A dead man's switch for your computer?

http://blog.viktorpetersson.com/post/108852454049/a-dead-mans-switch-for-your-computer

by mvip • 12 years ago

129 72 12 years ago

blog.viktorpetersson.com

falcolas• 12 years ago

Tails, a "Live CD" operating system which relies on Tor for all communication, does something like this at the OS level: If the media you are running Tails from is removed, the OS immediately writes over itself in RAM and shuts the system down.

Still capable of being worked around, but looking into that may help identify how to best implement a dead man's switch.

mayoff2• 12 years ago

I thought about this too when I read about how the FBI seized Ulbricht's laptop. I decided that a simple string isn't sufficient. You want the loop to be either a conductor or fiber optic, so that the system can detect when the cord is cut (not just when a USB device is pulled out).

jasonl99• 12 years ago

How about a lanyard that has a magnetic connector (like Apple charging ports). So it just a small amount of force to disconnect, but easy to stick back together if you forget it was there when you got up to visit the rest room.

Another thought, what about a little coin-sized watch battery device that does bluetooth low-energy. Press a button it locks your computer (or triple click wipes something, etc).

MichaelGG• 12 years ago

You should use the scenario of a pair of strong, well trained soldiers physically holding you or otherwise preventing you from performing actions. So anything requiring being aware that you're being raised then doing something like triple click might not be feasible.

I think a system would need to highly tend towards false positives, giving you a short ~5 second grace period to perform some positive challenge that things are OK.

And if this means that every day you end up accidentally having to reboot and start up Tor, well small price for physical security. But really, you should be far more focused on getting your online opsec right so you don't have to worry about thugs. If they're physically grabbing you it's very likely game over.

One countermeasure would be to find people and pay them anonymously to look like you. That is, proxy through their laptop, maybe even have them do some lightweight writing or chatting. Use their life details to leak things, like about weather or other local goings on. Essentially using them as a canary. If they get tackled, you know it's time to burn everything and hide.

mayoff2• 12 years ago

A lanyard with a magnetic connector doesn't suffice. If the enemy cuts the cord, the magnetic connector won't release and the computer won't know anything has happened.

kator• 12 years ago

I built a program that automatically locks my OSX machine when I get far enough away from it. It uses iBeacon ranging and I have the beacon in my pocket. Debated on sharing with others but I never managed to clean it up enough to be proud of sharing it.

icebraining2• 12 years ago

There's a program for Linux that does the same, but using your phone (or other Bluetooth device) called blueproximity. It had a slight tendency for false positives, though - sometimes it locked the screen even with the device less than a meter away.

taltman1• 12 years ago

I used blueproximity successfully with my Linux laptop. I bought the smallest bluetooth headset I could find ($25), removed all extraneous parts, and carried it on my person (not my bag). It was so small that I didn't notice it. Effectively like two-factor authentication for unlocking my laptop.

It's unwise to use your phone for this purpose, because a phone and laptop might both be swiped if you're not holding on to both. This has happened to folks at cafes or on mass transit in the Bay Area.

Alupis• 12 years ago

I had a laptop once that for some reason wouldn't use the battery even on a full charge. So, naturally, as soon as the power cord was pulled out, the laptop crashed.

Would make for a pretty good DMS; being deceiving with a battery attached and the OS reporting a full charge.

I wonder if there's a way to modify the mainboard (knife a lead or something) to be incapable of using the battery while still charging and the OS still being able to get reporting data.

Plough_Jogger• 12 years ago

Carrying a beacon in your pocket seems like a really impractical solution if you own a smartphone.

stinos• 12 years ago

Even then I would still consider it somewhat impractical as it means battery dead = computer locked. And depending on how it's programmed: forgot beacon/phone = computer locked.

k-mcgrady• 12 years ago

Just a guess but it would surprise me if his phone isn't the beacon.

bigbugbag3• 12 years ago

For this to work as a dead man switch, it will have to trigger the lock the instant there's two of that signal. Otherwise one simply has to sniff bluetooth then copy your signal.

pjc50• 12 years ago

Bluetooth is cloning-resistant if done properly; communications are encrypted and devices authenticated.

kitd• 12 years ago

Windows 7 + allows you to select a bluetooth device as the locking device for proximity detection.

rndmize• 12 years ago

I believe there was a post just yesterday for a piece of software that would lock and unlock your machine based on proximity to your phone through bluetooth.

Found it: https://news.ycombinator.com/item?id=8917992

thaumaturgy3• 12 years ago

Only MacOS/iPhone though.

robotkilla• 12 years ago

A bit different but I've considered releasing all of the stuff i own, certain accounts etc. into the public (or into the hands of some trustee) after i die + some specific period of time. I would need to automate everything i have and that task is daunting for something I wouldn't even get to enjoy.

Retra• 12 years ago

I was thinking of a voice-activated command that locks the UI while it nukes everything. But while this is happening, it keeps a safe image of the desktop up with basic mouse functionality, so the user doesn't know it is doing anything for a little while.

Of course, I have no use for such a thing, so I would never waste my time implementing it...

thaumaturgy3• 12 years ago

What you want is an RFID keyfob/detector. There used to be a writeup on a homebrew version of this at http://hackaday.com/2013/09/07/hidden-rfid-reader-locks-work... -- but the link that article references is rotten now. A sufficiently motivated person should be able to dig up instructions somewhere.

A few years ago there were companies that did this for most operating systems, and fairly inexpensively too, but I'm having trouble finding them now.

bigbugbag3• 12 years ago

Anything rfid can easily be duplicated.

padelt• 12 years ago

A simple readonly RFID tag - agreed. But think "smartcard with wireless power transmission" like [1]. These should be able to ensure cryptographically secure communication and identification. At least MitM-attacks without physical access to the card should be unfeasible, right?

[1] http://en.wikipedia.org/wiki/Contactless_smart_card#Security

literalusername• 11 years ago

https://www.youtube.com/watch?v=IIEdExAOXf0

https://github.com/kristoffer-marshall/XScreensaver-RFID-Unl...

Anyone who may be logged on to multiple TTYs should prefer `vlock -an` over `xscreensaver-command --lock`.

ipsin• 12 years ago

Independent of, and in addition to, other locking schemes, how about an active process that monitors for either high acceleration (the laptop being moved) or noise above a certain threshhold?

dougb• 12 years ago

You could use code from here on a Mac, http://osxbook.com/book/bonus/chapter10/ams2hid/ It would probably be best to have multiple triggers.

lgeek2• 12 years ago

I remember writing a script at some point to lock the screensaver in case of high acceleration or if the laptop is tilting by more than a few degrees. The idea was to lock it if was snatched (or just moved around).

However, that would only be effective against a petty thief and not against a forensic team. In that case you'd probable want to additionally flush the filesystems (if you care about data integrity in case of a false positive), overwrite the encryption keys in memory (maybe on disk as well, but then there's no coming back without a backup) and shut down. I wonder if the init scripts prompting for the password, cryptsetup and the LUKS subsystem have been designed to always overwrite copies of the entered password and decrypted keys ASAP.

sarciszewski• 12 years ago

It turns out that this has already been made before.

https://github.com/defuse/swatd

mirimir3• 12 years ago

Using dm-crypt/LUKS, there's a very fast and total wipe to execute when sensors fail.

Let's assume that /dev/sdb1 is the LUKS volume. First backup the LUKS header: "cryptsetup -v luksHeaderBackup --header-backup-file=/tmp/LUKS-header /dev/sdb1". Then encrypt (gpg -c) the LUKS-header, and anonymously stash a few copies online. This is the weak point. You must remember where at least one of them is, and also remember the passphrase.

When sensors fail, swatd runs "head -c 1052672 /dev/urandom > /dev/sdb1; sync; shutdown -P now".

To recover, you would just boot into initramfs, restore the LUKS header, and reboot.

wyldfire• 12 years ago

'shutdown -P now' is slow, maybe 'echo b > /proc/sysrq-trigger' is more effective. Trick is knowing when that sync is "really" done.

ryan-c• 12 years ago

Reminds me of Jacob Applebaum's udev rules for mouse jigglers: https://github.com/ioerror/udev_antiforensics

sneak• 12 years ago

This looks like useful software. His claim that it's now integrated into systemd is not supported by the patch he links to, though. Based on the systemd upstream patch, it looks like it just locks if a certain manufacturer of forensics tools are connected. The github repo you've linked locks the screen on any USB HID attachment, which seems much safer.

vezzy-fnord• 12 years ago

Dual Core (nerdcore rapper) wrote a bunch of anti-forensics scripts a couple of years ago, some quite kooky, which he presented at DerbyCon. Talk is worth watching [1], and the code [2].

[1] https://www.youtube.com/watch?v=i3nLrJrkYOc

[2] https://github.com/int0x80/anti-forensics

brudgers• 12 years ago

While a dead man failsafe is a good idea - facial recognition would be my preference for situations like that described in court, the bigger issue is compartmentalization. Whole disk encryption sounds good, but the flip side is whole disk decryption and that doesn't sound so good and didn't work out well when it mattered.

Based on the testimony everything was encoded from the same one time pad so to speak. That kinda' misses the point of one time pads.

Anyway enough thinking like a criminal or a spy for one day.

derekp7• 12 years ago

I like the idea of having a separate decryption device. OS reads encrypted data from hard disk, sends it over an encrypted link to your cell phone, which partially decrypts the data block (using one pass phrase), and sends it back over the encrypted link to the laptop. OS driver then finishes decrypting that block using a second key before passing it to your program. Writing back data just requires a public key, so write operations don't have to go to your cell phone. The idea is that your drive would never be fully unlocked, and the computer wouldn't ever have the full decryption key on it (neither would your phone).

Add in the always-on voice recognition that some Android phones have, and have the key wipe itself as soon as it hears "Freeze... FBI".

grimman2• 12 years ago

Which will work until that fateful day when you're watching a movie... ;)

fsk• 12 years ago

It's kind of pointless. If the police have already identified you as a target, there are too many other tactics they can use. For example, they could just set up a hidden camera that records you when you are using your PC.

IkmoIkmo• 12 years ago

Well for one this is a post in response to the Silk Road arrests in which a DMS would've saved him. Not pointless at all.

Sure over time their methods will evolve but ask Ross if he'd rather have had a DMS or not. It'd be unequivocally yes.

If your point is 'if you're a big enough target, you're pretty much fucked whatever you do given enough time' then yes that's probably true, too.

hotgoldminer• 12 years ago

If they observe the computer locking upon you removing the FD, wouldn't they induce the connection? Unless it irrevocably makes the system inoperable, I don't see this as solving for the larger problem.

mixologic• 12 years ago

This might work once, for somebody. Then law enforcement would understand what it is for, what it does, and cut the lanyard/string instead of removing the usb stick before apprehending the device.

hayksaakian• 12 years ago

Which is probably why the author mentioned wearables with Bluetooth.

Less conspicuous, and no strings to cut.

bigbugbag3• 12 years ago

and way easier to workaround, nothing to cut simply duplicate the wireless signal.

tomphoolery• 12 years ago

If the the computer loses connection to the device, it auto-locks.

If there are any Apple product developers listening, I'll definitely buy the next iPhone if part of its feature set is that as long as the phone is on and in my pocket, I never have to type in a password to unlock my computer(s). It would be even better if that feature was extended to developers so any developer could use the fact that my phone is in close proximity to my computer as grounds for successful authentication.

bentcorner• 12 years ago

https://news.ycombinator.com/item?id=8917992

wongm• 12 years ago

To me a simple 'device proximity' check described in the article would not work if an adversary forced you to remain near the computer.

A 'vigilance control' device would work as intended in these cases - a message is issued to the user (possibly via covert means), and failure to respond locks the device:

http://en.wikipedia.org/wiki/Dead_man%27s_switch#Vigilance_c...

avinassh• 12 years ago

I remember reading about that if HDD can be put in a magnetic field, it will be destroyed. If my door/passage can be set to generate magnetic field enough to destroy HDD, then as soon as authorities take out the computer out of your home, the HDD will be destroyed.

But I have no idea how practical is this.

grimman2• 12 years ago

You'd practically need an MRI machine to get any real effect.

DanBC• 12 years ago

That's also part of the fiction book "Cryptonomicon" by Neal Stephenson.

Looking at conventional hard drives we see pretty strong magnets a few CM away from the platters so you'd need something freaking huge to wipe the drives passing theough a doorway.

dagw2• 12 years ago

You probably read about it in Cryptonomicon (I know that's where I read about it), but I don't know if Stephenson made it up or not.

As to practically It seems quite unfeasible. First of all since magnetic forces fall off according to the inverse square law, you're going to need a seriously large magnet to for it work at say 1 meters distance or so. You're basically going to have seriously retrofit your entire house, and it's going to be very hard to hide. Secondly and more importantly even the most powerful commercial hard drive degaussers require that the drive be in contact with the magnet for up to 10 seconds to guarantee that all the data is erased, so someone just walking through a door isn't going to be in the field for anywhere near enough time.

verytrivial• 12 years ago

Unless you can get your hands on a powerful magnetic monopole, the field falls off with the inverse CUBE of distance. (Note: noone has so far managed to get their hands on a magnetic monopole, powerful or otherwise.)

mark_integerdsv• 12 years ago

As others have noted: Cryptonomicon.

...but that basic idea did give me another one: electromagnets on a separate circuit inside the drive enclosure or laptop body.

Fail to pass a security check on schedule and the circuit is engaged, destroying the HDD.

I'm no hardware wizz although I did make a motor out of a nail and copper wire once.

kefka2• 12 years ago

Well, you could just use a solenoid to actuate and make lots of metal contacts. Or you could use some sort of iron filing injection system that litters iron everyone in the computer.

The problem then is false positives. Only 1 mistake and kablooie.

poopsintub• 12 years ago

I'm pretty sure I saw this on one of the CSI tv shows.

captainmuon• 12 years ago

As a student, I visited the High Field Laboratory in Dresden (Germany). They have one of the stongest magnets in the world, I think it was 80-100 Tesla, and supposedly stronger than a similar one in Los Alamos (although the one in Dresden could only be powered up once, and would vaporize immediately). The whole setup was surrounded by ~3m thick concrete walls.

And right next to the magnetic coil, behind a small blast shield, was an old PC... an early 90s beige box looking like a 486 or early pentium, controlling some measurement equipment.

We asked how that worked, and whether there are any problems with "EMP" with the hardware or the hard disk. The answer was, no, the PC works fine. But you have to be extremely careful not to leave any screws or screwdrivers around, because "above xxx T/m field gradient, iron starts to fly", as evidenced by lots of scratches on the concrete.

lurkinggrue2• 12 years ago

Not the case with SSD.

fit2rule• 12 years ago

Everyone has their own unique heartbeat signature. What we need is a way to hear that heartbeat, and if its not the right signature: erase/destroy/etc.

kefka2• 12 years ago

I think you're on to something there. Biometrics might be the way to go here, but is difficult in implementation.

First security in layers is the best option.

1. USB HID watcher that shuts down system when plugged in. If we use a mouse, we can exclude that. But any other HID, shutdown -r now.

2. Fingerprint scanner. It's not foolproof, but does make duplicating fingerprints a pain if you dont cooperate. And jailcells usually have concrete. No more fingerprints :)

3. Most laptops have webcams built in. I'm looking in OpenCV FaceRecognizer class to see how it works, and if it's viable for fingerprinting a user. We could also do other checks, like 3d facial recognition over multiple video frames.

4. We could also potentially use the accelerometer built in laptops. When others have made a sshd knock script, we could provide a knock script to the physical device.

5. Lock on ac power removal. Simple and effective, unless the enemy has AC separation tools.

There's a few ideas. And of course, mix in live filesystems in ram, or virtualbox funniness, and you're in business.

jamies888888• 12 years ago

This would be a better concept if it just used your mobile phone proximity over Bluetooth.

Jekyll• 12 years ago

I don't know if I'm missing something here... but what's wrong with running your laptop directly off the mains without a battery and unplugging the cord if necessary so the computer shuts down?

kyleknighted• 12 years ago

The concept is sound, but new MacBooks do not have removable batteries.

Pwntastic• 12 years ago

There are tools available to law enforcement that allow them to splice into a power cable and convert it to battery power while still online

edit: i found it:

http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/

lurkinggrue2• 12 years ago

Get into the habit of locking your computer the moment you move away from it?

A dead man's switch for your computer?

Related Stories