Skip to main content
168 votes
Accepted

Buying a "Used" Router

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its ...
ThoriumBR's user avatar
  • 54.6k
167 votes

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

super duper encrypted with FIPS 140-2 Level 3, 256-bit AES-XTS Yet such a massive price difference. All because one is "encrypted"? Your question is a bit like comparing a Toyota and a ...
Mike Ounsworth's user avatar
117 votes

How is 'Removing RAM' a security risk?

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to ...
Peleus's user avatar
  • 3,907
93 votes
Accepted

What are the risks of buying a used/refurbished computer? How can I mitigate those risks?

It all boils down to which kinds of threats you want to migitate against - a determined attacker has many more options of leaving malware on your computer than just your hard drive, but it's getting ...
Guntram Blohm's user avatar
85 votes

Closed source binary blobs in chipsets - privacy threat?

Summary: There's probably some BS marketing going on, but on the whole they probably are making the more privacy-respecting laptop they can. Other answers mention other brands of privacy-focused ...
Mike Ounsworth's user avatar
66 votes

Should one buy new hardware after a system compromise?

You must do risk management. How likely it is that you and your laptop have been personally targeted? The vast majority of persistent malware operates entirely in software, and formatting the disk is ...
forest's user avatar
  • 67k
62 votes

Emergency method to erase all data off a machine within seconds

Thermite. Thermite burns at a temperature of thousands of degrees centigrade, which would be more than sufficient to destroy all the data stored in any modern data storage medium. It is also already ...
nick012000's user avatar
54 votes
Accepted

Emergency method to erase all data off a machine within seconds

There are two DEFCON videos from 2012 and 2015 exploring this exact issue: DEFCON 19: And That's How I Lost My Eye: Exploring Emergency Data Destruction DEFCON 23: And That's How I Lost My Other Eye.....
Slava Knyazev's user avatar
48 votes

Are all USB-based attacks dependent on being able to inject keystrokes?

There were also attacks based on the autoplay-feature (other source), although I think this is a bit outdated with newer OS like Windows 10. There are also USB-Killers which operate on a hardware-...
Lexu's user avatar
  • 956
44 votes

Emergency method to erase all data off a machine within seconds

If you trust encryption then you could encrypt your entire drive using Linux: LUKS (supported by all major distributions) Windows: BitLocker As soon as you physically switch off the device, all the ...
Artem S. Tashkinov's user avatar
40 votes
Accepted

How can you trust that there is no backdoor in your hardware?

The short answer is, you can't. The longer answer: there are a few things that can be done to increase your trust in hardware, though they also just shift the root of trust elsewhere. A first ...
plonk's user avatar
  • 643
37 votes

What are the differences between TPM and HSM?

Sorry, but I think there are some gaps in this conversation: TPMs can't be added later : False. Many modern motherboards include a header to which a TPM can be added after the fact. Visit Amazon ...
Paul Vilevac's user avatar
36 votes
Accepted

Are all USB-based attacks dependent on being able to inject keystrokes?

Besides all previous good answers, there's another one that nobody mentioned: USB-based Ethernet devices. Like the excelent PoisonTap. One can make the device register as a Ethernet device, and ...
ThoriumBR's user avatar
  • 54.6k
33 votes
Accepted

Is it safe to use cheap USB data cables?

Do you have reason to expect targeted attacks? It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons: ...
Peteris's user avatar
  • 8,429
30 votes

Is it safe to use cheap USB data cables?

Security issues with cables? No. It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply. However the cost of a device, especially ...
700 Software's user avatar
29 votes

Can BadUSB be avoided by looking at the shapes and the controller model inside it?

No, you can't tell by looking at it. There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The ...
Gilles 'SO- stop being evil''s user avatar
29 votes

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

I've contributed to the development of a crypto-related device that was certified to FIPS standards. It's an extensive, expensive certification process that's really only relevant to specific use ...
bta's user avatar
  • 1,131
29 votes
Accepted

Is a responsible disclosure for hardware-based vulnerabilities even possible?

The idea of a responsible disclosure is to protect the customers both in the short term and the long term. What this exactly means in terms of disclosure timelines and details depends on how severe ...
Steffen Ullrich's user avatar
28 votes
Accepted

How can a hacker disable the LED attached to a webcam without critically damaging the hardware?

Yes, they can and it has been demonstrated before. Basically, the naive camera design uses a USB-capable microcontroller and drives the "camera on" LED with a GPIO pin. If you can figure out a way to ...
akohlsmith's user avatar
28 votes

Emergency method to erase all data off a machine within seconds

A RAM disk RAM is cool in that it is volatile memory. This essentially means that once power is cut, all data is lost completely and can never be recovered - essentially, this irreversibly and ...
Daniel H.'s user avatar
  • 381
28 votes

Choosing laptop brand for company

For a normal company, you're not really in a position to identify or deal with hardware or firmware level compromises of any laptops you buy - so you mostly have to base your decision on the ...
Gh0stFish's user avatar
  • 13k
26 votes

Closed source binary blobs in chipsets - privacy threat?

Yes, binary blobs are a security risk, as any other proprietary software that you cannot audit. I wouldn't call all systems using proprietary software "compromised", but you can only trust such ...
Dmitry Grigoryev's user avatar
26 votes

Need to leave computer in repair shop. How can I secure solid state drive contents?

Swapping the SSDs for blank (or at least empty of anything-you-care-about) ones would work, though of course then you'd have to swap them back afterward and that has some potential to mess up the ...
CBHacking's user avatar
  • 49.5k
25 votes

How is 'Removing RAM' a security risk?

If you log in somewhere (say in a browser, or some application), the password you typed in is temporarily stored in RAM for comparison against the correct password. Most applications assume the RAM is ...
Luc's user avatar
  • 33k
23 votes
Accepted

New CVE-2018-5407 "PortSmash vulnerablity" in Intel CPU

As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker ...
Johnny's user avatar
  • 1,061
23 votes

Buying a "Used" Router

The main risk is that the firmware has been replaced by a malicious version, which could make it possible to intercept all the traffic on your network. Passwords, injecting malware, redirecting you to ...
schroeder's user avatar
  • 131k
22 votes

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

I think it's a case of paying not for the hardware but for the certification. IronKey devices are actually certified (https://www.ironkey.com/en-US/website/certification-and-compliance.html), and FIPS ...
Bruno Rohée's user avatar
  • 5,507
20 votes
Accepted

How to generate a unique and uncopyable VPN certificate/key for a specific client hardware device?

You can generate a virtual smart card on a Trusted Platform Module (TPM). A TPM is like a Hardware Security Module (HSM), except that a TPM is physically attached to a computer's motherboard and thus ...
vrtjason's user avatar
  • 1,125
20 votes

Are all USB-based attacks dependent on being able to inject keystrokes?

Infamously, Stuxnet exploited a feature of Windows that automatically installs USB drivers on a USB stick when inserted as long as the drivers have appropriate digital signatures. The Stuxnet virus ...
Robin Davies's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible