Hot answers tagged

46 votes
Accepted

Does rebooting a phone daily increase your phone's security?

Rebooting a phone regularly helps cleaning non-persistent malware, i.e., malware that only exist in memory – and non-persistent malware alone, as explained in Paul Ducklin's Sophos blog article on the ...
Esa Jokinen's user avatar
  • 18.9k
11 votes
Accepted

Write-protection at hardware level for security

Quis custodiet ipsos custodes? Before I begin, I'd like to explain a bit about the term trust as it is used in an information security context. In infosec, trust often has the opposite meaning of what ...
forest's user avatar
  • 66.6k
9 votes

What's stopping someone from copying my HDD/SSD?

Physical access is usually a huge security issue, depending also on your threat model or, in other words, what the attacker is willing to do with your machine. Full disk encryption is a great security ...
reed's user avatar
  • 15.8k
5 votes

How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?

The Intel TXT is a complex system designed to provide a hardware layer of security that can prevent software layer changes from resulting in increased access for attackers. Through use of stored ...
Connor Peoples's user avatar
5 votes
Accepted

Is Secure Boot really Secure?

systemd-boot has to be signed as well. The original signed gummiboot respects the 'secure' boot process and requires that the binaries it is to launch are signed as well: https://www.rodsbooks.com/efi-...
Therac's user avatar
  • 2,650
5 votes
Accepted

Why are pins required on boot on devices with fingerprint readers?

The PIN is used to derive an encryption key, whereas the fingerprint is used only for authentication. Because the encryption key is kept in memory during runtime, it is lost after a reboot and needs ...
forest's user avatar
  • 66.6k
4 votes
Accepted

Boot-sector virus - can it spread only through floppy disks?

No. Viruses can infect any commonly used bootable media. The spread of this type of viruses became thwarted (in addition to better protection mechanisms) because of a change in media usage patterns. ...
techraf's user avatar
  • 9,159
4 votes

What are the biggest security concerns on PXE?

There are some specific vulnerabilities associated with PXE boot images. Unauthenticated Images. If someone gets onto your network, it's trivial to boot a PXE image from VirtualBox or VMWare. Which ...
Ohnana's user avatar
  • 4,717
4 votes
Accepted

Will converting a MBR disk to GPT, formatting and the converting back to MBR remove a infected boot record.

No, not unless the infection exclusively resides on the MBR. It can easily exist on the bootloader or any other stage in the boot process. Also note that GPT has two backup MBRs on it, though they are ...
forest's user avatar
  • 66.6k
4 votes
Accepted

Can dual-boot, encrypted Windows 7 installations be fairly well secured against each other?

It depends on your threat model. There is one problem I can see: disk encryption does not guarantee integrity. That means the other operating system installation could change the data on the first one....
Peter Harmann's user avatar
4 votes
Accepted

Can a Windows program compromise the desktop hardware without giving administrator rights?

If I run a program on a Windows 10 machine, can the program install a virus on an attached USB drive Yes. You don't need admin access to write to a USB drive. can it install a virus into the ...
Hector's user avatar
  • 11k
4 votes

What's stopping someone from copying my HDD/SSD?

Time. Yes, someone could clone your entire hard drive, but this usually takes a long time. An attacker would have to open your computer's case, remove the drive, plug it into a dock, clone its ...
rosuav's user avatar
  • 239
4 votes
Accepted

Understanding FDE: Is the encrypted Linux protected against a compromised boot volume?

Full-disk encryption protects against theft. That is, it protects against a scenario where an attacker gains access to the device, and the owner loses access to the device at that point. Full-disk ...
Gilles 'SO- stop being evil''s user avatar
3 votes
Accepted

VeraCrypt - Windows boots Automated Repair on UEFI/GPT

OK, I came up with a solution and it works even after I switch off the computer. In BOOTICE I modified the Windows Boot Manager to load "\EFI\VERACRYPT\DCSBOOT.EFI" (the VeraCrypt loader) instead of ...
daerragh's user avatar
3 votes
Accepted

Could a computer turn itself on if the BIOS was modified even if it was turned off by holding the power button down?

Hard power-off of a Windows machine will ensure that wake-on-lan isn't functional, but there are two possible combinations of bios settings that can lead to machine waking up without power button ...
Grigory Sergeev's user avatar
3 votes

How is hibernation supported, on machines with UEFI Secure Boot?

Vulnerable But Addressable As user2213 indicated, hibernation file attacks are not prevented by anything in the UEFI Secure Boot specification. The solution is to use full-disk encryption on the ...
DoubleD's user avatar
  • 3,942
3 votes

How do boot-sector viruses propagate?

Well actually Removable media is a subset of physical media. Its the old "a cube is always a beam, but a beam is not always a cube." thing. Boot sector viruses have been know to be spread through: ...
LvB's user avatar
  • 8,943
3 votes
Accepted

tpm sealing and secure boot

Quite a few specific questions here, I'll break it down What is stopping an attacker from disabling the TPM until after boot? Nothing if the attacker controls both the FW (UEFI, BIOS, etc) and the ...
Wilbur Whateley's user avatar
3 votes

What's the point of encrypting /boot or / partition?

It prevents accidental leaks of private data that is copied around. For example, if /tmp is on the / partition, files from your encrypted /home partition could be copied to the unencrypted /tmp, ...
Simon Richter's user avatar
3 votes

Android verified boot within the boot sequence

AVB is enforced by the bootloader and dm-verity is enforced by the kernel. Both run consecutively in android boot flow. In factory: OEM constructs hashtree of /system, /vendor, product and ODM ...
defalt's user avatar
  • 6,841
3 votes
Accepted

System encryption on a uefi system?

The key here is privacy vs integrity. If your data volume (/home, /var/log and anything else with sensitive data) is encrypted then you're primarily just assuring privacy, whereas for /boot you want ...
Liam Dennehy's user avatar
3 votes

Would it add security to set a GRUB password if HDDs are encrypted and UEFI settings can be opened anyway?

Adding grub password is needed to protect the boot sequence, but protecting the boot sequence only makes sense if you protect the entire boot sequence, in other words if you enable grub password, you ...
Lie Ryan's user avatar
  • 31.4k
3 votes

Is Secure Boot really Secure?

I think the theory is that each level only signs an instance of the next level if it implements signature checks correctly. In other words systemd-boot is supposed to do signature checks, and only ...
Douglas Leeder's user avatar
3 votes
Accepted

Understanding Secure Boot

However, what ensures that CPU really starts booting the system from the correct ROM? Usually ROM are sorted onto motherboard. Since information once written to ROM can not be electronically altered, ...
Arpit Rohela's user avatar
3 votes

What's stopping someone from copying my HDD/SSD?

Yes, it is possible to clone drives using some external connector (SSD/HDD usb connectors/Tableau Hardware) and software (osf/winhex). Cloning can be done in both states. It takes 30 - 40 min depends ...
Test's user avatar
  • 31
3 votes

What's stopping someone from copying my HDD/SSD?

Physical Security An often overlooked part of Information Security. Lock the PC down by disabling external ports (USB, Serial, etc), and physically secure the PC so they cant take it or open it. ...
us_system_integrator's user avatar
2 votes

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Much of the computer security enhancements are there to make it difficult for general attackers to gain access to computers while still allowing western governments to crack in to them easily. So a ...
Alex Cannon's user avatar
2 votes

Best way to make a Linux install tamper proof

It is probably not possible to make this system tamper proof, at most you can make at some level of tamper resistant. Full disk encryption is a good way and maybe even the best you could achieve with ...
Steffen Ullrich's user avatar
2 votes
Accepted

Is a computer more vulnerable if wireless is left on when booting?

You do not need to be concerned by this. Windows 8 in particular introduced many new security features and technologies which take direct aim at early boot malware. You can read about these in some ...
niemiro's user avatar
  • 162

Only top scored, non community-wiki answers of a minimum length are eligible