votes
3
answers
5k
views
Wired VS Wireless Mouse & Keyboard Security
Wired VS Wireless Mouse & Keyboard Security
For someone who is trying to maintain the highest level of security, which option proposes the LEAST amount of security flaws?
Wired Keyboard & ...
41
votes
6
answers
10k
views
How "scrambled" is the data on a RAID5 disk?
My concern is the disposal of a replaced disk from a private RAID5 disk array.
I have had to replace a disk from my personal RAID5 disk-array. It had started developing errors, so out it went.
But ...
-1
votes
3
answers
2k
views
Shutdown vs sleep
From a security point of view, is sleep safer than shutdown in laptops? Shutdown only needs to be done after monthly updates, since shutdown "saves" settings, "changes" etc, then reboots. Sleep only ...
5
votes
2
answers
3k
views
Are DVDs vulnerable to firmware malware (and assorted questions)? [closed]
I have a few questions about DVD drives.
Are DVD drives and SATA interfaces vulnerable to issues like BadUSB caused by being able to reprogram firmware of the drive or disk or even spreading to other ...