Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

Post reply on HN
Print view View original

31–40 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#31

Post by michaelt »

daffy wrote: post #23
raziel2p wrote: post #16

Earlier quoted context omitted.

Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…

> depending on the OS, it's possible to craft a USB stick that copies files to a remote server as soon as it's plugged in. Is this possible with Linux?

You can get a 'USB rubber ducky' [1] which emulates both a USB memory stick and a USB keyboard, allowing you to script keystrokes for the keyboard [2]

So it can do anything a newly plugged in keyboard can do. Which, if the user is already logged in, makes grabbing the user's files easy.

[1] https://shop.hak5.org/collections/usb-rubber-ducky/products/... [2] https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#32

Post by kryptiskt »

daffy wrote: post #23
raziel2p wrote: post #16

Earlier quoted context omitted.

Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…

> depending on the OS, it's possible to craft a USB stick that copies files to a remote server as soon as it's plugged in. Is this possible with Linux?

Yes, the device can present itself as both a keyboard and storage device and send the copy commands via keystrokes.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#33

Post by daffy »

klyrs wrote: post #27
daffy wrote: post #14

Earlier quoted context omitted.

> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?

Speculation: It's possible to produce keyboard and mouse inputs, and also present as a storage device -- autorun isn't even necessary (though spurious inputs would be quite visible to somebody using the computer and something like a mirrored mouse, custom keyboard layout / shortcuts could foil this)

That would only work on a known operating system and window manager with known keyboard shortcuts, unless a terminal is already focused.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#34

Post by jki275 »

netsec_burn wrote: post #30
raziel2p wrote: post #16

Earlier quoted context omitted.

Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…

An alternative approach may be to check idVendor and idProduct (lsusb) to see if either matches a mouse jiggler supplier or product.

Those can be easily spoofed. I don’t know if current mouse jigglers in use have a specific Id or not, but there’s no reason they would have to have a recognizable Id.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#35

Post by sasaf5 »

raziel2p wrote: post #16
jokoon wrote: post #8

I dont understand. Is USB just always insecure because of hardware?

Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…

Once I have seen a coworker improvising one of these by placing a second (optical) mouse on top of a mechanical wristwatch.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#36

Post by daffy »

michaelt wrote: post #31
daffy wrote: post #23

Earlier quoted context omitted.

> depending on the OS, it's possible to craft a USB stick that copies files to a remote server as soon as it's plugged in. Is this possible with Linux?

You can get a 'USB rubber ducky' [1] which emulates both a USB memory stick and a USB keyboard, allowing you to script keystrokes for the keyboard [2] So it can do anything a newly plugged in keyboard can do. Which, if the user is already logged in, makes grabbing the user's files easy. [1] https://shop.hak5.org/collections/usb-rubber-ducky/products/... [2] https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads

This will only work, I suppose, if the attacker knows beforehand a keychord that will focus a terminal.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#37

Post by dividedbyzero »

numlock86 wrote: post #25

Obligatory $5 wrench comment: https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?

In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ...

But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe a SWAT team will snatch your laptop, but if all evidence is in there and encrypted, you may get off with a lot less than otherwise.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#38

Post by unionpivo »

daffy wrote: post #23
raziel2p wrote: post #16

Earlier quoted context omitted.

Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…

> depending on the OS, it's possible to craft a USB stick that copies files to a remote server as soon as it's plugged in. Is this possible with Linux?

yes. Mouse jiggers pretend to be regular mice an keyboard.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#39

Post by janekm »

daffy wrote: post #33
klyrs wrote: post #27

Earlier quoted context omitted.

Speculation: It's possible to produce keyboard and mouse inputs, and also present as a storage device -- autorun isn't even necessary (though spurious inputs would be quite visible to somebody using the computer and something like a mirrored mouse, custom keyboard layout / shortcuts could foil this)

That would only work on a known operating system and window manager with known keyboard shortcuts, unless a terminal is already focused.

In theory, you could fingerprint the host OS first and then run the appropriate commands (of course more tricky with more custom Linux setups, does CTRL+ALT+Fn still work to get to a text console?): https://www.cise.ufl.edu/~butler/pubs/sadfe11.pdf

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#40

Post by kawsper »

waldfee wrote: post #18

If you are paranoid about something like this happening, just use https://www.qubes-os.org/ . all usb devices are jailed in a non-networked vm by default. In general, if what you do warrants that level of paranoia, qubes will help you massively. Micah Lee held a great overview talk at HOPE 2018: https://www.youtube.com/watch?v=f4U8YbXKwog

How does that work with input devices like keyboard and mouse?
Post reply on HN