166

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its configuration, but a firmware upgrade and factory reset is enough to take care of almost every change. The risk that the previous owner tampered with the router and his ...


165

super duper encrypted with FIPS 140-2 Level 3, 256-bit AES-XTS Yet such a massive price difference. All because one is "encrypted"? Your question is a bit like comparing a Toyota and a Ferrari and asking "Why the massive price difference. All because one is "fast"? What is FIPS 140-2 Level 3? FIPS 140-2 Level 3 is more than just ...


147

No, you are just being paranoid. You were probably already connected to him over WiFi. There are many attacks he could have run this way without additional devices. Also if he would have wanted to hack you, he would not have thrown his strange hacking device in your face. He would have hidden it below the table. Side note: I feel like most of the people ...


120

Most probably he was using one of these wireless chargers that are built into the tables. It certainly fits your description.


116

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to dump the contents - often with the aid of liquid nitrogen. For more information, see the Wikipedia article for Cold Boot Attack.


95

It all boils down to which kinds of threats you want to migitate against - a determined attacker has many more options of leaving malware on your computer than just your hard drive, but it's getting increasingly complex to do so. If you're a rocket scientist working on the newest version of ICBMs you have more to fear than a college student who uses their ...


85

Summary: There's probably some BS marketing going on, but on the whole they probably are making the more privacy-respecting laptop they can. Other answers mention other brands of privacy-focused laptops that avoid Intel chips in favour of 100% libre hardware, but you take a big performance and cost hit for doing it, because, well, Intel is the market leader ...


71

This 2013 article analyses retention time for several DRAM chips. Among the relevant information, one may list the following: Retention time depends on a lot of things, including the values of neighbouring bits. A DRAM bit is a potential well, and it loses its contents by moving charges from or into neighbouring areas, so whether there is room in these ...


67

You must do risk management. How likely it is that you and your laptop have been personally targeted? The vast majority of persistent malware operates entirely in software, and formatting the disk is more than enough to remove all traces of it. Sophisticated, firmware-resident malware is extremely rare and unlikely to be a threat unless you have particular ...


63

Thermite. Thermite burns at a temperature of thousands of degrees centigrade, which would be more than sufficient to destroy all the data stored in any modern data storage medium. It is also already used by militaries for the targeted destruction of equipment. Additionally, according to Wikipedia: For example, thermite can be used for the emergency ...


56

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and cryptography. Typically, the GPU is programmed using either CUDA or OpenCL. The reason they're good for brute-force attacks is that they're orders of magnitude faster than ...


51

There are two DEFCON videos from 2012 and 2015 exploring this exact issue: DEFCON 19: And That's How I Lost My Eye: Exploring Emergency Data Destruction DEFCON 23: And That's How I Lost My Other Eye...Explorations in Data Destruction (Fixed) Summary of Viable Options Plasma Cutter Oxygen Injection (Difficult setup) Nailguns (depending on adversary) Damped ...


48

Well "impossible" is impossible to prove which is why in the linked answer I said "almost impossible", maybe even that is overstating it. By using a secure hardware device the attack vector goes from "malware installed remotely on host steals secret," to "attacker needs to physically gain access to the hardware device and destructively remove the private ...


48

There were also attacks based on the autoplay-feature (other source), although I think this is a bit outdated with newer OS like Windows 10. There are also USB-Killers which operate on a hardware-level and kill your machine through sending high current shocks. Here's a list of other attacks that might fall in the same category, including but not limited to:...


44

Yes, if an attacker has physical access to your computer it is no longer your computer. While it's theoretically possible to implement spying directly in silicon on a modern CPU, a modern x86-based CPU is extremely complicated. An attacker would be better off using a peripheral device that uses something like USB which exposes certain interrupts in an easily-...


44

If you trust encryption then you could encrypt your entire drive using Linux: LUKS (supported by all major distributions) Windows: BitLocker As soon as you physically switch off the device, all the information turns into random noise which no one will be able to recover unless he/she has the decryption key. However, this method has a major shortcoming: ...


43

There is nothing stopping an attacker from putting a powerline ethernet transceiver as well as a USB-enabled microcontroller into a USB charger. This would allow them to communicate with the charger in the hope to offload some malware onto a smartphone plugged into that port. However, such a device would need to be highly specialized and specifically ...


40

The short answer is, you can't. The longer answer: there are a few things that can be done to increase your trust in hardware, though they also just shift the root of trust elsewhere. A first interesting question you pose is the software/hardware distinction. To not go into the discussion about the possibly blurred boundary between the two here, I'll ...


37

What isn't documented, is not documented. All we can do is infer. From the documentation, we see that the password must be re-entered in a number of conditions (drive unplugged, computer shut down, computer put to sleep...) which boil down to: the drive was not powered at some time. This hints at a security feature done on the drive itself, not in software ...


36

Special firms either degauss, destroy or melt the harddrives. Harddrives are magnetic data. Magnetism can be destroyed by either: Degaussing (changing the magnetism) Heating the drive (melting) (which destroys/changes the magnetism) Hammering (shock) (shock damages magnetism somewhat, but the denting of the drive makes it very difficult to read the surface,...


36

Besides all previous good answers, there's another one that nobody mentioned: USB-based Ethernet devices. Like the excelent PoisonTap. One can make the device register as a Ethernet device, and change the default route for the IP of the device. This way, every cleartext request and every DNS request will be sent to it, and a request for important domains (...


35

I don't know what that gizmo is, but unless you've got a really bizarre laptop, it wouldn't be useful for attacking your computer. Outside of a laboratory setting, attacking a computer means using its standard input or output capabilities. An ordinary wifi or Bluetooth antenna can reach your laptop from anywhere in the room; a directional antenna can ...


33

Trusted Platform Modules A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic keys used for encryption. Many laptop computers include a TPM, but if the system doesn’t include it, it is not feasible to add one. Once enabled, the Trusted Platform Module provides full disk encryption ...


33

Do you have reason to expect targeted attacks? It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons: That would raise the cost of the cable far above its price, and would be uneconomical even considering the ability to "monetize" a certain amount of random ...


30

Security issues with cables? No. It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply. However the cost of a device, especially one small enough to be hidden in a cable, would be quite a bit higher than the cable itself so you probably don't need to worry about this.


28

Yes, they can and it has been demonstrated before. Basically, the naive camera design uses a USB-capable microcontroller and drives the "camera on" LED with a GPIO pin. If you can figure out a way to rewrite the firmware of that microcontroller then you can do whatever you like. I was part of a team that designed high resolution webcams. Part of the design ...


28

A RAM disk RAM is cool in that it is volatile memory. This essentially means that once power is cut, all data is lost completely and can never be recovered - essentially, this irreversibly and reliably wipes all the information instantly and does so in a way that cannot be stopped. Not only is this data irrecoverable, but this method does not include any ...


28

No, you can't tell by looking at it. There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The other is that your research clearly has an observation bias (presumably, because you're finding the things that are easier to find on the web). Originally, ...


28

I've contributed to the development of a crypto-related device that was certified to FIPS standards. It's an extensive, expensive certification process that's really only relevant to specific use cases. FIPS isn't about having the best encryption, it's about having a crypto engine that was independently tested and verified against a known list of security ...


Only top voted, non community-wiki answers of a minimum length are eligible