Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

Post reply on HN
Print view View original

111–120 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#111

Post by R0b0t1 »

macNchz wrote: post #83
captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

I have a Lenovo M93P Tiny which came with a chassis intrusion switch installed. It seems you can have it block startup/require a password when the case is opened and notify some central admin. I don’t know what happens if you open the case while it’s running, though. I’m not sure if it’s something they offer on current models, or to individuals at all (I bought it used from a corporate IT asset liquidator so it was l…

That feature is fairly common but practically quite useless and easy to circumvent if you can find the model information. Even with PCI-DSS enclosure compliance you can get in if you can take power tools to it. The assumption is power tools would be too obvious to use in a typical installation.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#112

Post by R0b0t1 »

sumtechguy wrote: post #63
daffy wrote: post #14

Earlier quoted context omitted.

> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?

You can present yourself as a standard file system or some device you know has a known exploit in the driver on the other side. Then on the USB 'drive' side you have a full out arm CPU. It can issue commands too as it is connected to the serial bus. Many USB drives already have small embedded CPU in them.

>Many USB drives already have small embedded CPU in them.

For most common hardware this is just an 8051 variant that sets up the USB and DMA peripherals. It's easy enough to get something more powerful, but I am doubtful you'd want to reuse consumer hardware.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#113

Post by R0b0t1 »

londons_explore wrote: post #65
worewood wrote: post #56

Earlier quoted context omitted.

Hidden operating system is the way to go. Usbkill turns the machine off, when asked you supply the public password.

Investigators will say "you sent this email to your dad at 09:29 on Tuesday, yet it wasn't sent from your phone or laptop according to device logs. You either have another device you haven't given us, or you haven't decrypted the right partition".

"Prove it."

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#114

Post by codethief »

From going through the discussion I'm getting the impression that the only feasible attack vector provided by USB is by emulating a keyboard like a USB Rubber Ducky. Is this really the case?

For instance, if my laptop is locked (with a proper[0][1] lock screen like xscreensaver) and that lock screen is capturing all keyboard input and magic SysRq keys[2] are disabled, too, is there really no way an attacker could use a USB device to hack my laptop?

Similarly, if my laptop is not locked but comes with unusual key bindings (maybe even a different keyboard layout), what are the chances of me getting hacked with a USB device? (Let's assume that the attacker manages to secretly plug in said USB device but doesn't want to access my unlocked laptop directly – maybe because we're in an open office and people are watching.)

My impression had always been that USB devices are dangerous beyond simple keyboard emulation but I might be wrong.

[0] https://www.jwz.org/blog/2015/04/i-told-you-so-again/

[1] https://www.jwz.org/xscreensaver/toolkits.html

[2] https://en.wikipedia.org/wiki/Magic_SysRq_key

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#115

Post by busterarm »

codethief wrote: post #114

From going through the discussion I'm getting the impression that the only feasible attack vector provided by USB is by emulating a keyboard like a USB Rubber Ducky. Is this really the case? For instance, if my laptop is locked (with a proper[0][1] lock screen like xscreensaver) and that lock screen is capturing all keyboard input and magic SysRq keys[2] are disabled, too, is there really no way an attacker could use…

Besides keyloggers, another reason people want this is because law enforcement has USB keepalive devices that will simulate mouse movement/keypresses to keep your computer from going to sleep.

They do this to make sure your computer stays on and your RAM doesn't get powered off, which will allow them to read any decrypted data in memory whether or not your data is encrypted on disk.

When they raid you, they come with massive UPS devices that they plug your computers into to give them as long a window as possible to get your data.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#116

Post by bausano_michael »

sn_master wrote: post #97

"immediately terminates the connection" Reminds me of some old Firewalls that would actively poll active connections, and when one is made that violates their rules, "immediately" terminate it. Often times, an attacker can embed a lot in just a single URL in the query string (stolen passwords etc) that would be done in That's like choosing to not have a door on your house, because you know you can run fast and shoot…

I think it's aimed at scenarios in which the attacker is not aware of this utility running. Otherwise they could just kill it before inserting the USB.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#117

Post by DanBC »

Jaruzel wrote: post #105
DanBC wrote: post #55

Earlier quoted context omitted.

Section 49 to force key disclosure should only happen if: + The person being given the notice has the key + Investigators need the key to prevent or detect crime + Disclosure is proportionate + They can't get the encrypted material by other means Not complying with the is a criminal offence. The maximum sentence is 2 years, unless it's a case involving child sexual exploitation or national security where the maximum…

> Investigators need the key to prevent or detect crime That's a bit scary. 'Detect crime' could be pure speculation on the polices' part. "We think you've done something bad, let us see the contents of your phone. No we don't have any evidence already as we're detecting the crime right now."

I'm not sure that would be proportionate.

It's not great, but it's better than before where this kind of crime detection had much less regulation.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#118

Post by toast0 »

derefr wrote: post #84
pfundstein wrote: post #24

Earlier quoted context omitted.

Autorun has been disabled by default for a long time (with good reason). And it has never worked with USB drives, only ones which emulated a CD drive such as U3 USB drives.

I've always been surprised that autorun wasn't re-enabled when app stores / code signing was introduced. If Microsoft or Apple is willing to sign an installer saying that it's something safe to install, isn't that proof enough to let it run when you insert the USB key it's on? I know this isn't really very relevant for the specific combination of installers and physical media any more, since it's rare for anyone to b…

Windows code signing does not include a step where Microsoft inspects the code. The developer gets a certificate from a commercial CA and signs the code. If the certificate is an EV certificate, that's basically it. If it's a regular certificate, Windows does a callback to Microsoft that seems to just be a popularity check --- if the certificate has been used a lot, then the prompts go away.

At best, Windows code signing lets you know who signed it and that that person was able to pay a CA some money, not that it's safe to run.

Post reply on HN