- [Instructor] Now, in this lesson,
I want to go over a couple of things.
Physical attacks against an asset, so, a device.
And also physical attacks against, of course,
an infrastructure or facilities.
So, let's actually start with physical attacks.
So, attackers where they actually
have physical access to a device,
and that whenever they actually can perform
many different types of you know, malfeasance,
and manipulations.
Of course, first thing that you're actually gonna say
is that device theft is actually
one of the most common risks out there.
So if somebody actually can steal your laptop
or your server, and you don't encrypt your hard drive,
of course they can actually do, or obtain,
sensitive information from that system.
A few other attacks and techniques
that I want to share with you.
First one is actually cold-boot attacks.
Basically that's a type of side-channel attack,
where the attacker tries to retrieve the encryption keys
from a running operating system,
after using a cold reboot or a system reload.
Basically, these cold-boot attacks
attempt to compromise the data remnants
of DRAM and SRAM to actually retrieve memory contents
that could actually remain,
could remain on the system or could be readable,
within seconds minutes actually after the system
actually has been powered on, right?
Typically, this type of attack is actually done
by using removable media to boot to a different
operating system, and actually used to dump
the contents of the pre-boot physical memory to a file.
Now another thing that an attacker can do
is actually connect to a serial console
for debugging and to perform reconnaissance
and tampering, right?
Many organizations actually use terminal servers,
serial console servers to actually allow remote access
to the serial port of another device of their network.
Of course, if you can actually compromise that,
you can potentially get access to those systems
through that underlying, other systems
that are connected to that terminal server,
and of course, you know, perform reconnaissance,
see what operating system and application's
actually running, and god forbid,
if actually they can login as an administrator
or as any other user, they can usually perform
other type of attacks.
Now another technique that I want to go over
is JTAG debugging reconnaissance and tampering.
Basically JTAG is a hardware access interface
that basically allows a hardware engineer
or USPN tester to perform debugging
on hardware implementations.
Basically, debuggers can actually use JTAG
access register and then other things
like memory contents and interrupts,
and then obtain information about the system
or even pause or redirect software instructions
or software instruction flows within any given system.
A whole bunch of other attacks can be done
against physical facilities, right,
against your facilities.
Some of these actually can be carried out
to infiltrate the facilities,
or to steal sensitive information from the organization.
Here I'm showing a list of the most common ones,
and specifically the ones that you have to know
for the test.
First one is actually piggybacking or tailgating.
That's actually you working behind somebody
that actually has authorized access to a facility,
and then basically you just get in right after them.
Then the other one is actually fence jumping,
that goes without saying, jumping a fence or a gate
to enter a restricted building or a facility.
Dumpster diving, that means actually that you may search
and attempt to collect sensitive information
literally from the trash.
Also lock picking, as a matter of fact,
lock picking is actually very powerful
among many security enthusiasts and,
as a matter of fact, there's actually lock picking events,
but at the end of the day, yes,
lock bypass is a technique used in lock picking
that can be, have been used for many, many, different years,
and includes different techniques that loading attempts,
using basically a credit card or a similar thing
to close, or rather open, or latch a lock,
or to actually literally pick a padlock
or any type of lock in a door.
Now you also have, the actors in some cases
actually may tamper with egress sensors
to open doors as well.
Another common attack is actually to clone badges
of employees and authorized individuals
to actually enter a restricted facility
or a specific area within a building.