Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

Post reply on HN
Print view View original

91–100 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#91

Post by Fjolsvith »

alfiedotwtf wrote: post #76
captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Back in the BBS days, there were textfile describing how to wire your beige box to either turn on strong magnets or ignite termite if a case was detected. ... I don’t know of anyone actually implementing this though :)

This was a plot device used in the TV series Mr. Robot Season 2, Episode 3, about 27 minutes in.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#92

Post by zzz61831 »

close04 wrote: post #26
seanhunter wrote: post #13

Earlier quoted context omitted.

Here's details of this attack for people who want more details https://citp.princeton.edu/our-work/memory/ If memory serves correctly they achieved the best results by using a can of compressed air to freeze the ram in place before removal. //Small edit to wording

Many of the measures that provide effective physical security also make a device really unsuited for personal usage. Look at HSMs for an example of this. And even they rely on being stored in a physically secure room and protected from theft. It's a matter of being more determined than your attacker. Imagine a device that will irretrievably brick itself if tilted more than a certain angle, if left unpowered for more…

Personal computers have an advantage here: it is acceptable for them not to work when they are not directly used by someone. It means they can be stored in safes when not used and have all the encryption keys securely erased when not used. For example, a screen locker could stop all the processes and erase all the keys from registers and memory assuming both disk and memory encryption. And the locker itself could be triggered by some proximity sensor, RFID, camera, whatever, not just input inactivity timeout.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#94

Post by ta17711771 »

londons_explore wrote: post #65
worewood wrote: post #56

Earlier quoted context omitted.

Hidden operating system is the way to go. Usbkill turns the machine off, when asked you supply the public password.

Investigators will say "you sent this email to your dad at 09:29 on Tuesday, yet it wasn't sent from your phone or laptop according to device logs. You either have another device you haven't given us, or you haven't decrypted the right partition".

You sent shit to your dad from the wrong machine/partition.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#95

Post by vinay427 »

sasaf5 wrote: post #35
raziel2p wrote: post #16

Earlier quoted context omitted.

Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…

Once I have seen a coworker improvising one of these by placing a second (optical) mouse on top of a mechanical wristwatch.

Hmm, this is actually rather nifty, although one issue I see is it will only last a few days at most. I don't know how long people who confiscate laptops normally need to run mouse jigglers.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#96

Post by loa_in_ »

darkwater wrote: post #79
kawsper wrote: post #53

Earlier quoted context omitted.

Your script can have the allowlist so you don't have to fiddle with udev everytime you introduce or retire USB-devices.

But then it's not a oneliner anymore, and the original project starts to make sense.

It doesn't warrant to make a product that replaces a dedicated feature of the system. To whitelist in usbkill you have to do more than one line too.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#97

Post by sn_master »

"immediately terminates the connection"

Reminds me of some old Firewalls that would actively poll active connections, and when one is made that violates their rules, "immediately" terminate it. Often times, an attacker can embed a lot in just a single URL in the query string (stolen passwords etc) that would be done in That's like choosing to not have a door on your house, because you know you can run fast and shoot the thief when they enter.

Maybe its not as bad for hardware due to the inherit latencies involved, but I am always skeptic about things that use polling vs sitting in the middle at the kernel before a USB connection is allowed to happen to the OS in the first place.

The default (aka the one that nobody will change) connection-polling interval for this thing is 250ms, which doesn't seem too small for me for many conceivable attack scenarios.

For Mac, it runs this:

os.system("killall Finder ; killall loginwindow ; halt -q")

This won't prevent windows from reopening after a reboot.

A possible exploit for this could be the USB pretending to be a keyboard, opening an exploit website or an app with malicious argument values, then you immediately shutdown the Mac, reboot manually and boom, the website/app opens up and the machine gets owned anyway post-reboot!

Also, lack of Windows support is upsetting, considering there isn't much code change required to do so.

The "melt" feature is one I really like and respect the thought they put to make it.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#98

Post by fortran77 »

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Agreed; but this USBKill is a good protection for ordinary city police, or even a grab-and-run crime at a coffeeshop (with a usb key attached to your wrist with a cord).

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#100

Post by fortran77 »

TedDoesntTalk wrote: post #20
daffy wrote: post #14

Earlier quoted context omitted.

> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?

On Windows, autorun.inf. This technique has been around since at least the 90s when CD-ROM drives were introduced to PCs... it is how a newly inserted CD (and later usb disk) can automatically execute software on insertion: https://www.instructables.com/id/Autorun-anything-off-of-a-u...

Microsoft limited autorun about two decades ago, and finally got rid of it completely in 2011.

https://www.theregister.com/2011/02/08/microsoft_windows_aut...

You should try Windows 10! It's very good. At least give it a whirl so you can have accurate facts to what it does, and not spread FUD about it.

Post reply on HN