Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BusKill – A USB kill cord for laptops

buskill.in

Post reply on HN
Print view View original

231–240 of 339 posts

Re: BusKill – A USB kill cord for laptops

#231

Post by dane-pgp »

XorNot wrote: post #58
shultays wrote: post #56

BusKill can trigger your laptop to lock, shutdown, or self-destruct if it's physically separated from you. I understand lock and shutdown but self-destruct? Really? Your laptop/data is one bump away from destroying itself?

Reminds me of a coworker who had their iPhone set to "wipe after 10 bad pins". Took about 2 days before their 5 year old happily typed the wrong pin 10 times and wiped it.

There should be an exponentially increasing delay for such a system, so that the phone would make you wait hours (or days) before letting you make your 10th guess. That would require the 5 year old to not get bored of the useless phone, and the owner to not find the phone (and enter the correct code) for those days too.

Also, it would make sense to include a simple proof-of-intentionality system, like the old Nokia keypad unlock feature to prevent pocket dials. The phone could prompt you to type a displayed 4 digit code before typing your actual PIN attempt, for example.

Re: BusKill – A USB kill cord for laptops

#232

Post by WesolyKubeczek »

aydwi wrote: post #154
WesolyKubeczek wrote: post #141

Say I'm an investigative journalist, gathering information about some bad guy embezzling all politicians that matter in a small country and doing all kinds of criminal stuff, including murders. I'm careful. I'm using a laptop that has this kill switch. I only keep my work on this laptop, it's so sensitive. The bad guy gets a whiff I'm digging around him. He sends armed thugs to my lair. They enter, so I pop the kill…

You joke but this might have happened already

This has happened, it was just that no technical gizmo would have saved the guy. I cannot imagine how.

In case of a corrupt government, if they wanted to lock you up, they wouldn't strictly need any evidence at all. Having a gizmo that can potentially destroy evidence is a bonus. Otherwise, they will throw you behind the bars for 18 years for jaywalking. If you had a controversial businessman and his thugs after you, destroying the evidence only means they wouldn't have to destroy it themselves after having killed you.

In any case, if you're working on sensitive stuff and you want to pretend you're writing some innocent poetry, I don't think any kind of jamesbondian device would help you look inconspicuous.

Re: BusKill – A USB kill cord for laptops

#233

Post by maltfield »

JeffRosenberg wrote: post #229
laristine wrote: post #226

Should we be concerned that no new canary notice [1] has been posted after the second canary [2], which promised to post the next one in June 2021? [1] List of canaries: https://www.buskill.in/tag/canary/ [2] https://www.buskill.in/canary-002/

> The BusKill team publishes cryptographically signed warrant canaries on a biannual basis. The canary-002 says: Status: All good Release: 2021-06-13 Period: 2021-06-01 to 2021-12-31 Expiry: 2022-01-31 EDIT: Oh, the issue is just that they failed to update the wording of: "We plan to publish the next of these canary statements in the month of June 2021." Looks like a copy from canary-001.

Ah, crap, sorry about that.

I'll try to remember to update the verbiage of that lower line to reference the top line to prevent this from happening again in the future.

Thanks for pointing it out!

Re: BusKill – A USB kill cord for laptops

#234

Post by Linosaurus »

gambiting wrote: post #87
V__ wrote: post #69

Earlier quoted context omitted.

I always thought that a lock screen with two passwords would be an interesting idea. Say the BusKill locks your system and sends a request to a server. If you don't enter the correct password to abort the script within a few seconds, it will run on your server, which sends a distress mail/call to emergency contacts, revoke all ssh keys/passwords etc. If however the distress password gets entered, the script still run…

Truecrypt had this exact function - one password would decrypt your drive sort of on one end, and start the OS there, another password would decrypt the drive on the other end, and start the OS installed there - so you always had perfectly plausible deniability, since the drive taken as a whole looked like a completely normal encrypted drive(in fact you could accidentally destroy the hidden partition by overwriting "…

> perfectly plausible deniability

The paranoid dystopian counterpart is that you cannot prove you don't have a second partition either. Might get awkward if someone decided to compel the second password on less solid evidence. If you're not actually using the feature.

Re: BusKill – A USB kill cord for laptops

#235

Post by dehrmann »

pmorici wrote: post #151
zionic wrote: post #102

Earlier quoted context omitted.

Wouldn't it make sense to remove the battery on your laptop entirely? With a modified magsafe-like power cord any attempt to grab the machine hard-kills the system and RAM begins degrading immediately. Epoxy over the screw terminals would also delay an attacker long enough to prevent freezing the RAM with compressed air to try and dump RAM via an exploit kit.

Devices to transfer from wall power to battery backup for transport have existed for a long time. https://wiebetech.com/products/hotplug-field-kit/

Seinfeld had a "rogue electrician" named Slippery Pete who could do this.

Re: BusKill – A USB kill cord for laptops

#236

Post by acoard »

2Gkashmiri wrote: post #142

would have immensely helped dread pirate roberts

Dread Pirate Roberts did have a kill switch. The FBI agents distracted him by having two pretend to be a couple fighting. He turned his head to watch. Then the other FBI agent beside him swiped his laptop. Theoretically he could have hit the kill switch before turning to gawk at a lovers quarrel, but I mean, not many have the opsec or personal discipline to do that.

Re: BusKill – A USB kill cord for laptops

#237

Post by BrazzVuvuzela »

gruez wrote: post #113
salex89 wrote: post #51

Or, maybe just add back the Kensington Security Slot and attach the laptop to yourself/desk with a strong wire and not have your laptop yanked in the first place. I understand the first part of my idea is dead in the water, we hardly get additional ports, let alone a slot hardly anyone will use. But I would like to see a way to retrofit a KSS on a laptop.

>Or, maybe just add back the Kensington Security Slot and attach the laptop to yourself/desk with a strong wire and not have your laptop yanked in the first place. They could still yank you . It would pretty hard for you to execute the self destruct sequence after the undercover fbi agent knocked you over from your chair.

You could tether the kill cord to your belt loop.

Re: BusKill – A USB kill cord for laptops

#238

Post by dane-pgp »

WesolyKubeczek wrote: post #232
aydwi wrote: post #154

Earlier quoted context omitted.

You joke but this might have happened already

This has happened, it was just that no technical gizmo would have saved the guy. I cannot imagine how. In case of a corrupt government, if they wanted to lock you up, they wouldn't strictly need any evidence at all. Having a gizmo that can potentially destroy evidence is a bonus. Otherwise, they will throw you behind the bars for 18 years for jaywalking. If you had a controversial businessman and his thugs after you,…

> if you're working on sensitive stuff and you want to pretend you're writing some innocent poetry

For plausible deniability, you need a second account on the machine that has all your poetry in. Then, when the thugs (or border guards) tell you to log into your laptop, you use the other username and password and say "Feel free to read all this poetry. I'm particularly proud of the one called 'My government isn't corrupt at all'."

Also, in this scenario, you should probably store your raw information (with the names of innocents redacted) in a public cloud somewhere outside your jurisdiction, encrypted, and have a time-based dead man's switch (hosted somewhere else) which sends an email to your colleagues containing the URL and decryption key.

Re: BusKill – A USB kill cord for laptops

#239

Post by new_stranger »

WesolyKubeczek wrote: post #141

Say I'm an investigative journalist, gathering information about some bad guy embezzling all politicians that matter in a small country and doing all kinds of criminal stuff, including murders. I'm careful. I'm using a laptop that has this kill switch. I only keep my work on this laptop, it's so sensitive. The bad guy gets a whiff I'm digging around him. He sends armed thugs to my lair. They enter, so I pop the kill…

You're confusing attacks. What you describe is very useful when there is not threat to your being. You just want the data gone.

However, if you are under physical threat then this is still useful because 1) you can protect witnesses and others and 2) you can make forwarding this information to remote sources part of the self-destruct.

That is, "Sorry, I no longer have the data - the laptop self-destructed. The data and my name and location have been posted to reddit publicly or sent to a list of contacts in six countries"

The point is, they want 1) you to stop and 2) to recover the data. You can bargain for your life by setting up the actions taken should this be activated.

Re: BusKill – A USB kill cord for laptops

#240

Post by Symbiote »

maltfield wrote: post #211
martin_a wrote: post #18

Maybe I'm "spoiled" because in Germany there's a need to publish an imprint on all websites that are somehow "commercial" (having ads on it would be enough), but this is highly "dubious". No contact information (as in "who runs this?") is provided on the site. Privacy policy is not GDPR compliant (no contact information provided), no names, nothing. This might be fine for a personal blog, but for doing business this…

Hi martin_a, I'm Michael Altfield. I started the BusKill project in January 2020 with the following article on my blog: * https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-k... The above article front-paged on Hacker News, and I got a lot of people asking me how they could buy one and use it in on Windows and MacOS. Over the past year, many people have contributed in porting it to those platforms (I original…

I'm not familiar with the German rules, but GDPR Art. 14 §1 says:

> Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

> (a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

Usually, these contact details are in the privacy policy.

It's certainly unusual for a website to omit this, and in most cases I wouldn't buy from a site where it's missing. In this particular case, maybe it's less strange.

However, I still wouldn't order without knowing from where the package will be sent. Something from Estonia arrives here without any import taxes, something from outside the EU can do (the CrowdSupply site says they handle VAT), but can also attract high processing fees.

https://gdpr-info.eu/art-13-gdpr/

(Note I'm not interested in buying a BusKill; I'm just procrastinating.)

Post reply on HN