Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

Post reply on HN
Print view View original

1–10 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#2

Post by reallymental »

"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill."

This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme?

Is is even extreme?

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#3

Post by berkas1 »

reallymental wrote: post #2

"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?

I don't think that wrist-key is an extreme (never seen it actually, but I still think this solution is a cautious one).

For me an extreme measure would be to modify my motherboard in a way that I could connect RAM to my wrist and tear it away when necessary.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#4

Post by baq »

reallymental wrote: post #2

"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?

not a security expert but a commonly heard phrase is 'depends on your threat model' :)

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#5

Post by moritonal »

reallymental wrote: post #2

"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?

"To prevent Ulbricht from encrypting or deleting files on the laptop he was using to run the site as he was arrested, two agents pretended to be quarreling lovers. When they had sufficiently distracted him, according to Joshuah Bearman of Wired, a third agent grabbed the laptop while Ulbricht was distracted by the apparent lovers' fight and handed it to agent Thomas Kiernan. Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files."

https://en.wikipedia.org/wiki/Ross_Ulbricht

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#6

Post by captainmuon »

Interesting project, I'm sure this is useful for people at risk.

Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys.

All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody here set up a chassis intrusion kill switch that erases the RAM/shuts down the PC etc. if the case is opened improperly? Can you buy anything like this on the market?

Post reply on HN