Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tamper-resistance]

The tag has no usage guidance.

2
votes
5answers
223 views

Prove log files weren't tampered with?

Say I have some Apache logs that show brute force attempts on a login page. I've singled out the IP, and found out who the culprit was. How can I show to a third party that I didn't makeup the entries ...
12
votes
2answers
755 views

Securing a Laptop from a Foreign Intelligence Agency

What would be the best practices for securing a single-purpose Windows laptop against a determined foreign intelligence agency from tampering with data on the machine? The machine would be used ...
5
votes
1answer
236 views

What use does a TPM have for accurate timekeeping?

I stumbled across this image and something immediately stood out to me. This is a photograph of a discrete TPM card. That silver cylinder on the left is a crystal oscillator, used to tell time with ...
2
votes
2answers
1k views

How do you keep someone from changing hidden values in an HTML form?

If I have an HTML form, and it has hidden inputs for ID numbers and the like (so I know the id key of of table x to update), how can I secure it so the person can't just change it and screw up ...
-1
votes
0answers
110 views

Implement physical self-destruct for embedded hardware to prevent IP theft?

I want to design a piece of hardware for control of an industrial system. The system will be based on an ARM board running embedded Linux that will be in a custom case of some kind. I am interested in ...
1
vote
1answer
234 views

Android tamper resistance: BuildConfig.DEBUG spoofing?

Our team is trying to secure a native Android mobile app. Amongst other things we are using Dexguard for some checks such as tamper, root and emulator detection. Long story short: some of these ...
2
votes
1answer
57 views

Is it possible to guarantee a transaction between two peers against interruption exploits?

Let's take an egregious example of this: Alice and Bob want to clone a Pokemon. They set up a trade between their console devices. Alice's device sends a copy of the data to Bob's device, then Bob's ...
2
votes
1answer
242 views

Is the Ethereum blockchain truly a tamper-proof way to deploy distributed applications?

The Ethereum website says that it provides a "cryptographically secure, decentralized, tamper-proof network" on which applications written in the Solidity contract language could be deployed. (https://...
1
vote
1answer
681 views

Post Data tamper detection [closed]

I have been studying a bit on security on how to make my mobile rest server secure. I am looking at one mobile application that uses plain HTTP. I have Charles proxy breakpoint enabled and edit the ...
0
votes
2answers
792 views

Best way to make a Linux install tamper proof

Good day, I am currently planning an environment where it comes down to the biggest security risk being to boot to another environment and tamper with the install on the disk (Older PCs with physical ...
0
votes
0answers
73 views

Altering assembly without affecting digital signature

I have discovered a software crack where the license check assembly (.NET) has been altered but the digital signature and the strong name are both still perfectly intact. Strong naming is easy to ...
14
votes
6answers
3k views

Mitigating forensic memory acquisition when an attacker has physical access to a workstation

My question regards whether or not the mitigations I use are appropriate for my threat model. Please don't jump to conclusions and say "you need to use locks" or "you can't leave your computer ...
1
vote
2answers
147 views

Don't encrypt the hard drive, but make it impossible to change things without a password?

I recently bought an SSD drive and realized that my CPU (Celeron 1007U - has no AES instructions) cannot really keep up encrypting it and the SSD doesn't have hardware encryption built in. This made ...
8
votes
4answers
794 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
37
votes
8answers
6k views

How to know whether a textfile has been edited or tampered with?

Is it possible to know whether a textfile, e.g. in XML format, has been edited or tampered with over time? The context to my question follows: I am a scientist in industry using a technology called ...
1
vote
2answers
99 views

How could an hard-token be packaged such that the recipient could trust it?

I purchased a Yubikey NEO, which arrived in a small plastic thing, inside of a padded envelope. An attacker with access in transit would have had basically unlimited ability to manipulate it. Which ...
37
votes
2answers
5k views

How can it be easy to write but “impossible” to extract the private key from a crypto token?

A number of crypto-dongles make the claim that it is impossible to extract the stored private key once written. Yubico: The YubiKey AES Key information can never be extracted from a YubiKey ...
3
votes
3answers
2k views

Tamper proof hardware - not resistant

Can you make a TPM (or any piece of hardware) Completely tamper-proof? The “regular” tamper resistant hardware has various physical attacks http://www.milinda-perera.com/pdf/EKKLP12a.pdf I have been ...
4
votes
1answer
45 views

safely changing distribution, is there a strategy to get an distro iso image untampered?

I can check that an Ubuntu iso file is indeed untampered using the public keys already present and trusted in my Ubuntu system. Now I want to switch from Ubuntu to Arch and I wonder how I can start ...
2
votes
3answers
128 views

is there a way to indirectly uncharge rapidly a coin cell to defeat an anti tampering mechanism?

An anti tampering mechanism of a device relay on detect tampering mechanism when the device is powered down using the energy provided internally by a coin cell. Is there a way to uncharge rapidly a ...
4
votes
2answers
3k views

Protecting hidden form fields

The scenario is as follows: An application has a web interface through which data can be configured. The data to consider for this question is Users with a many-to-many relationship with Groups. Each ...
9
votes
1answer
295 views

Physical security - responsible disclosure

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...
0
votes
6answers
327 views

If I want to protect a string from modification, is it enough to salt and hash it?

There is a particular string (URL) that I need to send from my webserver to the browser. The browser will need to inspect the string and later send it back unmodified (aka request the resource that ...
9
votes
2answers
2k views

Is there any Linux distro or kernel patch that wipes a process memory space after the process exits?

An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, ...
9
votes
2answers
2k views

How does one evaluate tamper-resistant envelopes/packaging?

In contrast to digital cryptographic algorithms and protocols where many qualified high-IQ individuals dig into the details and specifics, physical tamper resistance for low-tech packages is not ...