Seeking Expert Advice for Securing My New Lenovo Laptop

#41
Register now
You must login or register to view hidden content on this page.
I’m not as tech savvy as some of you here but I have a friend who is and I remember that he said a few things on that topic …

1. If someone has physical access to your computer and plans and wants to steal your data , they will . So best not to leave your computer unattended .
2. General rule of thumb is that Linux is best.
3. More secure almost always equals less comfort so you have to understand the level of risk you’re in decide what you want and who you want to protect yourself from.. isp , government etc or thieves and hackers…

He also said that generally iPhone + Mac is much better then android and windows , and that it is enough for most people with basic privacy settings..
 
Reactions: cckuhqilfownnfctux, JohnLocke and 0xDEADBEEF
#43
I installed Mint 22 two weeks ago on a older Dell XPS 13 (btw one of the few laptops that officially supported linux - Ubuntu if I remember correctly) - Bluetooth devices like headphones or watch one big pain in the a*s, same with wifi printer, sleep/hibernation support sucks, power management no way

with Proxmox or Vmware workstation (free for personal use now) one can achieve a lot and take the best from both Windows and Linux worlds - but it requires time (lots of time)

I'm repeatedly personally trying Linux on desktop for last 20 years, it's still not ready and I'm no rookie (I'm managing tens of mostly debian servers) - mission impossible for a mediocre user

everything of value should be in the server-side infrastructure and one can freely use various disposable and valueless devices (putting aside the value of the given hardware of course)
 
Reactions: JohnLocke and 0xDEADBEEF
#44
topic already discussed many times
mac is def better option than win, for non state actors
win + applocker + standard acc is also OK (pretty much to prevent anything not approved from running, ofcourse there could be exploit for it, who knows)

you were also told about bloatware, disabling macros...before i even added:
- changing DNS to DNS over HTTPS (browser option) and setting Google/CloudFlare as default DNS
- disable JS in browser, unless approved (to prevent popups from loading malicious web site)
- multiple VeraCrypt containers, just if one gets compromised, others are still encrypted (so do not auto mount them, or mount them all at the same time)

but for what you are after (by later post), i think your best bet is learning shortcut WIN + L
security on a machine with battery is uhhhh, well...if they take it, they will have it with completely powered with all ram content unencrypted...they will have plenty of time to disassemble laptop while being powered (if possible), spray ram modules...
 
Reactions: void, 0xDEADBEEF, EliasIT and 1 other person
#45
I agree, but to have a complete backup stored somewhere in an external hosting center may indeed help together with VerCrypt.

What do you mean with "spray ram modules" why ?

Can I also use Bulk Crap Uninstaller (BCUninstaller) ? I just installed it from SourceForce on a test PC - it finds a lot at clean it automatically, It is free and easy to use?
 
Last edited:
#48
EliasIT said:
What do you mean with "spray ram modules" why ?
Click to expand...
I think he is referring to RAM tracing and other methods to access data externally while your computer is still powered on in enemy hands:
https://scanlime.org/2009/09/dsi-ram-tracing/
You may want to use a Redkey or something attached to a wrist band. If set up properly with the patent of @JohnnyDoe
https://www.offshorecorptalk.com/threads/patent-for-secure-erasing-of-data.42666/All data will be gone if somebody takes your computer.
 
Last edited:
Reactions: JohnnyDoe
#50
I must admit that I’m learning a lot just by following this thread. I’ve been testing many of the mentioned methods and software/apps on a separate computer, and within just a few hours, it has already transformed the PC into a much faster and better machine. Thanks to everyone!
 
Reactions: JohnLocke, 0xDEADBEEF and JohnnyDoe
#51
How about the following .reg file?


and the following to uninstall all apps which do not allow to be uninstalled with the mouse
 
Reactions: 0xDEADBEEF
#52
Is it a build in function in Windows or how are you doing it?

very cool tool.
0xDEADBEEF said:
Also Defender EDR (MDE) keeps track of your vulnerabilities as well.
Click to expand...
this replace the used NOD32 by elias right?

0xDEADBEEF said:
Bitlocker is indeed included from the Pro edition, which will be more than sufficient.
Click to expand...
is included in Windows 11 Pro if I read the details correct?
 
Last edited:
#53
Houdini said:
Is it a build in function in Windows or how are you doing it?
Click to expand...
most straightforward approach is using the technology via Bitlocker (which I would not personally recommend but it's an option)

way better is using sedutil tool which will allow you to install PBA (PreBootAuthentication) utility to shadow MBR partition of the drive - when the NVMe drive with OPAL support is powered on this tools boots and allows you to submit your passphrase to the drive controller which unlocks given range (see the setup documentation) and "makes the drive readable" until next power off

then a conventional OS is loaded from the "encrypted" drive without even knowing about it

the most basic setup (totally fine for vast majority of users) is pretty simple and basically about following the cookbook

it's worth noting that these drives are encrypted "by default" and you're just changing the current password it's encrypted with (simplified but true from user perspective) which makes this technology so flexible

nice perk is zero impact on CPU load as all is done by the drive itself

as somebody (probably @0xDEADBEEF) already warned in another thread you're trusting the hardware manufacturer here when it comes to potential back doors implemented - this is something to consider and decided by yourself
 
Reactions: cryptofriendly, 0xDEADBEEF and Houdini
#54
void said:
as somebody (probably @0xDEADBEEF) already warned in another thread you're trusting the hardware manufacturer here when it comes to potential back doors implemented - this is something to consider and decided by yourself
Click to expand...
In the old days you could just do a formatting of the drive and start over, isn't that possible any longer on a laptop, the backdoors stay open ?
 
Reactions: 0xDEADBEEF
#55
Houdini said:
In the old days you could just do a formatting of the drive and start over, isn't that possible any longer on a laptop, the backdoors stay open ?
Click to expand...
actually formatting of old IDE/SATA drives is about erasing the partition table or other data structures of the drives - that's why so many utilities implementing different strategies of overwriting the data exist(ed)

if you don't trust you hw manufactures then DIY or make sure you don't have to (possible with disk data by using Veracrypt paying with your CPU load and moving the trust to Veracrypt developers ) or get back to pen&paper
 
Reactions: 0xDEADBEEF
#56
Houdini said:
In the old days you could just do a formatting of the drive and start over, isn't that possible any longer on a laptop, the backdoors stay open ?
Click to expand...
The backdoors are not *on* but *in* the hard drive. In other words, they are on the chip that comes with it. They use weak encryption. They have some sort of mainenance port etc.

And overwriting data is another issues. HDD are relatively easy in that sense as you can just write all blocks and cylinders. But SSD have a chip which decides where it wants to store the data (or not). It can completely fool you like with the 512 GB flash drives from China for $2 which show that amount of space on Windows, but actually only have 2 MB capacity. You can write a whole movie there, but the data is simply being wirtten nowhere and when you try to read it, the chip just spit out 0x00000000 or @0xDEADBEEF if you are lucky
 
Last edited:
Reactions: cckuhqilfownnfctux, 0xDEADBEEF and Houdini
#57
daniels27 said:
The backdoors are not *on* but *in* the hard drive. In other words, they are on the chip that comes with it. They use weak encryption. They have some sort of mainenance port etc.
Click to expand...
ahhh so it is a weak point of the hardware and you would need to replace the hard drive to get rid of the back door?
 
#58
void said:
as somebody (probably @0xDEADBEEF) already warned in another thread you're trusting the hardware manufacturer here when it comes to potential back doors implemented - this is something to consider and decided by yourself
Click to expand...

Houdini said:
ahhh so it is a weak point of the hardware and you would need to replace the hard drive to get rid of the back door?
Click to expand...
You probably would have to switch the manufacturer. If one hard drive has a backdoor built-in from delivery, most of them will have it. We currently do not know what all devices have backdoors, but there have been many issues in the past from EUSSR to China and as a result, US does no longer allow purchases of any Huawei devices.

You can check this one here:
https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/
We do not know if the backdoor was intended by Apple or not. But in any case, it shows you very well, that you simply cannot trust any hardware vendor that their devices are free from backdoors when delivered.
 
Last edited:
Reactions: JohnLocke and 0xDEADBEEF
You must log in or register to reply here.
Menu
Log in
Register