Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A dead man's switch for your computer?

blog.viktorpetersson.com

Post reply on HN
Print view View original

61–70 of 74 posts

Re: A dead man's switch for your computer?

#61

Post by kefka »

fit2rule wrote: post #44

Everyone has their own unique heartbeat signature. What we need is a way to hear that heartbeat, and if its not the right signature: erase/destroy/etc.

I think you're on to something there. Biometrics might be the way to go here, but is difficult in implementation.

First security in layers is the best option.

1. USB HID watcher that shuts down system when plugged in. If we use a mouse, we can exclude that. But any other HID, shutdown -r now.

2. Fingerprint scanner. It's not foolproof, but does make duplicating fingerprints a pain if you dont cooperate. And jailcells usually have concrete. No more fingerprints :)

3. Most laptops have webcams built in. I'm looking in OpenCV FaceRecognizer class to see how it works, and if it's viable for fingerprinting a user. We could also do other checks, like 3d facial recognition over multiple video frames.

4. We could also potentially use the accelerometer built in laptops. When others have made a sshd knock script, we could provide a knock script to the physical device.

5. Lock on ac power removal. Simple and effective, unless the enemy has AC separation tools.

There's a few ideas. And of course, mix in live filesystems in ram, or virtualbox funniness, and you're in business.

Re: A dead man's switch for your computer?

#62

Post by wyldfire »

mirimir wrote: post #28
sarciszewski wrote: post #11

It turns out that this has already been made before. https://github.com/defuse/swatd

Using dm-crypt/LUKS, there's a very fast and total wipe to execute when sensors fail. Let's assume that /dev/sdb1 is the LUKS volume. First backup the LUKS header: "cryptsetup -v luksHeaderBackup --header-backup-file=/tmp/LUKS-header /dev/sdb1". Then encrypt (gpg -c) the LUKS-header, and anonymously stash a few copies online. This is the weak point. You must remember where at least one of them is, and also remember t…

'shutdown -P now' is slow, maybe 'echo b > /proc/sysrq-trigger' is more effective. Trick is knowing when that sync is "really" done.

Re: A dead man's switch for your computer?

#64

Post by marcosdumay »

verytrivial wrote: post #48
dagw wrote: post #43

Earlier quoted context omitted.

You probably read about it in Cryptonomicon (I know that's where I read about it), but I don't know if Stephenson made it up or not. As to practically It seems quite unfeasible. First of all since magnetic forces fall off according to the inverse square law, you're going to need a seriously large magnet to for it work at say 1 meters distance or so. You're basically going to have seriously retrofit your entire house,…

Unless you can get your hands on a powerful magnetic monopole, the field falls off with the inverse CUBE of distance. (Note: noone has so far managed to get their hands on a magnetic monopole, powerful or otherwise.)

It can still fall with the inverse of the distance by smartly assembling several dipoles.

Anyway, the time issue remains.

Re: A dead man's switch for your computer?

#65

Post by kyleknighted »

Jekyll wrote: post #63

I don't know if I'm missing something here... but what's wrong with running your laptop directly off the mains without a battery and unplugging the cord if necessary so the computer shuts down?

The concept is sound, but new MacBooks do not have removable batteries.

Re: A dead man's switch for your computer?

#66

Post by mirimir »

wyldfire wrote: post #62
mirimir wrote: post #28

Earlier quoted context omitted.

Using dm-crypt/LUKS, there's a very fast and total wipe to execute when sensors fail. Let's assume that /dev/sdb1 is the LUKS volume. First backup the LUKS header: "cryptsetup -v luksHeaderBackup --header-backup-file=/tmp/LUKS-header /dev/sdb1". Then encrypt (gpg -c) the LUKS-header, and anonymously stash a few copies online. This is the weak point. You must remember where at least one of them is, and also remember t…

'shutdown -P now' is slow, maybe 'echo b > /proc/sysrq-trigger' is more effective. Trick is knowing when that sync is "really" done.

How about "head -c 1052672 /dev/urandom > /dev/sdb1; xinput set-int-prop 2 "Device Enabled" 8 0; xset dpms force off; xscreensaver-command --lock; sync; echo o > /proc/sysrq-trigger"? That way, the keyboard and display would be gone while sync was completing. Also, does rebooting protect better against reading RAM than shutting down?

Re: A dead man's switch for your computer?

#67

Post by TheLoneWolfling »

mayoff wrote: post #29
jasonl99 wrote: post #16

Earlier quoted context omitted.

How about a lanyard that has a magnetic connector (like Apple charging ports). So it just a small amount of force to disconnect, but easy to stick back together if you forget it was there when you got up to visit the rest room. Another thought, what about a little coin-sized watch battery device that does bluetooth low-energy. Press a button it locks your computer (or triple click wipes something, etc).

A lanyard with a magnetic connector doesn't suffice. If the enemy cuts the cord, the magnetic connector won't release and the computer won't know anything has happened.

If the enemy cuts the cord, the loop of wire in the cord will be cut, and hence the computer will know something has happened.

(i.e. you have a lanyard with a magsafe-like connector with two pins. There's a resistance wire that runs inside the lanyard from the connector, up through the loop, and back to the connector. The computer checks that the resistance remains the same.)

If you want to get fancy, you can embed a RC network in the lanyard and have the computer sweep frequencies measuring reactance.

Re: A dead man's switch for your computer?

#68

Post by TheLoneWolfling »

exprL wrote: post #39
bigbugbag wrote: post #37

Earlier quoted context omitted.

and way easier to workaround, nothing to cut simply duplicate the wireless signal.

How would you duplicate a wireless signal that contains an “answer” to a changing challenge (e.g. sign this message with the secret key)?

Easy. You do a relay attack.

I.e. instead of comp -> wireless -> device, you go comp -> extender -> extender -> device -> extender -> extender -> comp.

Re: A dead man's switch for your computer?

#69

Post by mirimir »

mirimir wrote: post #66
wyldfire wrote: post #62

Earlier quoted context omitted.

'shutdown -P now' is slow, maybe 'echo b > /proc/sysrq-trigger' is more effective. Trick is knowing when that sync is "really" done.

How about "head -c 1052672 /dev/urandom > /dev/sdb1; xinput set-int-prop 2 "Device Enabled" 8 0; xset dpms force off; xscreensaver-command --lock; sync; echo o > /proc/sysrq-trigger"? That way, the keyboard and display would be gone while sync was completing. Also, does rebooting protect better against reading RAM than shutting down?

This works well, and is very fast:

head -c 1052672 /dev/urandom > /dev/sdb1; xinput --disable 9; xinput --disable 10; xset dpms force off; sync; echo o > /proc/sysrq-trigger

Re: A dead man's switch for your computer?

#70

Post by Pwntastic »

Jekyll wrote: post #63

I don't know if I'm missing something here... but what's wrong with running your laptop directly off the mains without a battery and unplugging the cord if necessary so the computer shuts down?

There are tools available to law enforcement that allow them to splice into a power cable and convert it to battery power while still online

edit: i found it:

http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/

Post reply on HN