Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

Post reply on HN
Print view View original

11–20 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#11

Post by emiliobumachar »

reallymental wrote: post #2

"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?

How about a bluetooth dongle in your pocket? Less visible, and unless there hostiles know about it, they will separate you from the computer.

A phone could work. An apparent car key would be better. Best would be a piece of clothing, like a belt.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#12

Post by osivertsson »

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

I doubt there is a need to open the case for a sophisticated attacker. If there is even the slightest opening for air you can run camera optics and freeze spray tubes to RAM I would imagine.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#13

Post by seanhunter »

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Here's details of this attack for people who want more details https://citp.princeton.edu/our-work/memory/

If memory serves correctly they achieved the best results by using a can of compressed air to freeze the ram in place before removal.

//Small edit to wording

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#14

Post by daffy »

moritonal wrote: post #5
reallymental wrote: post #2

"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?

"To prevent Ulbricht from encrypting or deleting files on the laptop he was using to run the site as he was arrested, two agents pretended to be quarreling lovers. When they had sufficiently distracted him, according to Joshuah Bearman of Wired, a third agent grabbed the laptop while Ulbricht was distracted by the apparent lovers' fight and handed it to agent Thomas Kiernan. Kiernan then inserted a flash drive in one…

> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files.

How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#15

Post by darkwater »

raziel2p wrote: post #10

Seems like a lot of code for what should be, on Linux anyway, a simple udev rule? echo 'RUN+=/root/usb-changed.sh' > /etc/udev/rules.d/usb-changed.rules Then just put whatever you want to be ran in /root/usb-changed.sh.

I think you would at least add an allowlist of safe (i.e. owned by you) USB ids you don't want to shut your pc/laptop down if connected

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#16

Post by raziel2p »

jokoon wrote: post #8

I dont understand. Is USB just always insecure because of hardware?

Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-...

And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server as soon as it's plugged in.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#17

Post by el_oni »

I attended a talk by GSK and there was part of the talk about security. They don't allow usb devices to be plugged into their analysis computers. But every year they get an intern that tries to charge their phone from the PC USB.

Something like this, that doesnt halt the computer but shows a warning on screen and logs information would perhaps be a solution to their problem. Although in the case of industrial espionage maybe locking the system would be worth it...

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#18

Post by waldfee »

If you are paranoid about something like this happening, just use https://www.qubes-os.org/. all usb devices are jailed in a non-networked vm by default.

In general, if what you do warrants that level of paranoia, qubes will help you massively.

Micah Lee held a great overview talk at HOPE 2018: https://www.youtube.com/watch?v=f4U8YbXKwog

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#19

Post by _kbh_ »

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Memory encryption technologies such as AMD's Secure Encrypted Memory (SME). Would be your best bet to combat this, along with other anti-evil maid protections.

https://en.wikichip.org/wiki/x86/sme#Overview https://www.qubes-os.org/doc/anti-evil-maid/

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#20

Post by TedDoesntTalk »

daffy wrote: post #14
moritonal wrote: post #5

Earlier quoted context omitted.

"To prevent Ulbricht from encrypting or deleting files on the laptop he was using to run the site as he was arrested, two agents pretended to be quarreling lovers. When they had sufficiently distracted him, according to Joshuah Bearman of Wired, a third agent grabbed the laptop while Ulbricht was distracted by the apparent lovers' fight and handed it to agent Thomas Kiernan. Kiernan then inserted a flash drive in one…

> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?

On Windows, autorun.inf. This technique has been around since at least the 90s when CD-ROM drives were introduced to PCs... it is how a newly inserted CD (and later usb disk) can automatically execute software on insertion:

https://www.instructables.com/id/Autorun-anything-off-of-a-u...

Post reply on HN