168
votes
Accepted
Buying a "Used" Router
Short answer: do a factory reset, update the firmware, and you are good to go.
The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its ...
- 55.1k
167
votes
What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?
super duper encrypted with FIPS 140-2 Level 3, 256-bit AES-XTS
Yet such a massive price difference. All because one is "encrypted"?
Your question is a bit like comparing a Toyota and a ...
- 59.2k
93
votes
Accepted
What are the risks of buying a used/refurbished computer? How can I mitigate those risks?
It all boils down to which kinds of threats you want to migitate against - a determined attacker has many more options of leaving malware on your computer than just your hard drive, but it's getting ...
- 1,977
66
votes
Should one buy new hardware after a system compromise?
You must do risk management. How likely it is that you and your laptop have been personally targeted? The vast majority of persistent malware operates entirely in software, and formatting the disk is ...
- 67.1k
62
votes
Emergency method to erase all data off a machine within seconds
Thermite.
Thermite burns at a temperature of thousands of degrees centigrade, which would be more than sufficient to destroy all the data stored in any modern data storage medium. It is also already ...
- 591
54
votes
Accepted
Emergency method to erase all data off a machine within seconds
There are two DEFCON videos from 2012 and 2015 exploring this exact issue:
DEFCON 19: And That's How I Lost My Eye: Exploring Emergency Data Destruction
DEFCON 23: And That's How I Lost My Other Eye.....
- 736
48
votes
Are all USB-based attacks dependent on being able to inject keystrokes?
There were also attacks based on the autoplay-feature (other source), although I think this is a bit outdated with newer OS like Windows 10. There are also USB-Killers which operate on a hardware-...
- 956
45
votes
Emergency method to erase all data off a machine within seconds
If you trust encryption then you could encrypt your entire drive using
Linux: LUKS (supported by all major distributions)
Windows: BitLocker
As soon as you physically switch off the device, all the ...
- 3,445
40
votes
Accepted
How can you trust that there is no backdoor in your hardware?
The short answer is, you can't. The longer answer: there are a few things that can be done to increase your trust in hardware, though they also just shift the root of trust elsewhere.
A first ...
- 643
37
votes
What are the differences between TPM and HSM?
Sorry, but I think there are some gaps in this conversation:
TPMs can't be added later : False. Many modern motherboards include a header to which a TPM can be added after the fact. Visit Amazon ...
- 471
36
votes
Accepted
Are all USB-based attacks dependent on being able to inject keystrokes?
Besides all previous good answers, there's another one that nobody mentioned: USB-based Ethernet devices. Like the excelent PoisonTap.
One can make the device register as a Ethernet device, and ...
- 55.1k
33
votes
Accepted
Is it safe to use cheap USB data cables?
Do you have reason to expect targeted attacks?
It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons:
...
- 8,439
30
votes
Is it safe to use cheap USB data cables?
Security issues with cables? No.
It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply.
However the cost of a device, especially ...
- 14k
29
votes
Can BadUSB be avoided by looking at the shapes and the controller model inside it?
No, you can't tell by looking at it.
There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The ...
29
votes
What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?
I've contributed to the development of a crypto-related device that was certified to FIPS standards. It's an extensive, expensive certification process that's really only relevant to specific use ...
- 1,131
29
votes
Accepted
Is a responsible disclosure for hardware-based vulnerabilities even possible?
The idea of a responsible disclosure is to protect the customers both in the short term and the long term. What this exactly means in terms of disclosure timelines and details depends on how severe ...
- 206k
28
votes
Accepted
How can a hacker disable the LED attached to a webcam without critically damaging the hardware?
Yes, they can and it has been demonstrated before.
Basically, the naive camera design uses a USB-capable microcontroller and drives the "camera on" LED with a GPIO pin. If you can figure out a way to ...
- 386
28
votes
Emergency method to erase all data off a machine within seconds
A RAM disk
RAM is cool in that it is volatile memory. This essentially means that once power is cut, all data is lost completely and can never be recovered - essentially, this irreversibly and ...
- 381
28
votes
Choosing laptop brand for company
For a normal company, you're not really in a position to identify or deal with hardware or firmware level compromises of any laptops you buy - so you mostly have to base your decision on the ...
- 14.6k
26
votes
Need to leave computer in repair shop. How can I secure solid state drive contents?
Swapping the SSDs for blank (or at least empty of anything-you-care-about) ones would work, though of course then you'd have to swap them back afterward and that has some potential to mess up the ...
- 50.3k
23
votes
Accepted
New CVE-2018-5407 "PortSmash vulnerablity" in Intel CPU
As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker ...
- 1,061
23
votes
Buying a "Used" Router
The main risk is that the firmware has been replaced by a malicious version, which could make it possible to intercept all the traffic on your network. Passwords, injecting malware, redirecting you to ...
- 132k
22
votes
What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?
I think it's a case of paying not for the hardware but for the certification. IronKey devices are actually certified (https://www.ironkey.com/en-US/website/certification-and-compliance.html), and FIPS ...
- 5,507
20
votes
Accepted
How to generate a unique and uncopyable VPN certificate/key for a specific client hardware device?
You can generate a virtual smart card on a Trusted Platform Module (TPM). A TPM is like a Hardware Security Module (HSM), except that a TPM is physically attached to a computer's motherboard and thus ...
- 1,145
20
votes
Are all USB-based attacks dependent on being able to inject keystrokes?
Infamously, Stuxnet exploited a feature of Windows that automatically installs USB drivers on a USB stick when inserted as long as the drivers have appropriate digital signatures. The Stuxnet virus ...
- 301
19
votes
Emergency method to erase all data off a machine within seconds
Hard Drive with glass platters
HDD’s with glass platters are common. All you need to do is make sure that your data is stored on one of them, and, in an emergency, chuck it at the ground really hard. ...
- 441
18
votes
Buying a "Used" Router
By far, your main risk in buying an "open box" router is that the router has some subtle damage that the manufacturer didn't detect but that will ultimately reduce the lifespan of the device. That's ...
- 1,131
18
votes
Are all USB-based attacks dependent on being able to inject keystrokes?
In some cases, acting as a mass storage device will enable a lot of havoc.
Any operating system that will autoplay anything (no longer implemented for good reason these days) is vulnerable - this ...
- 975
16
votes
Accepted
Surveillance: blocking laptop's microphone from spying on you?
This issue affect both laptops, tablets and cellphones with similar solutions, so even if only laptops were explicitly mentioned in the OP's question (with still a link to an article focusing on ...
- 19.3k
Only top scored, non community-wiki answers of a minimum length are eligible