Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BusKill – A USB kill cord for laptops

buskill.in

Post reply on HN
Print view View original

141–150 of 339 posts

Re: BusKill – A USB kill cord for laptops

#141

Post by WesolyKubeczek »

Say I'm an investigative journalist, gathering information about some bad guy embezzling all politicians that matter in a small country and doing all kinds of criminal stuff, including murders.

I'm careful. I'm using a laptop that has this kill switch. I only keep my work on this laptop, it's so sensitive.

The bad guy gets a whiff I'm digging around him. He sends armed thugs to my lair. They enter, so I pop the kill switch. "Where is the data?!", they ask me. "I don't know what you're talking about!" They beat me down, then one thug says to the other: "Hey comrade, look, maybe it's all on this laptop?" — "Let's see". The laptop doesn't boot. They turn to me: "Funny how this laptop of yours doesn't even boot, why would you have a non-working toy?" I play dumb, they train their guns on my head. "Okay, okay," I say, "the data on this laptop has self-destructed, you're not getting it, no one is getting it!" — "Really?" — "Really!" — "It's good, motherfucker," says the thug and double-taps me in the head.

Re: BusKill – A USB kill cord for laptops

#143

Post by amiga-workbench »

intrasight wrote: post #122

https://news.ycombinator.com/item?id=21935359 I vaguely remember there being special hard drives with an "acid release" tab for rapid physical destruction. The military being a prime consumer. For laptops, I'm thinking a Thermite kill switch would be effective.

I've seen thermite tested, its absolutely not enough to damage disk players.

Re: BusKill – A USB kill cord for laptops

#144

Post by MayeulC »

hef19898 wrote: post #92
V__ wrote: post #69

Earlier quoted context omitted.

I always thought that a lock screen with two passwords would be an interesting idea. Say the BusKill locks your system and sends a request to a server. If you don't enter the correct password to abort the script within a few seconds, it will run on your server, which sends a distress mail/call to emergency contacts, revoke all ssh keys/passwords etc. If however the distress password gets entered, the script still run…

Disclaimer: I know next to nothing about OS'es and login and so on. I had an idea once, would it be possible to set up two sets of passwords? One to properly unlock your device, and one to trigger either encryption or scrambling of the data when entered?

Of course, this is a kill switch, but that's usually detectable if the attacker is sophisticated enough. Plus, they can always backup the disk before.

Plausible deniability lets you pretend you do not have incriminating data, but it's tricky to use in the first place: https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyA...

Travelling with an empty disk seems like a more appropriate option. Dm-verity could probably be used to check that there has been no tampering.

Re: BusKill – A USB kill cord for laptops

#145

Post by ryanlol »

hef19898 wrote: post #92
V__ wrote: post #69

Earlier quoted context omitted.

I always thought that a lock screen with two passwords would be an interesting idea. Say the BusKill locks your system and sends a request to a server. If you don't enter the correct password to abort the script within a few seconds, it will run on your server, which sends a distress mail/call to emergency contacts, revoke all ssh keys/passwords etc. If however the distress password gets entered, the script still run…

Disclaimer: I know next to nothing about OS'es and login and so on. I had an idea once, would it be possible to set up two sets of passwords? One to properly unlock your device, and one to trigger either encryption or scrambling of the data when entered?

Of course, but this won’t be easy with commodity hardware. Standard practice is to use write-blockers to prevent this kind of tricks, but of course you can prevent write-blockers by integrating your storage.

I think you could get a pixel phone to do this in a useful way.

Re: BusKill – A USB kill cord for laptops

#146

Post by schleck8 »

Cthulhu_ wrote: post #31
schleck8 wrote: post #23

> Buy with Monero I bet they'd go crazy if someone accused them of this being designed for illegal activities

That's... because it isn't? How would a dead man switch be illegal? I mean it may, hypothetically, be used to hide illegal activities, but if you go that way you go down the slippery slope and will be advocating for weakening or backdooring encryption just in case it's used for illegal activites.

This is a perfect fit for darknet admins, being able to nuke all digital evidence when arrested has been a thing for ever. Often it works by closing the laptop.

It might also be useful for whistleblowers, although I doubt that there is any advantages over strong file and disk encryption.

Re: BusKill – A USB kill cord for laptops

#147

Post by tjader »

marcodiego wrote: post #129
lmilcin wrote: post #86

Earlier quoted context omitted.

The combo solution is not good enough, especially if you are in public. If you can be observed to use the combo (which you would have to be using regularly) somebody else could be pressing the combo or they could insert USB device that can generate the combo regularly. I would also add that locking your laptop is not safe enough if you are serious about this. There are devices that can exfiltrate information from wha…

> There are devices that can exfiltrate information from what I understand almost every operating system through USB. If that is true, then it is a vulnerability. You should file bug reports.

How will you prevent a USB device to present itself as both a keyboard and mass storage and then type commands that copy data?

Re: BusKill – A USB kill cord for laptops

#148

Post by nefitty »

hef19898 wrote: post #92
V__ wrote: post #69

Earlier quoted context omitted.

I always thought that a lock screen with two passwords would be an interesting idea. Say the BusKill locks your system and sends a request to a server. If you don't enter the correct password to abort the script within a few seconds, it will run on your server, which sends a distress mail/call to emergency contacts, revoke all ssh keys/passwords etc. If however the distress password gets entered, the script still run…

Disclaimer: I know next to nothing about OS'es and login and so on. I had an idea once, would it be possible to set up two sets of passwords? One to properly unlock your device, and one to trigger either encryption or scrambling of the data when entered?

In software, where there's a will, there's a way.

Darknet Diaries has a cool episode about the dark cellphone industry: https://darknetdiaries.com/episode/105/

Re: BusKill – A USB kill cord for laptops

#149

Post by paulcole »

martin_a wrote: post #117
paulcole wrote: post #95

Earlier quoted context omitted.

> Would you feel fine paying around 100 bucks to... well... whom? I’d feel fine deciding if I feel fine. That’s also why I have a credit card. I can get scammed and not be out $100.

Ok, so you get the item and it explodes in your face. Whom do you sue?

Probably nobody!

Re: BusKill – A USB kill cord for laptops

#150

Post by doubled112 »

dotancohen wrote: post #127
gruez wrote: post #109

Earlier quoted context omitted.

>Epoxy over the screw terminals would also delay an attacker... Might as well go all in and epoxy the ram sticks/dimm slot assembly.

Aren't they already soldered in place in modern laptops?

Many laptops but not all laptops.

I've noticed many lower end have one soldered and one removable. Drives me crazy because then you end up with more RAM but less performance, so have to choose which hit is worse.

Post reply on HN