11
votes
Accepted
Securing a Laptop from a Foreign Intelligence Agency
I am assuming that there is some reason you can't use a dozen different laptops in multiple countries or jurisdictions doing the same activities to provide extremely high redundancy (as pointed out in ...
- 67.3k
11
votes
Accepted
How do you keep someone from changing hidden values in an HTML form?
You don't. User can change whatever they want to. A hidden field is not different from a common field from the browser or server perspective.
If you want to store secret data the user will need, ...
- 55.5k
4
votes
Accepted
How to know whether a textfile has been edited or tampered with on the local system?
I fear that the answer is "it's not possible"
You are right.
The user have the save file, and the executable. He can change the save file as much as he wants, and he have an infinite number of ...
- 55.5k
4
votes
Accepted
What use does a TPM have for accurate timekeeping?
The oscillator is a mandatory component for the TPM system to function.
The TPM module has a 100 kHz SMBus which is synced using that oscillator.
If the TPM board also has a wireless sensor node, ...
- 8,939
4
votes
Is the Ethereum blockchain truly a tamper-proof way to deploy distributed applications?
It might depend on what you mean by "tamper-proof" and what they mean.
One of the benefits of blockchains is the ability to distribute a ledger of data across the entire network. Each node in the ...
- 132k
3
votes
Accepted
Prove log files weren't tampered with?
Disclaimer: I Am Not A Lawyer.
Despite of this, I know a general rule: nobody can be a proof for themselves. That means that if the log was generated in your system you cannot use it a definitive ...
- 26.9k
3
votes
Android tamper resistance: BuildConfig.DEBUG spoofing?
As your sample code shows if the attacker uses a debug version he can easily bypass the security checks. Actually you need compiler directives to do that.
Using compiler directives the portion of ...
- 306
2
votes
Accepted
Post Data tamper detection
One way to ensure security is to have the client create a Message Authentication Code for the request and then send the MAC along with the data. The server will recreate the MAC and then validate it ...
- 751
2
votes
Prove log files weren't tampered with?
There should be trust between the administrators, but the same question is asked every time a system gets compromised: if an attacker gets root access to the system, the log files could have been ...
- 19.4k
2
votes
Prove log files weren't tampered with?
No, you cannot prove to someone else, that logs on your system have not been tampered with. Clearly, if you own that given system, you can do whatever you like with it, including the manipulation of ...
2
votes
How do you keep someone from changing hidden values in an HTML form?
You can use HMAC or some other digital signature mechanism, such as encrypting the "hidden" data with the page-and-user-specific encryption key, and then decrypting and validating it on the server ...
- 3,544
2
votes
Is the security seal on samsung phones proof that the phone has not been tampered with?
No. They exist primarily to make you comfortable with your purchase.
As Steve noted in his comment, most anti-tamper seals are actually easy to tamper with. The attacker just needs to dedicate some ...
- 3,970
2
votes
Is encrypting a query parameter within a URI a security best practice?
No, the approach you've described does not make sense.
First, merely using a public Wi-Fi doesn't mean everybody with network access can inspect the browser state or JavaScript variables. This would ...
- 23k
1
vote
Accepted
Since JTAG can be authenticated and encrypted, which key is used? I read that Secure Boot is used, but what is the key?
Although the exact nature is unknown, securing the JTAG with authentication and encryption is often linked to the device’s Secire boot process. But this doesn’t mean it’s easy to find out what key is ...
- 3,035
1
vote
Accepted
Tactics to ensure payload has not been modified
If the end-user’s system is compromised there nothing you can do to detect that data is coming from a legitimate user. However, you can use following measures to ensure some level integrity:
mTLS: ...
- 808
1
vote
Tactics to ensure payload has not been modified
The term for what you are referring to is integrity. One of the goals of any secure protocol (including TLS, which is used on the web with https protocol) is to ensure integrity, which is another way ...
- 24.1k
1
vote
Preventing printed data interception using origami or other technique?
I've never heard of a cryptographic operator that works like this—you could certainly design a page that looks a certain way (e.g. has certain numbers on it) when folded up, but I've never heard of an ...
- 131
1
vote
Tamper proof SD card
Creating tamper-proof hardware is a very difficult problem. Depending on the attacker’s resources, capabilities and motives, just about any chip’s secrets can eventually be recovered.
Instead, ...
- 34.7k
1
vote
Securing a Laptop from a Foreign Intelligence Agency
I would like to add a layer of simplification to @forest's excellent answer.
Burn the entire system to read-only media
And protect the DVD (or bluray) from swapping by the attacker.
Once the software ...
- 5,418
1
vote
Is it possible to guarantee a transaction between two peers against interruption exploits?
The situation you describe assumes that both Alice and Bob are not in full control of the device and software because otherwise Alice could use a modified software which prevents the deletion of the ...
- 208k
Only top scored, non community-wiki answers of a minimum length are eligible