Pierluigi Paganini May 05, 2015

Criminals, activists, and whistleblowers have a new weapon dubbed USBKill in their arsenal to shut down laptops before they police start examining them.

The best way to protect data from prying eyes is to destroy them, this is the thought of criminals when law enforcement is investigating on them.

The best option for crooks it to completely wipe their electronic equipment, or make them not accessible, before law enforcement seize them to conduct a forensic analysis. The last idea of criminal crews is to use the USBKill to quickly clean their machines from any evidence that could bring them in the jail.

“In case the police comes busting in, or steals your laptop from you when you are at a public library (as with Ross). The police will use a `mouse jiggler‘ [0] to keep the screensaver and sleep mode from activating. If this happens you would like your computer to shut down immediately. Additionally, you may use a cord to attach a usb key to your wrist. Then insert the key into your computer and start usbkill. If they then steal your computer, the usb will be removed and the computer shuts down immediately. Custom commands for when a usb change is observed will be implemented later. Make sure to use full disk encryption! Otherwise they will get in anyway.” explains the creator of USBKill “Hephaestos” (@h3phaestos) on github.com.

USBKill it’s basically a script that once put it in thumb drive, when plugged to a Pc forces the PC to shut down.

“USBKill waits for a change on your USB ports, then immediately kills your computer”, “The police will use a mouse jiggler to keep the screensaver and sleep mode from activating, “If this happens you would like your computer to shut down immediately.” continues Hephaestos.

The author also said that more command and capabilities will be added. Some users are testing this tool even on VM’s and for what it looks like, it works perfectly as well.

Of course to protect data definitively it is necessary to enable full disk encryption on the machine and refuse to provide the password to law enforcement when asked it … an option that may aggravate your position.

About the Author Elsio Pinto

Edited by Pierluigi Paganini

(Security Affairs – USBKill, forensic)