« usbkill » is an anti-forensic kill-switch that waits for a change on your USB ports and then immediately shuts down your computer.

The project is still under development but it does work and is effective.

To run:

sudo usbkill

Why?

There are 3 reasons (maybe more?) to use this tool:

• In case the police or other thugs come busting in (or steal your laptop from you when you are at a public library as happened to Ross). The police commonly uses a « mouse jiggler » to keep the screensaver and sleep mode from activating.
• You don't want someone to install backdoors or malware on your computer or to retrieve documents from your computer via USB.
• You want to improve the security of your (Full Disk Encrypted) home or corporate server (e.g. Your Raspberry).

[!] Important: Make sure to use full disk encryption! Otherwise they will get in anyway.

Tip: Additionally, you may use a cord to attach a USB key to your wrist. Then insert the key into your computer and start usbkill. If they steal your computer, the USB will be removed and the computer shuts down immediately.

Feature List

• Compability with Linux and OS X (BSD's soon)
• Shutdown the computer when there is USB activity
• Ability to whitelist an USB device

Installation/Usage

To install run:

sudo ./install.sh

Then to enable or disable usbkill:

sudo usbkill

To add a device to the whitelist add serial numbers to the WHITELIST_SERIAL option in /etc/usbkill/usbkill_config. By default all devices are blacklisted and will shutdown when any USB is unplugged. It should be noted that the usbkill command generates from the config file at every run.

Contact

hephaestos@riseup.net - PGP/GPG Fingerprint: 8764 EF6F D5C1 7838 8D10 E061 CF84 9CE5 42D0 B12B