165

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its configuration, but a firmware upgrade and factory reset is enough to take care of almost every change. The risk that the previous owner tampered with the router and his ...


148

No, you are just being paranoid. You were probably already connected to him over WiFi. There are many attacks he could have run this way without additional devices. Also if he would have wanted to hack you, he would not have thrown his strange hacking device in your face. He would have hidden it below the table. Side note: I feel like most of the people ...


120

Most probably he was using one of these wireless chargers that are built into the tables. It certainly fits your description.


117

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to dump the contents - often with the aid of liquid nitrogen. For more information, see the Wikipedia article for Cold Boot Attack.


95

It all boils down to which kinds of threats you want to migitate against - a determined attacker has many more options of leaving malware on your computer than just your hard drive, but it's getting increasingly complex to do so. If you're a rocket scientist working on the newest version of ICBMs you have more to fear than a college student who uses their ...


93

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


91

In 2011 the news was reporting on HP Printers catching fire. HP Responded saying that there was a hardware element called a "thermal breaker" to prevent this from happening. The researcher never produced a burning pile of printer. Also in 2011 Charlie Miller was researching the firmware on Apple's batteries trying to get them to explode or catch fire. ...


86

Summary: There's probably some BS marketing going on, but on the whole they probably are making the more privacy-respecting laptop they can. Other answers mention other brands of privacy-focused laptops that avoid Intel chips in favour of 100% libre hardware, but you take a big performance and cost hit for doing it, because, well, Intel is the market leader ...


73

Yes. If you do a normal format, the old data can be recovered. A normal format only deletes/overwrites a tiny bit of filesystem metadata, but does not overwrite all of the data itself. The data is still there. This is especially true on SSDs, due to wear levelling and other features of SSDs. The following research paper studies erasure of data on SSDs: ...


71

This 2013 article analyses retention time for several DRAM chips. Among the relevant information, one may list the following: Retention time depends on a lot of things, including the values of neighbouring bits. A DRAM bit is a potential well, and it loses its contents by moving charges from or into neighbouring areas, so whether there is room in these ...


67

You must do risk management. How likely it is that you and your laptop have been personally targeted? The vast majority of persistent malware operates entirely in software, and formatting the disk is more than enough to remove all traces of it. Sophisticated, firmware-resident malware is extremely rare and unlikely to be a threat unless you have particular ...


55

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and cryptography. Typically, the GPU is programmed using either CUDA or OpenCL. The reason they're good for brute-force attacks is that they're orders of magnitude faster than ...


44

Well "impossible" is impossible to prove which is why in the linked answer I said "almost impossible", maybe even that is overstating it. By using a secure hardware device the attack vector goes from "malware installed remotely on host steals secret," to "attacker needs to physically gain access to the hardware device and destructively remove the private ...


43

There is nothing stopping an attacker from putting a powerline ethernet transceiver as well as a USB-enabled microcontroller into a USB charger. This would allow them to communicate with the charger in the hope to offload some malware onto a smartphone plugged into that port. However, such a device would need to be highly specialized and specifically ...


42

Yes, if an attacker has physical access to your computer it is no longer your computer. While it's theoretically possible to implement spying directly in silicon on a modern CPU, a modern x86-based CPU is extremely complicated. An attacker would be better off using a peripheral device that uses something like USB which exposes certain interrupts in an easily-...


36

Special firms either degauss, destroy or melt the harddrives. Harddrives are magnetic data. Magnetism can be destroyed by either: Degaussing (changing the magnetism) Heating the drive (melting) (which destroys/changes the magnetism) Hammering (shock) (shock damages magnetism somewhat, but the denting of the drive makes it very difficult to read the surface,...


36

What isn't documented, is not documented. All we can do is infer. From the documentation, we see that the password must be re-entered in a number of conditions (drive unplugged, computer shut down, computer put to sleep...) which boil down to: the drive was not powered at some time. This hints at a security feature done on the drive itself, not in software ...


36

I don't know what that gizmo is, but unless you've got a really bizarre laptop, it wouldn't be useful for attacking your computer. Outside of a laboratory setting, attacking a computer means using its standard input or output capabilities. An ordinary wifi or Bluetooth antenna can reach your laptop from anywhere in the room; a directional antenna can ...


33

Trusted Platform Modules A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic keys used for encryption. Many laptop computers include a TPM, but if the system doesn’t include it, it is not feasible to add one. Once enabled, the Trusted Platform Module provides full disk encryption ...


33

Do you have reason to expect targeted attacks? It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons: That would raise the cost of the cable far above its price, and would be uneconomical even considering the ability to "monetize" a certain amount of random ...


32

There is an element of truth to this one - an attack was discovered which took advantage of data remanence in RAM, allowing an attacker to grab data from the RAM in a machine. There was a very short timeframe (a matter of seconds or minutes) in which to do this, but it wasn't a hack of the PC as such. Simple Wikipedia link to Cold Boot Attack here And the ...


30

Security issues with cables? No. It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply. However the cost of a device, especially one small enough to be hidden in a cable, would be quite a bit higher than the cable itself so you probably don't need to worry about this.


27

Yes, they can and it has been demonstrated before. Basically, the naive camera design uses a USB-capable microcontroller and drives the "camera on" LED with a GPIO pin. If you can figure out a way to rewrite the firmware of that microcontroller then you can do whatever you like. I was part of a team that designed high resolution webcams. Part of the design ...


26

It really depends upon the specific threats you may be facing, the direction of your data transfers, etc. USB specific dangers You mention the dangers of USB. The main one is indeed related to its firmware opening the possibility of a BadUSB type attack. When you need to transfer data in both directions, you may therefore prefer to use SD-Cards which are ...


25

It's taking me a few minutes to come up with something beyond, "That's patently damn absurd!" But... I guess like many things, nobody would write it if somebody didn't buy it. My first thought from the formatting and related image is that this was sensationalist crud from a few decades ago. After all, that machine has a 5 1/4" floppy... but they're talking ...


25

If you log in somewhere (say in a browser, or some application), the password you typed in is temporarily stored in RAM for comparison against the correct password. Most applications assume the RAM is secure and don't clear everything, so it could (and often does) happen that your RAM memory contains passwords and privacy-sensitive data. Now RAM is said to ...


25

Yes, binary blobs are a security risk, as any other proprietary software that you cannot audit. I wouldn't call all systems using proprietary software "compromised", but you can only trust such systems as much as you trust people selling them. Regarding that Purism thing, I wouldn't trust them more than I would any other laptop. Their FAQ states: Purism ...


24

If the chip is writable from within the OS, the malware can write to it too, so it wouldn't help there. Also, anti-malware software has to handle threats that are only a few hours old. Having to reboot your computer to upgrade the anti-malware software that's running on its own hardware would suck, so we need to be able to upgrade it from within the OS. If ...


23

As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker toolkit. It only affects a very narrow set of targets, which are already vulnerable to other attacks (and have been for years). Colin Percival actually described ...


Only top voted, non community-wiki answers of a minimum length are eligible