Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

191–195 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#191

Earlier quoted context omitted.

> [0] https://www.jwz.org/blog/2015/04/i-told-you-so-again/ Sorry for the digression, but WTF is this guy doing? Looks like he redirects all requests that have HN as the referrer to a picture of a testicle. Copy-pasting the link (i.e., dropping the referrer) seems to work, though.

Oh wow, I wasn't aware of that. Sorry about that.

Not your fault at all, I'd never expect such childish behavior from a website either.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#192
post #174

Earlier quoted context omitted.

It's funny when I think back, I was a teen in the 90s and did plenty of questionable stuff online and w/ local BBS scene (Kevin Mitnick was busted in Raleigh and many rumors existed about his presence in the BBS scene, obviously fantasy though!). Nobody I know who got arrested ever managed to destroy anything. When I think about it, we all assumed the cops would storm in when we were in the act of doing something bad…

This is how you earn tampering with evidence charges, up to 20 years felony.

Well, keep this in mind: I knew quite a few people who got interviewed with, and arrested by authorities. Everyone under the age of 18 in the 90s got a slap on the wrist because they hadn't got too good at punishing those kinds of crimes. I think the worst I saw was $1200 paid over 12 months to AT&T.

After 18, you're done, even if they can't think of a good charge, they'll make them up, which is exactly what they did back then, cross state commerce was a blanket thing to grab folks.

I stopped doing anything questionable well before I turned 18.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#193
post #174

Earlier quoted context omitted.

This is how you earn tampering with evidence charges, up to 20 years felony.

Eh, it's worth it, depending on what you're doing. I'd much rather get in trouble for a hard drive full of zeroes, than them knowing what was on it beforehand. Today, you should encrypt everything, and cut power before physical access is obtained. Will that count as "tampering"? I was just turning off my computer. No, I do not remember the key.

Looking back, federal authorities really only came when they had the evidence they needed already, and local authorities were way too far behind to know what was going on (in the 90s).

In practice, the only real protection we had (those of us in my social group) was that we were minors, and lucky that laws hadn't caught up yet.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#194
post #155

Earlier quoted context omitted.

It is. The program tries to prevent use of unauthorized USB devices, yet it uses the easily spoofed USB device IDs to authenticate them.

It isn't. The problem this program solves is thwarting a naive attempt to alter the state of the USB bus. The design assumes the attacker is not aware of the consequences of adding or removing devices and has no reason to employ spoofed devices or any other Ever Greater Adversary Regression techniques you can imagine.

After they got bitten but tools like this usbkill once, ID spoofing will just become the standard practice, and it will be made so easy to do they don't even need to think.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#195
post #112

Earlier quoted context omitted.

>Many USB drives already have small embedded CPU in them. For most common hardware this is just an 8051 variant that sets up the USB and DMA peripherals. It's easy enough to get something more powerful, but I am doubtful you'd want to reuse consumer hardware.

The 8051 is a decently capable CPU (it is the cpu at the heart of the furby toy). At one point they built whole computer ecosystems around it. Remember the point here is to take over the computer not have a full out modern OS. They USB manufactures use them because they work well on low power and are decently cheap and small. Now most usb sticks do not do much more than like you say. But that would not stop someone f…

Mfrs use them because they are not patent encumbered. There are some fairly high power 8051 clones, true. But in most applications they are barely sufficient.

In this case any kind of MCU is making life harder than it needs to be.

Post reply on HN