Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

Post reply on HN
Print view View original

161–170 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#161

Post by nkrisc »

berkas1 wrote: post #3
reallymental wrote: post #2

"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?

I don't think that wrist-key is an extreme (never seen it actually, but I still think this solution is a cautious one). For me an extreme measure would be to modify my motherboard in a way that I could connect RAM to my wrist and tear it away when necessary.

Now that would be interesting: have your RAM strapped to your wrist and connected to your Mobo by a breakaway cable.

Bonus points if they cut it when the tackle you because they thought it was a deadman switch, like mentioned in the link.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#163

Post by hinkley »

close04 wrote: post #158
hinkley wrote: post #146

Earlier quoted context omitted.

> And even they rely on being stored in a physically secure room and protected from theft. Not exactly. You don't want someone sneaking in and misappropriating the HSM to authorize something bad. And if you set the system up for unattended recovery from a power failure, then in all likelihood someone walking off with the server the HSM is in can use those keys indefinitely. But there are options. Some HSMs have self-…

> Not exactly. You don't want someone sneaking in and misappropriating the HSM to authorize something bad. I think we're talking about exactly the same thing :). That's what I meant by "even they rely on being stored in a physically secure room and protected from theft". Despite all the hardening that is applied to the device, it must always be kept secure and supervised. As an example, this is what Safenet considers…

As I was trying to say, there are ways to make that less of an issue by moving other factors off-site. You can configure (some) HSM cards not to be available on boot, requiring a human to come in and reactivate them with a password or a fob that they bring with them, and leaves with them.

Then your biggest problem is people thinking that stealing the cards will get them anything. Which, they're not entirely wrong, because those things are damned expensive. So you need a 'kinda' secure facility.

Again, the issue is that any hardware that will start up for you without any action on your part will likely start up for anybody else, too. Your laziness will probably win out...

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#164

Post by kllrnohj »

busterarm wrote: post #139
bsdz wrote: post #134

Earlier quoted context omitted.

.. or get a HotPlug https://www.cru-inc.com/products/wiebetech/hotplug_field_kit... Just discovered this now myself. The same company sells mouse jigglers.

Which is why if you want to defend against the easy versions of these and make people have to do work, only plug your desktop PCs into standalone outputs not on a surge protector. Yes, it won't defend against cord cutting. Edit: A more interesting defense I think would be to modify a surge protector for this specifically to defeat HotPlug. Only put your computer on a specific outlet and wire it so that if any other o…

Plugging into the wall doesn't defend against hotplug nor make it meaningfully more difficult: https://youtu.be/erq4TO_a3z8?t=236

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#165

Post by refurb »

gamblor956 wrote: post #152

Destroying evidence is considered a crime on it's own. Use something like this at your own legal risk, since it's usually far easier to prove obstruction than it is to prove the underlying crimes that were being investigated.

Any relevant case law here? I mean, clearly destroying evidence (e.g. shredding documents) is one thing but I assume it’s harder to prove when it’s a byproduct of computer security?

Apple phones can be wiped with 10 invalid password attempts, but the cops already know it. If it’s a piece of custom software that erases a computer after 2 attempts, can the prosecution really claim it was pure evidence destruction?

I honestly don’t know, but I’m curious.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#166

Post by refurb »

vinay427 wrote: post #95
sasaf5 wrote: post #35

Earlier quoted context omitted.

Once I have seen a coworker improvising one of these by placing a second (optical) mouse on top of a mechanical wristwatch.

Hmm, this is actually rather nifty, although one issue I see is it will only last a few days at most. I don't know how long people who confiscate laptops normally need to run mouse jigglers.

Battery operated mechanical wrist watches last years!

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#167

Post by refurb »

nialv7 wrote: post #154
deadbunny wrote: post #125

Earlier quoted context omitted.

How do they get the IDs?

They could just look around and see what USB devices you own. USB vendor/product IDs are not secret.

No doubt if the govt got burned by one of these, they’d pretty quickly approach it differently.

Security through (counter-measure) obscurity.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#168

Post by refurb »

Jaruzel wrote: post #105
DanBC wrote: post #55

Earlier quoted context omitted.

Section 49 to force key disclosure should only happen if: + The person being given the notice has the key + Investigators need the key to prevent or detect crime + Disclosure is proportionate + They can't get the encrypted material by other means Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum…

> Investigators need the key to prevent or detect crime That's a bit scary. 'Detect crime' could be pure speculation on the polices' part. "We think you've done something bad, let us see the contents of your phone. No we don't have any evidence already as we're detecting the crime right now."

Maybe I’m wrong, but I’m going to assume that the UK requires at least some evidence (reviewed by a judge) of a crime being committed or is about to be committed before they can throw you in jail for not giving the code to your phone.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#169

Post by nitrogen »

boring_twenties wrote: post #145
codethief wrote: post #114

From going through the discussion I'm getting the impression that the only feasible attack vector provided by USB is by emulating a keyboard like a USB Rubber Ducky. Is this really the case? For instance, if my laptop is locked (with a proper[0][1] lock screen like xscreensaver) and that lock screen is capturing all keyboard input and magic SysRq keys[2] are disabled, too, is there really no way an attacker could use…

> [0] https://www.jwz.org/blog/2015/04/i-told-you-so-again/ Sorry for the digression, but WTF is this guy doing? Looks like he redirects all requests that have HN as the referrer to a picture of a testicle. Copy-pasting the link (i.e., dropping the referrer) seems to work, though.

That's exactly what he's doing. I can't remember why he hates HN though, but it's been that way for a really long time.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#170

Post by stjohnswarts »

Everyone should also install a hard power off on the front of their computer and always have encrypted drives. Unrecognized USB storage in my computer also is instant off. Might corrupt my files someday, but it's worth the risk.
Post reply on HN