Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Usbkill – anti-forensic tool to halt computer when new USB device is connected

github.com

Post reply on HN
Print view View original

71–80 of 195 posts

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#71

Post by InsomniacL »

raxxorrax wrote: post #58

> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.

how would you authenticate the USB stick that is allowed though? Without some sort of authentication mechanism an attacked could clone the device id of an allowed device. better than nothing though! :)

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#73

Post by captainmuon »

_kbh_ wrote: post #19
captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Memory encryption technologies such as AMD's Secure Encrypted Memory (SME). Would be your best bet to combat this, along with other anti-evil maid protections. https://en.wikichip.org/wiki/x86/sme#Overview https://www.qubes-os.org/doc/anti-evil-maid/

There are also things like TRESOR [1] which keep all encryption keys inside the CPU. I'm not sure what the current state of the art is.

There are so many possible evil maid attacks that I think it would be useful to add a pysical layer, just in case.

[1] https://en.wikipedia.org/wiki/TRESOR

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#75

Post by giomasce »

dividedbyzero wrote: post #37
numlock86 wrote: post #25

Obligatory $5 wrench comment: https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?

In many places, law enforcement will pressure but not torture you to provide decryption keys, maybe imprison you for a while, fine you, ... But that may be preferable than them knowing about all those highly illegal nuclear doomsday space arms technology knowledge deals you've brokered, or that collection of child porn, or those detailed assassination plans, or whatever. Maybe the authorities suspect something, maybe…

Also, you can decide to reveal your secret after having discussed the matter with a lawyer.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#76

Post by alfiedotwtf »

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Back in the BBS days, there were textfile describing how to wire your beige box to either turn on strong magnets or ignite termite if a case was detected.

... I don’t know of anyone actually implementing this though :)

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#77

Post by the8472 »

InsomniacL wrote: post #71
raxxorrax wrote: post #58

> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.

how would you authenticate the USB stick that is allowed though? Without some sort of authentication mechanism an attacked could clone the device id of an allowed device. better than nothing though! :)

There's the USB Authentication Protocol where devices identify themselves through digital signatures. But i don't know whether each device has a unique ID or its one cert for the whole production series.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#78

Post by numlock86 »

ex_amazon_sde wrote: post #68
numlock86 wrote: post #25

Obligatory $5 wrench comment: https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?

Can we please stop endlessly repeating this? Life is much more complex than that. A small laptop, a phone or a tablet can be stolen from you while powered on and unlocked by a simple thief that has no intention, nor ability, to capture and torture you. The thief could then quickly hand the device to other people that flash it and sell it in a different country. But first they might extract any valuable data.

> Life is much more complex than that.

> [...] a simple thief that has no intention, nor ability, to capture and torture you

By your comment I assume you live in a developed country and/or are not within a regularly oppressed minority, which of course, is a nice privilege. Sadly not everyone is that lucky and torture over something simple as $1 online transactions is pretty real.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#79

Post by darkwater »

kawsper wrote: post #53
darkwater wrote: post #15

Earlier quoted context omitted.

I think you would at least add an allowlist of safe (i.e. owned by you) USB ids you don't want to shut your pc/laptop down if connected

Your script can have the allowlist so you don't have to fiddle with udev everytime you introduce or retire USB-devices.

But then it's not a oneliner anymore, and the original project starts to make sense.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#80

Post by Asmod4n »

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Chenbro makes cases with intrusion detection, bought one nearly 20 years ago and they still make similar ones: http://www.chenbro.com/en-global/products/TowerServerChassis...
Post reply on HN