168 votes
Accepted

Buying a "Used" Router

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its ...
user avatar
  • 50.5k
166 votes

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

super duper encrypted with FIPS 140-2 Level 3, 256-bit AES-XTS Yet such a massive price difference. All because one is "encrypted"? Your question is a bit like comparing a Toyota and a ...
user avatar
147 votes

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

No, you are just being paranoid. You were probably already connected to him over WiFi. There are many attacks he could have run this way without additional devices. Also if he would have wanted to ...
user avatar
  • 5,404
119 votes

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

Most probably he was using one of these wireless chargers that are built into the tables. It certainly fits your description.
user avatar
  • 1,181
117 votes

How is 'Removing RAM' a security risk?

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to ...
user avatar
  • 3,807
95 votes
Accepted

What are the risks of buying a used/refurbished computer? How can I mitigate those risks?

It all boils down to which kinds of threats you want to migitate against - a determined attacker has many more options of leaving malware on your computer than just your hard drive, but it's getting ...
user avatar
85 votes

Closed source binary blobs in chipsets - privacy threat?

Summary: There's probably some BS marketing going on, but on the whole they probably are making the more privacy-respecting laptop they can. Other answers mention other brands of privacy-focused ...
user avatar
75 votes
Accepted

Can RAM retain data after removal?

This 2013 article analyses retention time for several DRAM chips. Among the relevant information, one may list the following: Retention time depends on a lot of things, including the values of ...
user avatar
  • 168k
67 votes

Should one buy new hardware after a system compromise?

You must do risk management. How likely it is that you and your laptop have been personally targeted? The vast majority of persistent malware operates entirely in software, and formatting the disk is ...
user avatar
  • 64k
63 votes

Emergency method to erase all data off a machine within seconds

Thermite. Thermite burns at a temperature of thousands of degrees centigrade, which would be more than sufficient to destroy all the data stored in any modern data storage medium. It is also already ...
user avatar
56 votes
Accepted

How are GPUs used in brute force attacks?

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
user avatar
  • 1,122
52 votes
Accepted

Emergency method to erase all data off a machine within seconds

There are two DEFCON videos from 2012 and 2015 exploring this exact issue: DEFCON 19: And That's How I Lost My Eye: Exploring Emergency Data Destruction DEFCON 23: And That's How I Lost My Other Eye.....
user avatar
48 votes
Accepted

How can it be easy to write but "impossible" to extract the private key from a crypto token?

Well "impossible" is impossible to prove which is why in the linked answer I said "almost impossible", maybe even that is overstating it. By using a secure hardware device the attack vector goes from ...
user avatar
  • 2,240
48 votes

Are all USB-based attacks dependent on being able to inject keystrokes?

There were also attacks based on the autoplay-feature (other source), although I think this is a bit outdated with newer OS like Windows 10. There are also USB-Killers which operate on a hardware-...
user avatar
  • 936
44 votes

Is it possible to secretly monitor/backdoor hardware?

Yes, if an attacker has physical access to your computer it is no longer your computer. While it's theoretically possible to implement spying directly in silicon on a modern CPU, a modern x86-based ...
user avatar
44 votes

Emergency method to erase all data off a machine within seconds

If you trust encryption then you could encrypt your entire drive using Linux: LUKS (supported by all major distributions) Windows: BitLocker As soon as you physically switch off the device, all the ...
user avatar
43 votes
Accepted

Can malware be transmitted via a USB charger plugged into a wall socket?

There is nothing stopping an attacker from putting a powerline ethernet transceiver as well as a USB-enabled microcontroller into a USB charger. This would allow them to communicate with the charger ...
user avatar
41 votes
Accepted

How can you trust that there is no backdoor in your hardware?

The short answer is, you can't. The longer answer: there are a few things that can be done to increase your trust in hardware, though they also just shift the root of trust elsewhere. A first ...
user avatar
  • 643
37 votes
Accepted

What are the differences between TPM and HSM?

Trusted Platform Modules A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic keys used for encryption. Many laptop computers include a TPM,...
user avatar
  • 1,040
36 votes
Accepted

Are all USB-based attacks dependent on being able to inject keystrokes?

Besides all previous good answers, there's another one that nobody mentioned: USB-based Ethernet devices. Like the excelent PoisonTap. One can make the device register as a Ethernet device, and ...
user avatar
  • 50.5k
35 votes

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

I don't know what that gizmo is, but unless you've got a really bizarre laptop, it wouldn't be useful for attacking your computer. Outside of a laboratory setting, attacking a computer means using ...
user avatar
  • 34.4k
33 votes
Accepted

Is it safe to use cheap USB data cables?

Do you have reason to expect targeted attacks? It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons: ...
user avatar
  • 8,390
30 votes

Is it safe to use cheap USB data cables?

Security issues with cables? No. It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply. However the cost of a device, especially ...
user avatar
  • 13.8k
29 votes

What are the differences between TPM and HSM?

Sorry, but I think there are some gaps in this conversation: TPMs can't be added later : False. Many modern motherboards include a header to which a TPM can be added after the fact. Visit Amazon ...
user avatar
29 votes

Can BadUSB be avoided by looking at the shapes and the controller model inside it?

No, you can't tell by looking at it. There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The ...
user avatar
28 votes
Accepted

How can a hacker disable the LED attached to a webcam without critically damaging the hardware?

Yes, they can and it has been demonstrated before. Basically, the naive camera design uses a USB-capable microcontroller and drives the "camera on" LED with a GPIO pin. If you can figure out a way to ...
user avatar
28 votes

Emergency method to erase all data off a machine within seconds

A RAM disk RAM is cool in that it is volatile memory. This essentially means that once power is cut, all data is lost completely and can never be recovered - essentially, this irreversibly and ...
user avatar
  • 381
28 votes

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

I've contributed to the development of a crypto-related device that was certified to FIPS standards. It's an extensive, expensive certification process that's really only relevant to specific use ...
user avatar
  • 1,041
26 votes
Accepted

Is there a secure way to transfer data outside the Internet?

It really depends upon the specific threats you may be facing, the direction of your data transfers, etc. USB specific dangers You mention the dangers of USB. The main one is indeed related to its ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible