Earlier quoted context omitted.
"To prevent Ulbricht from encrypting or deleting files on the laptop he was using to run the site as he was arrested, two agents pretended to be quarreling lovers. When they had sufficiently distracted him, according to Joshuah Bearman of Wired, a third agent grabbed the laptop while Ulbricht was distracted by the apparent lovers' fight and handed it to agent Thomas Kiernan. Kiernan then inserted a flash drive in one…
> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?
Usbkill – anti-forensic tool to halt computer when new USB device is connected
21–30 of 195 posts
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#22"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?
How about a bluetooth dongle in your pocket? Less visible, and unless there hostiles know about it, they will separate you from the computer. A phone could work. An apparent car key would be better. Best would be a piece of clothing, like a belt.
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#23I dont understand. Is USB just always insecure because of hardware?
Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…
Is this possible with Linux?
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#24Earlier quoted context omitted.
> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?
On Windows, autorun.inf. This technique has been around since at least the 90s when CD-ROM drives were introduced to PCs... it is how a newly inserted CD (and later usb disk) can automatically execute software on insertion: https://www.instructables.com/id/Autorun-anything-off-of-a-u...
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#25Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#26Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…
Here's details of this attack for people who want more details https://citp.princeton.edu/our-work/memory/ If memory serves correctly they achieved the best results by using a can of compressed air to freeze the ram in place before removal. //Small edit to wording
It's a matter of being more determined than your attacker. Imagine a device that will irretrievably brick itself if tilted more than a certain angle, if left unpowered for more than a certain time, etc. and that has to be under constant guard. This seems almost incompatible with any kind of personal use. And some measures may only work in one instance, with the attacker planning for them the second time they have an operation.
Many attackers also don't have the same restrictions the police has. In the Ulbricht case the police may have been forced to use a device that copies the data with no human intervention just to preserve the chain of evidence and not have suspicions that the agent operating the laptop altered it while installing additional software. An attacker operating in the grey/dark area might just immobilize the user, snip the wrist cable, and then retrieve the necessary data either directly at the console or by siphoning it via the network. Or the police may just start video recording in great detail every step from the moment an agent touched the laptop until the data was exfiltrated to remove suspicions of tampering.
But such a tool would be of great effect against an undetermined, unsophisticated attacker committing a crime of opportunity.
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#27Earlier quoted context omitted.
"To prevent Ulbricht from encrypting or deleting files on the laptop he was using to run the site as he was arrested, two agents pretended to be quarreling lovers. When they had sufficiently distracted him, according to Joshuah Bearman of Wired, a third agent grabbed the laptop while Ulbricht was distracted by the apparent lovers' fight and handed it to agent Thomas Kiernan. Kiernan then inserted a flash drive in one…
> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#28Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#29Earlier quoted context omitted.
On Windows, autorun.inf. This technique has been around since at least the 90s when CD-ROM drives were introduced to PCs... it is how a newly inserted CD (and later usb disk) can automatically execute software on insertion: https://www.instructables.com/id/Autorun-anything-off-of-a-u...
Autorun has been disabled by default for a long time (with good reason). And it has never worked with USB drives, only ones which emulated a CD drive such as U3 USB drives.
Apparently, autorun from USB volumes was enabled for XP SP2:
https://support.microsoft.com/en-us/help/967715/how-to-disab...
>Before Windows XP SP2, AutoPlay was disabled by default on removable drives, such as the floppy disk drive (but not the CD drive), and on network drives. Starting with Windows XP SP2, AutoPlay is enabled for removable drives. This includes ZIP drives and some USB mass storage devices.
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#30I dont understand. Is USB just always insecure because of hardware?
Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…