"Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill." This line particularly caught my eye. I wonder what's the percentage of people (I'm presuming people working in security or those who are trying to avoid detection) go to this extreme? Is is even extreme?
How about a bluetooth dongle in your pocket? Less visible, and unless there hostiles know about it, they will separate you from the computer. A phone could work. An apparent car key would be better. Best would be a piece of clothing, like a belt.
Usbkill – anti-forensic tool to halt computer when new USB device is connected
61–70 of 195 posts
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#62Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#63Earlier quoted context omitted.
"To prevent Ulbricht from encrypting or deleting files on the laptop he was using to run the site as he was arrested, two agents pretended to be quarreling lovers. When they had sufficiently distracted him, according to Joshuah Bearman of Wired, a third agent grabbed the laptop while Ulbricht was distracted by the apparent lovers' fight and handed it to agent Thomas Kiernan. Kiernan then inserted a flash drive in one…
> Kiernan then inserted a flash drive in one of the laptop's USB ports, with software that copied key files. How exactly does this work? Is there a sort of software that runs automatically when you insert the stick, or did he have to click on it?
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#64Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…
I doubt there is a need to open the case for a sophisticated attacker. If there is even the slightest opening for air you can run camera optics and freeze spray tubes to RAM I would imagine.
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#65Earlier quoted context omitted.
In the UK you might well be in prison for five years for refusing to hand over the keys. https://www.schneier.com/blog/archives/2007/10/uk_police_can... Not sure what the situation is now.
Hidden operating system is the way to go. Usbkill turns the machine off, when asked you supply the public password.
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#66Earlier quoted context omitted.
How about a bluetooth dongle in your pocket? Less visible, and unless there hostiles know about it, they will separate you from the computer. A phone could work. An apparent car key would be better. Best would be a piece of clothing, like a belt.
That would work great for half an hour, until your Bluetooth connection drops for no reason, the dongle pairs with your car or phone instead, decides it's a headset now, or one of the hundred other things that inevitably go wrong with Bluetooth.
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#67I thought this was https://usbkill.com/ I think maybe this would be more effective in anti-forensic because it actually destroys the computer?
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#68Obligatory $5 wrench comment: https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?
A small laptop, a phone or a tablet can be stolen from you while powered on and unlocked by a simple thief that has no intention, nor ability, to capture and torture you.
The thief could then quickly hand the device to other people that flash it and sell it in a different country. But first they might extract any valuable data.
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#69That's why I've made similar projects. One to detect when USB storage devices get attached to domain workstations, and email the administrator with device and user info..... https://github.com/zelon88/Workstation_USB_Monitor
And one which detects USB HID devices, confirms them, and notifies the administrator..... https://github.com/zelon88/Rubber_Ducky_Defender
Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected
#70> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.