168 votes
Accepted

Buying a "Used" Router

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its ...
ThoriumBR's user avatar
  • 53.9k
166 votes

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

super duper encrypted with FIPS 140-2 Level 3, 256-bit AES-XTS Yet such a massive price difference. All because one is "encrypted"? Your question is a bit like comparing a Toyota and a ...
Mike Ounsworth's user avatar
117 votes

How is 'Removing RAM' a security risk?

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to ...
Peleus's user avatar
  • 3,877
95 votes
Accepted

What are the risks of buying a used/refurbished computer? How can I mitigate those risks?

It all boils down to which kinds of threats you want to migitate against - a determined attacker has many more options of leaving malware on your computer than just your hard drive, but it's getting ...
Guntram Blohm's user avatar
85 votes

Closed source binary blobs in chipsets - privacy threat?

Summary: There's probably some BS marketing going on, but on the whole they probably are making the more privacy-respecting laptop they can. Other answers mention other brands of privacy-focused ...
Mike Ounsworth's user avatar
66 votes

Should one buy new hardware after a system compromise?

You must do risk management. How likely it is that you and your laptop have been personally targeted? The vast majority of persistent malware operates entirely in software, and formatting the disk is ...
forest's user avatar
  • 66.6k
63 votes

Emergency method to erase all data off a machine within seconds

Thermite. Thermite burns at a temperature of thousands of degrees centigrade, which would be more than sufficient to destroy all the data stored in any modern data storage medium. It is also already ...
nick012000's user avatar
56 votes
Accepted

How are GPUs used in brute force attacks?

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
Phil Lello's user avatar
  • 1,122
54 votes
Accepted

Emergency method to erase all data off a machine within seconds

There are two DEFCON videos from 2012 and 2015 exploring this exact issue: DEFCON 19: And That's How I Lost My Eye: Exploring Emergency Data Destruction DEFCON 23: And That's How I Lost My Other Eye.....
Slava Knyazev's user avatar
48 votes

Are all USB-based attacks dependent on being able to inject keystrokes?

There were also attacks based on the autoplay-feature (other source), although I think this is a bit outdated with newer OS like Windows 10. There are also USB-Killers which operate on a hardware-...
Lexu's user avatar
  • 956
44 votes

Is it possible to secretly monitor/backdoor hardware?

Yes, if an attacker has physical access to your computer it is no longer your computer. While it's theoretically possible to implement spying directly in silicon on a modern CPU, a modern x86-based ...
David Freitag's user avatar
44 votes

Emergency method to erase all data off a machine within seconds

If you trust encryption then you could encrypt your entire drive using Linux: LUKS (supported by all major distributions) Windows: BitLocker As soon as you physically switch off the device, all the ...
Artem S. Tashkinov's user avatar
40 votes
Accepted

How can you trust that there is no backdoor in your hardware?

The short answer is, you can't. The longer answer: there are a few things that can be done to increase your trust in hardware, though they also just shift the root of trust elsewhere. A first ...
plonk's user avatar
  • 643
37 votes

What are the differences between TPM and HSM?

Sorry, but I think there are some gaps in this conversation: TPMs can't be added later : False. Many modern motherboards include a header to which a TPM can be added after the fact. Visit Amazon ...
Paul Vilevac's user avatar
36 votes
Accepted

Are all USB-based attacks dependent on being able to inject keystrokes?

Besides all previous good answers, there's another one that nobody mentioned: USB-based Ethernet devices. Like the excelent PoisonTap. One can make the device register as a Ethernet device, and ...
ThoriumBR's user avatar
  • 53.9k
33 votes
Accepted

Is it safe to use cheap USB data cables?

Do you have reason to expect targeted attacks? It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons: ...
Peteris's user avatar
  • 8,419
30 votes

Is it safe to use cheap USB data cables?

Security issues with cables? No. It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply. However the cost of a device, especially ...
700 Software's user avatar
29 votes

Can BadUSB be avoided by looking at the shapes and the controller model inside it?

No, you can't tell by looking at it. There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The ...
Gilles 'SO- stop being evil''s user avatar
28 votes
Accepted

How can a hacker disable the LED attached to a webcam without critically damaging the hardware?

Yes, they can and it has been demonstrated before. Basically, the naive camera design uses a USB-capable microcontroller and drives the "camera on" LED with a GPIO pin. If you can figure out a way to ...
akohlsmith's user avatar
28 votes

Emergency method to erase all data off a machine within seconds

A RAM disk RAM is cool in that it is volatile memory. This essentially means that once power is cut, all data is lost completely and can never be recovered - essentially, this irreversibly and ...
Daniel H.'s user avatar
  • 381
28 votes

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

I've contributed to the development of a crypto-related device that was certified to FIPS standards. It's an extensive, expensive certification process that's really only relevant to specific use ...
bta's user avatar
  • 1,121
28 votes
Accepted

Is a responsible disclosure for hardware-based vulnerabilities even possible?

The idea of a responsible disclosure is to protect the customers both in the short term and the long term. What this exactly means in terms of disclosure timelines and details depends on how severe ...
Steffen Ullrich's user avatar
26 votes
Accepted

Is there a secure way to transfer data outside the Internet?

It really depends upon the specific threats you may be facing, the direction of your data transfers, etc. USB specific dangers You mention the dangers of USB. The main one is indeed related to its ...
WhiteWinterWolf's user avatar
26 votes

Closed source binary blobs in chipsets - privacy threat?

Yes, binary blobs are a security risk, as any other proprietary software that you cannot audit. I wouldn't call all systems using proprietary software "compromised", but you can only trust such ...
Dmitry Grigoryev's user avatar
25 votes

How is 'Removing RAM' a security risk?

If you log in somewhere (say in a browser, or some application), the password you typed in is temporarily stored in RAM for comparison against the correct password. Most applications assume the RAM is ...
Luc's user avatar
  • 32.9k
25 votes

Need to leave computer in repair shop. How can I secure solid state drive contents?

Swapping the SSDs for blank (or at least empty of anything-you-care-about) ones would work, though of course then you'd have to swap them back afterward and that has some potential to mess up the ...
CBHacking's user avatar
  • 47.6k
24 votes

Buying a "Used" Router

The main risk is that the firmware has been replaced by a malicious version, which could make it possible to intercept all the traffic on your network. Passwords, injecting malware, redirecting you to ...
schroeder's user avatar
  • 129k
23 votes

Is it possible to secretly monitor/backdoor hardware?

Of course, the hardware/firmware also plays as role in keeping/compromising your security. The point is at the end of day, firmware also runs programs, and some controllers even provide full computing ...
Rui F Ribeiro's user avatar
23 votes
Accepted

New CVE-2018-5407 "PortSmash vulnerablity" in Intel CPU

As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker ...
Johnny's user avatar
  • 1,061

Only top scored, non community-wiki answers of a minimum length are eligible