Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BusKill – A USB kill cord for laptops

buskill.in

Post reply on HN
Print view View original

211–220 of 339 posts

Re: BusKill – A USB kill cord for laptops

#211

Post by maltfield »

martin_a wrote: post #18

Maybe I'm "spoiled" because in Germany there's a need to publish an imprint on all websites that are somehow "commercial" (having ads on it would be enough), but this is highly "dubious". No contact information (as in "who runs this?") is provided on the site. Privacy policy is not GDPR compliant (no contact information provided), no names, nothing. This might be fine for a personal blog, but for doing business this…

Hi martin_a, I'm Michael Altfield. I started the BusKill project in January 2020 with the following article on my blog:

* https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-k...

The above article front-paged on Hacker News, and I got a lot of people asking me how they could buy one and use it in on Windows and MacOS. Over the past year, many people have contributed in porting it to those platforms (I originally just designed it for myself, and I use Linux).

The BusKill project is not owned by me. All our work is open-source, and it's owned by the community. As such, I don't put just my name on it because it's not just my work. But if you dig around, you do see my name pop-up in a few places.

The list of contributors can be found on our documentation's "Attribution" section.

* https://docs.buskill.in/buskill-app/en/stable/attribution.ht...

The main website is mostly just a landing page, blog, and a store so people can buy with cryptocurrencies and Tor since CrowdSupply doesn't run an Onion Service and doesn't accept crypto payments.

Not everyone who has contributed to the BusKill project is still active, but some of us are. You can find our names & photos at the bottom of the Crowd Supply campaign page:

* https://www.crowdsupply.com/alt-shift/buskill

Contact information is provided on the website. There's a link to it in the Footer* and on the GitHub page. Not sure how I can make that more clear:

* https://www.buskill.in/contact/

Re: BusKill – A USB kill cord for laptops

#212

Post by maltfield »

Symbiote wrote: post #50
martin_a wrote: post #18

Maybe I'm "spoiled" because in Germany there's a need to publish an imprint on all websites that are somehow "commercial" (having ads on it would be enough), but this is highly "dubious". No contact information (as in "who runs this?") is provided on the site. Privacy policy is not GDPR compliant (no contact information provided), no names, nothing. This might be fine for a personal blog, but for doing business this…

It seems to be from (or in partnership with) https://www.altshift.in/ in Estonia, leading to https://twitter.com/MichaelAltfield

Yes :) BusKill is an open-source project. AltShift is my company.

Re: BusKill – A USB kill cord for laptops

#213

Post by ComputerGuru »

MayeulC wrote: post #124
Jerrrry wrote: post #98

Earlier quoted context omitted.

Instead of a personal key combo, a dongle with an OTP code. Both the dongle and the computer have accelerometer-bump-tilt-oh-fuck-support. A OTP has to be entered every 5 minutes, or a secure screen/dead sequence starts. Sudden accelerated movements or a lack of presence-detection would also start the sequence.

I once wrote a script to automatically lock my computer if I got too far away from it, back when I was wearing a bluetooth wristband. I guess you could do the same, but shut down the computer instead.

Windows 10 does this automatically if you pair your phone to your Windows 10 PC via bluetooth. When you walk away, it locks the screen.

Re: BusKill – A USB kill cord for laptops

#214

Post by dane-pgp »

captaincrunch wrote: post #157
tbabej wrote: post #7

For the Yubikey owners out there, a while back I wrote a blog post on how to achieve a similar setup using a Yubikey [1]. All it requires is a lanyard to attach the yubikey to. [1]: https://tbabej.com/Yubikey-secure-session-setup/

Anyone needing a Yubikey would be very lucky to see them just hanging out of a computer, would just a bonus for the evil actor to also ruin your day and pull it out.

Or you could attach the Yubikey to your belt (with a clip) and connect it to the laptop with a USB cable. Then all they could steal is a useless laptop and a cheap cable.

Re: BusKill – A USB kill cord for laptops

#215

Post by reincarnate0x14 »

Ensorceled wrote: post #4
dotancohen wrote: post #3

Interesting. The site implicitly references the arrest of the Silk Road founder, using the alternative acronym "Department of Parks and Recreation". He was arrested by having his laptop literally yanked from under his fingertips in a public library.

Having a USB kill switch in this case could (would?) have escalated the arrest method to something more violent.

I can definitely see policy to tase or otherwise subdue with less than lethal means being OK'ed by authorities and judiciaries. In principle you'd hope this was rigorously established beforehand on per case basis but that historically has not been held to standard long if they end up doing it with any frequency.

This is getting into the security question of what your threat model is. If you're seriously expecting a nation-state intelligence agency to be after your laptop, I'd really, really recommend not having anything on your laptop because unless you've got your own security team they're going to find some way to get it and will observe you to see if you're using something like a killswitch first.

Re: BusKill – A USB kill cord for laptops

#216

Post by Mandatum »

zionic wrote: post #102
yholio wrote: post #77

Good to have if you run a dark net marketplace or a political disident ring from public libraries. An additional refinement is to autolock the device if a certain personal key combo (ex. Shit - vol up - vol down) is not pressed every few minutes in response to an audible click. If not unlocked in a minute or so with a complex password, the device halts to a disk encrypted state and unpowered ram, minimizing the windo…

Wouldn't it make sense to remove the battery on your laptop entirely? With a modified magsafe-like power cord any attempt to grab the machine hard-kills the system and RAM begins degrading immediately. Epoxy over the screw terminals would also delay an attacker long enough to prevent freezing the RAM with compressed air to try and dump RAM via an exploit kit.

You freeze the whole laptop.

Re: BusKill – A USB kill cord for laptops

#217

Post by jeroenhd »

Terry_Roll wrote: post #88
comeonseriously wrote: post #84

Windows: Sorry, Dave, we can't shut your system down right now, you have 3 apps keeping it from shutting down and we have 37 updates to Edge Browser to install... Have a nice day.

https://docs.microsoft.com/en-us/windows/win32/api/winuser/n... EWX_FORCEIFHUNG 0x00000010 Forces processes to terminate if they do not respond to the WM_QUERYENDSESSION or WM_ENDSESSION message within the timeout interval. For more information, see the Remarks. If the EWX_FORCEIFHUNG value is specified, the system forces hung applications to close and does not display the dialog box.

If forced shutdown is a priority, causing a bugcheck would probably be your best bet. This could be part of the USB driver for the device, or you could write a piece of software running as admin to trigger a fail state (like killing wininit or any other critical part of Windows).

You'd have to watch out that you don't let the system store a memory dump, of course, that'd be the exact opposite of what you want.

Re: BusKill – A USB kill cord for laptops

#218

Post by maltfield »

WesolyKubeczek wrote: post #126

Looks like "security LARPers" are at it again. I'd bet 99% of buyers will self destruct their laptop themselves, by accidentally bumping into the cord. And to think now, the same people are pushing the narrative how PGP is bad.

Hi, I'm Michael Altfield (Founder of the BusKill project). I'll take that bet because I'm pretty sure BusKill does not ship with destructive triggers. The current app is limited to locking your screen. Future releases will include soft/hard shutdown.

We do have a "LUKS Header Shredder" trigger (which we call self-destruct as it renders all the data on the FDE disk useless), but we (intentionally) don't include it by default and raise the barrier of entry because of the risk of data loss.

We'll be publishing a more detailed write-up on the LUKS Header Shredder in 2 weeks. You can subscribe for updates on our website (buskill.in) or the campaign directly (crowdsupply.com)

Also, while I recognize there are limits in PGP, I encourage it and actively train journalists and activists on how to use it (though I do prefer messaging solutions that make e2ee required and use PFS like Signal, Threema, Wire, etc).

Re: BusKill – A USB kill cord for laptops

#219

Post by maltfield »

pjerem wrote: post #53
Ensorceled wrote: post #5

Earlier quoted context omitted.

$89 doesn't seem that expensive. It's just as impractical as money belts, key chain alarms, Tiles(tm) I mean, too impractical for me, but there is definitely a market for it.

Well, that's something you could easily do with only software and any USB device : while { if(!monitored_device.plugged) { setComputerOnFire() } } It must exist somewhere. And for the magnetic gimmick, any magnetic usb (which, btw, are actually pretty useful) cable from amazon would do the trick.

Hi pjerem, Michael Altfield here (founder of the BusKill project).

The problem is that there are no USB-A magnetic breakaways available on Amazon. If there were, then I wouldn't have launched this campaign!

* https://buskill.in/buy

Actually, Amazon did have USB-A magnetic breakaway components before, but they went EOL and sold-out when I first published my DIY article on how to build-your-own-BusKill-cable last year.

* https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-k...

The reason I started making my own was a response to all the folks that asked me how they could get a USB-A BusKill cable since they sold-out (and they also were never available in Europe -- now they are!).

Re: BusKill – A USB kill cord for laptops

#220

Post by dane-pgp »

quesera wrote: post #188
lmilcin wrote: post #90

Earlier quoted context omitted.

Yeah, I have that on my servers in case somebody tries to hack them. There is a secret to logging to my machines and if you miss it the machine self destructs in a reversible way. Can't give more information but it is pretty easy to boot it again. One thing of note here, don't put LUKS header on any kind of flash (like SSD) or SMR HDD.

> self destructs in a reversible way Reversibility is not a feature of destruction, lexically-speaking. A better description might be "locked". More importantly in this case: if you are able to reverse it, you can be compelled to reverse it. This is no different than having a secret passphrase.

> if you are able to reverse it, you can be compelled to reverse it.

An interesting way of strengthening such a system is to split the recovery code between multiple people in multiple jurisdictions. Convincing them to hand over their piece of the key could require various levels of proof-of-free-will, ranging from "Hey, I need those numbers on that piece of paper I gave you" (asked on a video call, in a public park) to "I've booked a flight and I'll meet you at the agreed place next Monday at the standard time".

These approaches can be combined with a protocol of "If I use the duress phrase, then give me a fake key and then send a message to the other members of the group / the public / the media that I've been compromised". Of course this sort of system assumes you are part of a wider organisation or at least have friends you can trust to implement all this opsec securely, without adding to your risk profile, but for some people this will be viable.

Post reply on HN