Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

Post reply on HN
Print view View original

151–160 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#151

Post by kibwen »

geerlingguy wrote: post #90
alfiedotwtf wrote: post #76

Earlier quoted context omitted.

Back in the BBS days, there were textfile describing how to wire your beige box to either turn on strong magnets or ignite termite if a case was detected. ... I don’t know of anyone actually implementing this though :)

I would imagine that's thermite and not termite ;) If the latter, the server would probably be okay, and it would take a very long time for the termites to damage the surrounding room enough to be a security deterrent.

Nah, it's termite. You're trying to destroy your logs, right?

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#153

Post by InitialLastName »

daffy wrote: post #33
klyrs wrote: post #27

Earlier quoted context omitted.

Speculation: It's possible to produce keyboard and mouse inputs, and also present as a storage device -- autorun isn't even necessary (though spurious inputs would be quite visible to somebody using the computer and something like a mirrored mouse, custom keyboard layout / shortcuts could foil this)

That would only work on a known operating system and window manager with known keyboard shortcuts, unless a terminal is already focused.

One of Atmel's USB-capable microcontrollers had a HID Keyboard example program that when you pressed a button (on a Windows host) would start Notepad (via the run command) and type "Hello, I'm an Atmel SAMXXXX".

Great bit of example code, but opens a world of possibilities for what you could do with, say, a HID + Mass Storage composite device.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#154

Post by nialv7 »

deadbunny wrote: post #125
nialv7 wrote: post #108

What's stopping the forensic people from just spoofing the USB device IDs?

How do they get the IDs?

They could just look around and see what USB devices you own. USB vendor/product IDs are not secret.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#155

Post by nialv7 »

topspin wrote: post #119
nialv7 wrote: post #108

What's stopping the forensic people from just spoofing the USB device IDs?

Nothing. And that's not the problem this program is intended to solve.

It is. The program tries to prevent use of unauthorized USB devices, yet it uses the easily spoofed USB device IDs to authenticate them.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#156

Post by sn_master »

bausano_michael wrote: post #116
sn_master wrote: post #97

"immediately terminates the connection" Reminds me of some old Firewalls that would actively poll active connections, and when one is made that violates their rules, "immediately" terminate it. Often times, an attacker can embed a lot in just a single URL in the query string (stolen passwords etc) that would be done in That's like choosing to not have a door on your house, because you know you can run fast and shoot…

I think it's aimed at scenarios in which the attacker is not aware of this utility running. Otherwise they could just kill it before inserting the USB.

Well, for attack vectors like Mouse Jiggler (I have one, very cheap on Amazon) or polymorphic USB devices, it would work if the attack is unaware of the utility's existence. For polymorphics specifically, I checked the code, and it does indeed validate the Ids of the devices, not just their count.

For others, even if the attacker is unaware of the utility, those shortcomings are still serious enough (e.g. rapid keyboard typing).

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#157

Post by [deleted] »

nialv7 wrote: post #155
topspin wrote: post #119

Earlier quoted context omitted.

Nothing. And that's not the problem this program is intended to solve.

It is. The program tries to prevent use of unauthorized USB devices, yet it uses the easily spoofed USB device IDs to authenticate them.

[deleted]

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#158

Post by close04 »

hinkley wrote: post #146
close04 wrote: post #26

Earlier quoted context omitted.

Many of the measures that provide effective physical security also make a device really unsuited for personal usage. Look at HSMs for an example of this. And even they rely on being stored in a physically secure room and protected from theft. It's a matter of being more determined than your attacker. Imagine a device that will irretrievably brick itself if tilted more than a certain angle, if left unpowered for more…

> And even they rely on being stored in a physically secure room and protected from theft. Not exactly. You don't want someone sneaking in and misappropriating the HSM to authorize something bad. And if you set the system up for unattended recovery from a power failure, then in all likelihood someone walking off with the server the HSM is in can use those keys indefinitely. But there are options. Some HSMs have self-…

> Not exactly. You don't want someone sneaking in and misappropriating the HSM to authorize something bad.

I think we're talking about exactly the same thing :). That's what I meant by "even they rely on being stored in a physically secure room and protected from theft". Despite all the hardening that is applied to the device, it must always be kept secure and supervised. As an example, this is what Safenet considers the intended installation environment should be [0].

This can't be effectively applied to a personal computer.

[0] http://cloudhsm-safenet-docs-5.3.s3-website-us-east-1.amazon...

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#159

Post by topspin »

nialv7 wrote: post #155
topspin wrote: post #119

Earlier quoted context omitted.

Nothing. And that's not the problem this program is intended to solve.

It is. The program tries to prevent use of unauthorized USB devices, yet it uses the easily spoofed USB device IDs to authenticate them.

It isn't. The problem this program solves is thwarting a naive attempt to alter the state of the USB bus. The design assumes the attacker is not aware of the consequences of adding or removing devices and has no reason to employ spoofed devices or any other Ever Greater Adversary Regression techniques you can imagine.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#160

Post by smogcutter »

portpecos wrote: post #129
waldfee wrote: post #49

Earlier quoted context omitted.

it does not solve the same problem, correct. it's still a great tool if your threat model warrants it.

Can you give an example of a threat model that would warrant it?

You’re a journalist. Source gives you a usb drive full of documents. Source is in reality hostile/compromised, so is the usb drive.
Post reply on HN