(untitled)

We talk a lot about opsec , social engineering, and infosec. But how do you secure your house/apartment/whatever? What should you do to secure your most important belongings from thieves? And if a bad actor has physical access to your machines, it's game over man.

>>7761 Have steel shipping container, has big lock, and another big lock, and is sited in a locked gated yard with CCTV. Use this for deep safe storage. Situation is as important as steel... live in small safe town - way better than big fuarrrk off city... regardless of your lock arrangements! Beyond this - I go for shielded, 6 pin, security pin pad locks with >12mm shackle diameter. Thinking of getting new composite front door (apparently police find it hard/cant brake them down without big tools) also have multi point locking leavers and security pins. But they look totally normal - not too beefy! Also have dog - not a huge hard dog but not a pussy either - enough to be a deterrent and an alarm!

>>7762 Any non-analog form of lock is prone to cracking. There is a new trend amongst idiots to make their locks, surrveilence systems, and their doorbell IoT dumbsoykaftery. While the person with actual intelect avoids botnet such as Ring(TM) and such, and chooses to use things including an SSH key for their doors, what happens when 1) it is hacked, 2) the video feed is accessed due to it being public-facing, 3) the power goes out, 4) your cell phone, smart card, or whatever you have, is stolen or lost, or locked inside? A digital pin-pad is a simplistic example of this. Analog locks requiring a pin input is also a concern, due to them usually being made of poor quality and requiring a maximum of 4 digits.

I have a lot of files on home security, if anyone's interested.

>>7766 I'd be interested.

>>7766 Seconded.

>>7761 > And if a bad actor has physical access to your machines, it's game over man. Not necessarily. There's a lot of info out there about Anti-Evil Maid. While I wouldn't necessarily trust a machine that has been in a bad actor's possession for an extended period of time, you can at least raise the barrier for compromise to potentially thwart a number of attacks. https://github.com/osresearch/heads https://trmm.net/Heads_33c3

>>7761 I found this to be a good resource: https://www.youtube.com/watch?v=4YYvBLAF4T8

>>7761 Please find attached two books written by Lawrence J. Fennelly, he has been writing the books on security and physical security for the last 40 years. Lawrence J. Fennelly is an internationally recognized authority on crime prevention, security planning and analysis, and on the study of how environmental factors (CPTED), physical hardware, alarms, lighting, site design, management practices, litigation consultants, security policies and procedures, and guard management contribute to criminal victimization. Mr. Fennelly was previously employed with Apollo Security, Computershare, Inc., as well as a sergeant at Harvard College, employed by the Harvard University Police Department in Cambridge, Massachusetts. He was trained as a crime prevention specialist and served in this capacity for over 21 years at Harvard. He was also the department’s training officer and assistant court officer. As part of his role as an officer at Harvard, Larry also was a deputy sheriff in both Suffolk and Middlesex counties (Massachusetts). And a third book which is Military Handbook for Physical Security published by the DOD.

>>7777 Sweet. Thanks!

>>7761 Please find attached two books on Home security and another on Physical Security and Safety. The first book was written by the following authors Jarred Ball, M.S., is a certified law enforcement instructor for the Commonwealth of Kentucky in homeland security. He has a master’s degree in safety, security, and emergency management from Eastern Kentucky University and has taught homeland security at the college level. Jarred has conducted antiterrorism risk and vulnerability assessments of critical infrastructure for the Commonwealth of Kentucky’s Office of Homeland Security. Jeff Dingle, CPP, is the director of security for PCI Gaming in Atmore, Alabama. He is a former special agent with the National Security Agency, and has held senior security management positions with both the Carter Presidential Center and corporate Home Depot. He has written and taught physical security courses for over 25 years for private companies and the Federal Law Enforcement Training Center (FLETC), including being the program manager for the FLETC Advanced Physical Security Training Program and the Physical Security Managers Training Program. He has written numerous articles on security and has presented at industry security conferences. James L. Pharr, M.S., is an associate professor of fire and safety engineering technology at Eastern Kentucky University (EKU). Professor Pharr specializes in fire dynamics, building and life safety, leadership, emergency scene operations, and fire investigation. Prior to joining EKU, Pharr was the emergency management director and fire marshal in Gaston County, North Carolina. Truett A. Ricks, Ph.D., was the retired dean of the College of Justice and Safety at Eastern Kentucky University. He wrote several textbooks on physical security and crime prevention. He was the former owner of a security company and was president of his own consulting company. He was a former Certified Protection Professional (CPP). The second book was written by Jim Cobb is the owner and lead trainer for DisasterPrepConsultants.com. His articles on preparedness have been published in national magazines such as OFFGRID, American Survival Guide, Survivor's Edge, and Boy's Life. You can find him online at SurvivalWeekly.com. His books include Prepper's Home Defense, Prepper's Financial Guide, and Prepper's Long-Term Survival Guide. Jim lives in the Upper Midwest with his beautiful wife and their three adolescent weapons of mass destruction. And the third was written by Des Conway has worked in the security field for 30 years, serving as a police officer, working in government security and as a security consultant. He has carried out countless reviews of domestic and commercial properties.

>>7782 Aren't police officers actually quite unsuited for security qualifications?

As for what I personally do regardless of literature and books. I personally hide things in plain sight, with valuable things being contained behind locked doors, and with fancy looking things out of sight and hidden in plain looking or not useful looking boxes or other containers (like old food containers or jars) and having those containers instead containers where the first of the stuff in the first container looks low value and not worth stealing. Regarding physical security of electronics or appliances it is best to just be insured unless you own your property and can renovate / improve its defenses. It depends on your threat model and whether the burglar or person invading your physical security is a trained / determined individual or group. E.g. Kensington locks can be dealt with by bolt cutters. But if you have a tracking chip installed on your device, then you know its location if lost or stolen. Then your next layer is secure boot and bios password / and encrypted drives, then you next layer is mutlifactor authentication for login, etc and so on. Other people have intrusion detection systems that isolate an access point to their accounts / other information (passwords for mounting separate encrypted partitions, booby traps which take photos using laptop cameras and upload to remote server, acting like surveillance camera if a password isn't entered, etc) Having security alarms and security cameras hidden in toy animals or clocks is another thing that can done, though I haven't done it recently.

>>7783 It depends on the police officer and the training and experience on the job they have received, but the reason Des Conway's book was last and with such a small author bio is because most of what he writes about is common sense, but people these days say common sense isn't that common. He is also known for his books on event management , and various amazon reviews of his security books, either recommend other books to compliment his book/s or criticize his books based on the basic common knowledge they contain, but that too serves as purpose as not everyone has the same shared security knowledge or common knowledge.

>>7768 >>7767 OK then. Generally, I suggest engraving your valuables in case you find them in a pawn shop. Motion detector-activated solar powered lights will dissuade most burglars. And putting your lights and television on a timer can help create the illusion you're home when you're not. Women and children should be drilled to never admit over the phone to being alone at home. Calls should be screened, and try to network with your neighbours. Always face your webcam to the wall when you're not using it, and have the police on speed-dial. You should check that no-one can see into your house, remember that one-way glass works in reverse at night. Check that your locks can't be opened with a credit card.

>>7792 > Always face your webcam to the wall If someone has compromised your box to the point where they control the camera, it's time to nuke and reinstall. They still have microphones they can use, they likely will have access to your router, or at the very minimum can see what devices are on the network. Very easy to correlate what devices are phones, and people very rarely leave those at home.

>>7793 More to the point a web cam you can turn around is 99% of the time a web cam you can unplug until you need it.... will kill all cam hacks and the mic too...

>>7761 If you are renting and want to lock internal doors but can't, you know, fuarrrk up the doorframes and soykaf, you can remove the door handles and replace the "outside" handle with a window handle. The two screw holes will be covered by the original handle when you move out so there's no obvious sign of damage. One big caveat is the square rod is shorter so it won't go all the way through the door so you can't latch it from inside the room. Also I don't know how easy those locks are to pick, since the locks are not accessible from outside they might have a lower standard. But it's better than nothing.

>>7796 > since the locks are not accessible from outside Window locks are not accessible from outside the property when you're using them for windows the way they are intended so the lock itself might be soykafty I mean.

>>7764 >No one has replied to my post

>>7764 > your cell phone, smart card, or whatever you have, is stolen or lost, or locked inside yes, because that's not something that can happen with your key...

>>7834 >>7834 You can get a locksmith for your key. You can't get a locksmith for your PGP+SHA512 RFC-designed SSH key-lock. And if you tried to get a locksmith to bypass it he probably wouldn't have a clue how

>>7835 s/RFC/NFC

>>7835 so you're saying there's a whole profession out there getting paid for being able to get into my house without a key?

>>7835 >>7764 seriously though. hacking is always a possibility. so is lockpicking. that's why it's not a good idea to trust only one of these options. >the video feed is accessed due to it being public-facing depends on how you build your system. i wouldn't make it accessible on the internet for example >the power goes out usually you have failsafes for these situations... obviously backup battery is one of them, but for example (what some safes do) - if there's no electricity, activate failsafe (for example thick iron bars that make it difficult to open it - i am not an expert, you can look this up) > your cell phone, smart card, or whatever you have, is stolen or lost, or locked inside? again, you won't trust only one thing... you need a protocol ready for such situations >Analog locks requiring a pin input is also a concern, due to them usually being made of poor quality and requiring a maximum of 4 digits. i agree, but you said it yourself. it's usually. if one wants to implement this, they should research their options... btw, kinda relevant (and it's defcon :3) https://www.youtube.com/watch?v=-cZ7eDV2n5Y i am not saying we should do this... (if nothing else, that incident with people locked out (or locked in) because a company screwed up update for their locks is an example...) i am just saying all options have their downsides and upsides

>>7837 Three, counting contract burglars and the police.

>>7838 When I said Public-Facing video I was referring to the consumer devices currently in vogue, such as the Ring Video Doorbell, IP cameras connected on the "Cloud", through your Cable Company branching out into the (((Home Security))) industry. The safest method of CCTV surveillance with recording capabilities in my view is a series of cameras connected to a series of VCRs, which you manually cycle the tape out of. Having a policy of overwriting the tapes you already have by cycling the every week or is also good (for the privacy of innocent individuals).