Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

61–70 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#61

"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?

How about a bluetooth dongle in your pocket? Less visible, and unless there hostiles know about it, they will separate you from the computer. A phone could work. An apparent car key would be better. Best would be a piece of clothing, like a belt.

That would work great for half an hour, until your Bluetooth connection drops for no reason, the dongle pairs with your car or phone instead, decides it's a headset now, or one of the hundred other things that inevitably go wrong with Bluetooth.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#63
post #14

Earlier quoted context omitted.

"To prevent Ulbricht from encrypting or deleting files on the laptop he was using to run the site as he was arrested, two agents pretended to be quarreling lovers. When they had sufficiently distracted him, according to Joshuah Bearman of Wired, a third agent grabbed the laptop while Ulbricht was distracted by the apparent lovers' fight and handed it to agent Thomas Kiernan. Kiernan then inserted a flash drive in one…

> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?

You can present yourself as a standard file system or some device you know has a known exploit in the driver on the other side. Then on the USB 'drive' side you have a full out arm CPU. It can issue commands too as it is connected to the serial bus. Many USB drives already have small embedded CPU in them.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#64

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

I doubt there is a need to open the case for a sophisticated attacker. If there is even the slightest opening for air you can run camera optics and freeze spray tubes to RAM I would imagine.

This is why security-sensitive devices are often encapsulated and potted in epoxy or similar.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#65

Earlier quoted context omitted.

In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.

Hidden operating system is the way to go. Usbkill turns the machine off, when asked you supply the public password.

Investigators will say "you sent this email to your dad at 09:29 on Tuesday, yet it wasn't sent from your phone or laptop according to device logs. You either have another device you haven't given us, or you haven't decrypted the right partition".

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#66
post #61

Earlier quoted context omitted.

How about a bluetooth dongle in your pocket? Less visible, and unless there hostiles know about it, they will separate you from the computer. A phone could work. An apparent car key would be better. Best would be a piece of clothing, like a belt.

That would work great for half an hour, until your Bluetooth connection drops for no reason, the dongle pairs with your car or phone instead, decides it's a headset now, or one of the hundred other things that inevitably go wrong with Bluetooth.

hehe, Do not think like an engineer in this case. Think like someone who only has to get it right once but can try 100 times. So even if you have a flake connection. Just so long as it works that 'one time'. You are good.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#68

Obligatory $5 wrench comment: https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?

Can we please stop endlessly repeating this? Life is much more complex than that.

A small laptop, a phone or a tablet can be stolen from you while powered on and unlocked by a simple thief that has no intention, nor ability, to capture and torture you.

The thief could then quickly hand the device to other people that flash it and sell it in a different country. But first they might extract any valuable data.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#69
I really like this concept.

That's why I've made similar projects. One to detect when USB storage devices get attached to domain workstations, and email the administrator with device and user info..... https://github.com/zelon88/Workstation_USB_Monitor

And one which detects USB HID devices, confirms them, and notifies the administrator..... https://github.com/zelon88/Rubber_Ducky_Defender

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#70

> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.

I just disable all hotplugging support in my OS. Anything plugged into the machine must be manually mounted, enabled, etc. This works really great for me as it's rare that anything is attached to this machine other than the charger.
Post reply on HN