Usbkill – anti-forensic tool to halt computer when new USB device is connected • Hacker News Board

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#81

Post by SV_BubbleTime » Thu, Aug 06, 2020, 1:44 PM UTC

lozf wrote: post #50

el_oni wrote: post #17

I attended a talk by GSK and there was part of the talk about security. They don't allow usb devices to be plugged into their analysis computers. But every year they get an intern that tries to charge their phone from the PC USB. Something like this, that doesnt halt the computer but shows a warning on screen and logs information would perhaps be a solution to their problem. Although in the case of industrial espiona…

At a former gig for a post-production facility we used CoSoSys EndpointProtector to restrict USB access to workstations. Works as described in your second paragraph, (logs and warning) admin can then allow approved devices remotely if necessary.

I worked for a car mfg that had that on all their laptops. It was annoying and I’m 99% certain no one ever checked up on the alerts and instead was just logging in case there was an issue later.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#82

Post by mschuster91 » Thu, Aug 06, 2020, 1:46 PM UTC

raxxorrax wrote: post #58

> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.

> But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure.

This will not help against hardware that exploits bugs in the USB stack of the operating system.

Assuming the threat model is police or secret service seizing one's server, it is feasible that the attackers also have knowledge of the running OS (IIRC one can distinguish between Windows, Linux and xBSD by simply looking at TCP fingerprints) and thus can use a targeted exploit.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#83

Post by macNchz » Thu, Aug 06, 2020, 1:47 PM UTC

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

I have a Lenovo M93P Tiny which came with a chassis intrusion switch installed. It seems you can have it block startup/require a password when the case is opened and notify some central admin. I don’t know what happens if you open the case while it’s running, though.

I’m not sure if it’s something they offer on current models, or to individuals at all (I bought it used from a corporate IT asset liquidator so it was likely originally purchased as part of a bulk deal). Regardless it makes a great little Linux box!

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#84

Post by derefr » Thu, Aug 06, 2020, 1:47 PM UTC

pfundstein wrote: post #24

TedDoesntTalk wrote: post #20

Earlier quoted context omitted.

On Windows, autorun.inf. This technique has been around since at least the 90s when CD-ROM drives were introduced to PCs... it is how a newly inserted CD (and later usb disk) can automatically execute software on insertion: https://www.instructables.com/id/Autorun-anything-off-of-a-u...

Autorun has been disabled by default for a long time (with good reason). And it has never worked with USB drives, only ones which emulated a CD drive such as U3 USB drives.

I've always been surprised that autorun wasn't re-enabled when app stores / code signing was introduced. If Microsoft or Apple is willing to sign an installer saying that it's something safe to install, isn't that proof enough to let it run when you insert the USB key it's on?

I know this isn't really very relevant for the specific combination of installers and physical media any more, since it's rare for anyone to be trying to install something off a CD/DVD/USB these days (other than a new OS, of course.)

But I could see the use case for physical media doing something other than running an installer (e.g. DRMed disks launching the equivalent of a FUSE server to mount the "rest" of the disk); or for non-physical media (e.g. macOS DMG disk images) being able to autorun their embedded installer. Either way, the code signing that the platforms are already doing would be enough to make these safe, no?

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#85

Post by umvi » Thu, Aug 06, 2020, 1:47 PM UTC

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

> Interesting project, I'm sure this is useful for people at risk.

Could you expound on what this means? In the USA/UK, people most "at risk" of police kicking down the door seizing their laptops/computers while they are still running are child pornographers.

Perhaps this can be used "for good" under oppressive regimes (i.e. if you are a dissenting journalist) but then I think you won't get a fair trial anyway and having a kill switch just means more prison.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#86

Post by toxik » Thu, Aug 06, 2020, 1:52 PM UTC

umvi wrote: post #85

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

> Interesting project, I'm sure this is useful for people at risk. Could you expound on what this means? In the USA/UK, people most "at risk" of police kicking down the door seizing their laptops/computers while they are still running are child pornographers. Perhaps this can be used "for good" under oppressive regimes (i.e. if you are a dissenting journalist) but then I think you won't get a fair trial anyway and ha…

This is a somewhat pessimistic outlook on humanity, first off I would say that those who are most commonly at risk are those with trade secrets. Patented tech and investment intel for example.

As for the dissenters, I’m sure they would appreciate their co-conspirators remain secret.

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#87

Post by agumonkey » Thu, Aug 06, 2020, 1:54 PM UTC

raxxorrax wrote: post #58

> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.

typical social pattern:

    - nothing 
    - hard work to make something easy to use
    - hard work to make something easy to control
    - control

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#88

Post by luckylion » Thu, Aug 06, 2020, 1:54 PM UTC

alfiedotwtf wrote: post #76

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Back in the BBS days, there were textfile describing how to wire your beige box to either turn on strong magnets or ignite termite if a case was detected. ... I don’t know of anyone actually implementing this though :)

Some ideas have been tested, there was an entertaining talk a few years back at DefCon: https://www.youtube.com/watch?v=-bpX8YvNg6Y

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#89

Post by umvi » Thu, Aug 06, 2020, 1:57 PM UTC

toxik wrote: post #86

umvi wrote: post #85

Earlier quoted context omitted.

> Interesting project, I'm sure this is useful for people at risk. Could you expound on what this means? In the USA/UK, people most "at risk" of police kicking down the door seizing their laptops/computers while they are still running are child pornographers. Perhaps this can be used "for good" under oppressive regimes (i.e. if you are a dissenting journalist) but then I think you won't get a fair trial anyway and ha…

This is a somewhat pessimistic outlook on humanity, first off I would say that those who are most commonly at risk are those with trade secrets. Patented tech and investment intel for example. As for the dissenters, I’m sure they would appreciate their co-conspirators remain secret.

> This is a somewhat pessimistic outlook on humanity, first off I would say that those who are most commonly at risk are those with trade secrets. Patented tech and investment intel for example.

Can you provide any evidence at all of police or "thugs" (or anyone, really) kicking down doors to get at trade secrets being a common problem? Because there are countless news articles of police raids seizing computers to stop child porn[0].

I speculate any tool billed as "anti-forensic" will be used for immoral purposes more commonly than moral purposes.

[0] https://en.wikipedia.org/wiki/Jared_Fogle#Child_pornography_...

Re: Usbkill – anti-forensic tool to halt computer when new USB device is connected

#90

Post by geerlingguy » Thu, Aug 06, 2020, 1:59 PM UTC

alfiedotwtf wrote: post #76

captainmuon wrote: post #6

Interesting project, I'm sure this is useful for people at risk. Somewhat related, I'm wondering about the physical security of computers. There is an attack where they open your PC, take out the ram, and freeze it immediately so the bits don't decay and they can extract your encryption keys. All BIOSes have an option for cassis intrusion detection, but I've never seen a case that has the necessary cable. Has anybody…

Back in the BBS days, there were textfile describing how to wire your beige box to either turn on strong magnets or ignite termite if a case was detected. ... I don’t know of anyone actually implementing this though :)

I would imagine that's thermite and not termite ;)

If the latter, the server would probably be okay, and it would take a very long time for the termites to damage the surrounding room enough to be a security deterrent.