Tuesday, March 7, 2017

USB Killers - Hardware and Software options to destroy your data (or devices)

https://www.linuxforum.com/threads/usb-killers-hardware-and-software-options-to-destroy-your-data-or-devices.2194

Every new computer, whether running Linux or not, has some type of Universal Serial Bus (USB) connector. Most electronics now come with a USB connection of some type from TVs to cars. The time has arrived to worry about what device is being placed into these connectors or even being taken out.

There are two types of problems to be dealt with in this scenario. The first is to protect your hardware and the second is to protect your data with software.

Before we start, let's look at the USB system overall.

The USB hardware started in 1996 and began at a speed around 1.5 Mbps (megabytes per second), whereas today the speed is over 10 Gbps (gigabytes per second). The current estimate is that there are around 15 billion USB devices in the world making a USB device a very common item. The main aspects of USB which make it so convenient are the following:


  • Single connector type: USB replaces all the different legacy connectors with one well-defined, standardized USB connector for all USB peripheral devices. Thus eliminating the need for different cables and connectors and simplifying the design of the USB devices. The single connector type allows all USB devices to be connected directly to a standard USB port on a computer.
  • Hot-swappable: USB devices can be added and removed while the computer is running.

  • Low-cost implementation: The USB devices are managed by the USB Host which is implemented in the PC, phone, etc. The USB devices do not require a controller built-in so the cost is minimized for USB devices.

  • Plug and Play: Operating Systems (OS) identifies, configures, and loads the appropriate device driver when a USB device is connected.

  • High performance: USB offers a variety of speeds which are increasing with each update of the USB hardware.

  • Expandability: In theory, up to 127 different devices may be connected to a single bus.

  • Bus supplied power: The USB controller supplies power to all connected devices so there is no need for external power to be supplied if the device is low-powered. High-powered devices may still require an external power source.

  • Easy to use for end user: A single standard connector simplifies the usage of the USB device.
NOTE: For a detailed listing of USB devices and hubs on your Linux system, use the command from a terminal “lsusb -v”.

The USB Host is the main component of the USB system. The Host is usually the PC in to which the USB devices are plugged. The USB Host Controller Interface (HCI) is where the Hardware communicates with the Software.

The USB system works as a Master/Slave unit, usually termed Bus Mastering. The USB Host is the Master and controls the Slave (periphery devices) setting up a communication protocol between the Host and all devices. Each Host may have one or more Host Controllers which has a port or multiple ports attached to it. The port or ports on a single Host Controller of the USB Hub called the Root Hub. From these ports, devices and hubs may be attached to create USB Bus. All devices on the USB Bus are a Slave to the Host Controller of the Root Hub, which is the Master. Two devices on the same USB Bus can only communicate directly with each other through a USB Bridge.

USB connections consist of four connection points. These points allow for power and data connections. For USB 1.0, a pin provides 5V DC power while another pin provides the return of the power to complete the circuit. USB 3.0 on the other hand provides 20 volts, 5 amps, and 100 watts through the power connection. Keep in mind the power being sent through these ports!

To give a little more information, the amps used determines how fast the power can travel through the lines. A higher amperage can allow your phone to charge faster. For example, to use a 1 amp charger on your phone may require an hour to fully charge it. If you were to use a 2 amp charger, then your phone may only take half of an hour.

The Hardware option:

Let's look at the hardware first, the USB Kill. The USB Kill device looks like a regular USB Thumb Drive. It contains a capacitor, which is used to store power. The capacitor is charged to -200V DC. Once charged, the capacitor releases the stored voltage into the USB Port. The voltage may then travel into all parts of the device destroying components along the way until the voltage is dissipated. The capacitor is charged again and releases the burst of power into the system again. This process can occur numerous times in a single second. In a PC, the motherboard can be damaged in three seconds or less.

NOTE: USB Kill 1.0 can take up to 5 seconds to cause system damage.

What this means is that any hardware which has a USB port can be destroyed with the USB Kill device. Hardware can include PCs, laptops, televisions, phones, etc. The discharge of the voltage is similar to a voltage overload or a static burst such as a nearby lightning strike. Some devices have built-in protection against such power spikes, but some may not to the extent of -200V.

Everyone should be wary of using devices which may be found or ones others may try to place into your USB Port.

The USB Kill Device can be used over and over on many pieces of hardware.

NOTE: Please do not use the device maliciously if you should happen to have one.

A USB Killer Shield can be used to protect your hardware from being destroyed by a USB Kill device. A USB Killer Shield has two connectors, one is male and the other female. The male connector is plugged into the hardware and any USB device can be plugged into the female connector. By using the shield, you are protected from a USB Kill device.

NOTE: One final piece of information is that Apple devices seem to have a built-in protection from such a device so as not to allow the hardware device to be damaged.

The Software option:

For software, there is the USB Kill program. The script is more for your protection of your data. Keep all folders and files encrypted on your hard drive. Use the USBKill script from https://github.com/hephaest0s/usbkill. Once you have it on your system, run it with the command “sudo python usbkill.py” or “sudo python3 usbkill.py”. Make sure you have a USB drive in the USB Port. You can connect the drive to your wrist with a strap. If someone swipes your laptop the USB thumb drive will be removed. Once the script detects that the USB Port has had activity, then a special script will run as you have configured. The laptop could be powered off so no one can get back on it without the password. Before the laptop powers off, all data could be deleted, etc. The configuration can also specify USB Drives which will not set off the script when attached or removed.

The ability of the script is:

  • Compatible with Linux, *BSD and OS X
  • Shutdown the computer when there is USB activity
  • Customizable. Define which commands should be executed just before shut down
  • Ability to whitelist a USB device
  • Ability to change the check interval (default: 250ms)
  • Ability to melt the program on shut down
  • RAM and swap wiping
  • Works with sleep mode (OS X)
  • No dependency except secure-delete if you want usbkill to delete files/folders for you or if you want to wipe RAM or swap. sudo apt-get install secure-delete
  • Sensible defaults
The USB Kill script can help safeguard your data from theft or your hardware from unwanted use to prevent someone from copying the data off your system.

Be aware that the USB ports are useful and convenient, but they can pose a risk to your hardware and data. Keep your hardware and data safe as much as possible.

Monday, March 6, 2017

Free tool protects PCs from master boot record attacks

http://www.csoonline.com/article/3133115/security/free-tool-protects-pcs-from-master-boot-record-attacks.html

The tool acts as a system driver and blocks ransomware and other malicious programs from injecting rogue code into the master boot record

MBRFilter protects Windows computers against MBR attacks.

Credit: Thinkstock
Cisco's Talos team has developed an open-source tool that can protect the master boot record of Windows computers from modification by ransomware and other malicious attacks.
The tool, called MBRFilter, functions as a signed system driver and puts the disk's sector 0 into a read-only state. It is available for both 32-bit and 64-bit Windows versions and its source code has been published on GitHub.
The master boot record (MBR) consists of executable code that's stored in the first sector (sector 0) of a hard disk drive and launches the operating system's boot loader. The MBR also contains information about the disk's partitions and their file systems.
Since the MBR code is executed before the OS itself, it can be abused by malware programs to increase their persistence and gain a head start before antivirus programs. Malware programs that infect the MBR to hide from antivirus programs have historically been known as bootkits -- boot-level rootkits.
Microsoft attempted to solve the bootkit problem by implementing cryptographic verification of the bootloader in Windows 8 and later. This feature is known as Secure Boot and is based on the Unified Extensible Firmware Interface (UEFI) -- the modern BIOS.
The problem is that Secure Boot does not work on all computers and for all Windows versions and does not support MBR-partitioned disks at all. This means that there are still a large number of computers out there that don't benefit from it and remain vulnerable to MBR attacks.
More recently, ransomware authors have also understood the potential for abusing the MBR in their attacks. For example, the Petya ransomware, which appeared in March, replaces the MBR with malicious code that encrypts the OS partition's master file table (MFT) when the computer is rebooted.
The MFT is a special file on NTFS partitions that contains information about every other file: their name, size and mapping to the hard disk sectors. Encrypting the MFT renders the entire system partition unusable and prevents users from being able to use their computers.
A second ransomware program that targets the MBR and appeared this year is called Satana. It doesn't not encrypt the MFT, but encrypts the original MBR code itself and replaces it with its own code which displays a ransom note.
A third ransomware program that modifies the MBR to prevent computers from booting is called HDDCrypter and some researchers believe that it predates both Petya and Satana.
"MBRFilter is a simple disk filter based on Microsoft’s diskperf and classpnp example drivers," the Cisco Talos researchers said in a blog post. "It can be used to prevent malware from writing to Sector 0 on all disk devices connected to a system. Once installed, the system will need to be booted into Safe Mode in order for Sector 0 of the disk to become accessible for modification."

 

Browse anonymously in Kali Linux with Anonsurf

https://www.blackmoreops.com/2016/10/17/browse-anonymously-in-kali-linux-with-anonsurf

IP spoofing, also known as IP address forgery or a host file hijack, is a hijacking technique in which a cracker masquerades as a trusted host to conceal his identity, spoof a Web site, hijack browsers, or gain access to a network. We use various methods to spoof our IP addresses, most common being using Proxy, VPN and TOR. Browse anonymously with Anonsurf in Kali Linux - blackMORE Ops -5I found this interesting tool named Anonsurf and it will anonymize the entire system under TOR using IPTables. It will also allow you to start and stop i2p as well. That means you can browse anonymously in Kali Linux with Anonsurf running in the background. Anonsurf will run and keep changing IP address every so often or you can simply restart the process to make it grab a new IP address and thus spoofing your own IP address. Sounds good?
Und3rf10w forked ParrotSec’s git and made a version for Kali Linux which is very easy and straight forward to install. His repo contains the sources of both the anonsurf and pandora packages from ParrotSec combined into one. Und3rf10w also made some small modifications to the DNS servers to use of Private Internet Access (instead of using FrozenDNS) and added some fixes for users who don’t use the resolvconf application. He also removed some functionality such as the GUI and IceWeasel/Firefox in RAM. There’s a installer script which makes it really easy to install it. You can review the installer script to find out more. This forked version should now work with any Debian or Ubuntu system, but this has only been tested to work on a kali-rolling amd64 system. I am also using the same system but users are advised to test and verify it in their own distro. If it works, then you will be able to hide your IP and gain anonymity as long you’re not signed into any website such as Google, Yahoo etc. I wrote a nice long article comparing different methods i.e. TOR vs VPN vs Proxy on top of each other.

anonsurf

Anonsurf will anonymize the entire system under TOR using IPTables. It will also allow you to start and stop i2p as well.
NOTE: DO NOT run this as service anonsurf $COMMAND. Run this as anonsurf $COMMAND
Browse-anonymously-with-Anonsurf-in-Kali-Linux-blackMORE-Ops-10

Pandora

Pandora automatically overwrites the RAM when the system is shutting down. Pandora can also be ran manually:
pandora bomb
NOTE: This will clear the entire system cache, including active SSH tunnels or sessions so perhaps not a good idea to run it while working. It makes the system freeze for sometime (I tried it in a VM).
So here’s how to configure Anonsurf in Kali Linux:

Download Anonsurf

Clone anonsurf  from GIT
root@kali:~# git clone https://github.com/Und3rf10w/kali-anonsurf.git
Cloning into 'kali-anonsurf'...
remote: Counting objects: 275, done.
remote: Total 275 (delta 0), reused 0 (delta 0), pack-reused 275
Receiving objects: 100% (275/275), 163.44 KiB | 75.00 KiB/s, done.
Resolving deltas: 100% (79/79), done.
Checking connectivity... done.
root@kali:~#
Browse anonymously with Anonsurf in Kali Linux - blackMORE Ops -1
Once it’s downloaded, change directory to kali-anonsurf
root@kali:~# 
root@kali:~# cd kali-anonsurf/
root@kali:~/kali-anonsurf# 
root@kali:~/kali-anonsurf# ls
installer.sh  kali-anonsurf-deb-src  LICENSE  README.md
root@kali:~/kali-anonsurf#

Install anonsurf

With the installer script, it’s very straight forward to install anonsurf in Kali Linux.
root@kali:~/kali-anonsurf# ./installer.sh
--2016-10-13 12:36:53--  https://geti2p.net/_static/i2p-debian-repo.key.asc
Resolving geti2p.net (geti2p.net)... 2a02:180:a:65:2456:6542:1101:1010, 91.143.92.136
Connecting to geti2p.net (geti2p.net)|2a02:180:a:65:2456:6542:1101:1010|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 14455 (14K) [text/plain]
Saving to: ‘/tmp/i2p-debian-repo.key.asc’

/tmp/i2p-debian-rep 100%[===================>]  14.12K  21.6KB/s    in 0.7s
<--------output-----truncated------->
Browse anonymously with Anonsurf in Kali Linux - blackMORE Ops -2
In Kali Linux, it will automagically update /etc/tor/torrc file and add the following lines:
VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
SocksPort 9050
DNSPort 53
RunAsDaemon 1
It also changes your resolver configuration to the following:
root@kali:~# cat /etc/resolv.conf
nameserver 127.0.0.1
nameserver 209.222.18.222
nameserver 209.222.18.218
If you don’t like using Private Internet Access DNS, simply the change DNS in the following lines in /etc/init.d/anonsurf script
    echo -e 'nameserver 127.0.0.1\nnameserver 209.222.18.222\nnameserver 209.222.18.218' > /etc/resolv.conf
    echo -e " $GREEN*$BLUE Modified resolv.conf to use Tor and Private Internet Access DNS"

Start anonsurf

To start anonsurf, and pass all under TOR, simply start anonsurf. It will also start TOR if that already been started:
root@kali:~# anonsurf start
 * killing dangerous applications
 * cleaning some dangerous cache elements
[ i ] Stopping IPv6 services:
[ i ] Starting anonymous mode:
 * Tor is not running!  starting it  for you
 * Saved iptables rules
 * Modified resolv.conf to use Tor and Private Internet Access DNS
 * All traffic was redirected throught Tor
[ i ] You are under AnonSurf tunnel
root@kali:~#

Find your new Public IP

You can issue the following command to find out your IP adderss
root@kali:~# anonsurf myip
My ip is:
1xx.1xx.2xx.1xx

Restart anonsurf

If you want a new IP address, simply restart anonsurf:
oot@kali:~# anonsurf restart
 * killing dangerous applications
 * cleaning some dangerous cache elements
[ i ] Stopping anonymous mode:
 * Deleted all iptables rules
 * Iptables rules restored
[ i ] Reenabling IPv6 services:
 * Anonymous mode stopped
 * killing dangerous applications
 * cleaning some dangerous cache elements
[ i ] Stopping IPv6 services:
[ i ] Starting anonymous mode:
 * Tor is not running!  starting it  for you
 * Saved iptables rules
 * Modified resolv.conf to use Tor and Private Internet Access DNS
 * All traffic was redirected throught Tor
[ i ] You are under AnonSurf tunnel
Then simply check your new IP address using the same myip command:
root@kali:~# anonsurf myip
My ip is:
1xx.1xx.6x.6x

Stop anonsurf

To stop anonsurf,
root@kali:~# anonsurf stop
 * killing dangerous applications
 * cleaning some dangerous cache elements
[ i ] Stopping anonymous mode:
 * Deleted all iptables rules
 * Iptables rules restored
[ i ] Reenabling IPv6 services:
 * Anonymous mode stopped

Testing anonymity

First of all, your IP address definitely changed, so there’s no worry on that side. I checked my public IP from command line, using Google and WhatismyIP.  This seems to be working and I was able to browse and compared to just TOR, I think it was slightly faster and more responsive.If you think it’s working slow, simply restart anonsurf and chances are you will end up in a faster connection.
The not so obvious thing people doesn’t check is if they are leaking DNS. I usually do it from http://dnsleak.com/ as shown on my post from setting up VPN.  However, I did not get any results back, so I used https://www.perfect-privacy.com/dns-leaktest/ and https://torguard.net/vpn-dns-leak-test.php and they seems to think I am in Netherlands or Belgium … so all good.
You can also check if you’re leaking IPv6 in here: http://ipv6leak.com/

Conclusion

Those who doesn’t know what ParrotSec OS is, it is another Security OS similar to Kali Linux developed by Parrot Security. I would give them a go if I were you.
Finally I would like to thank ParrotSec and Und3rf10w for taking their time and doing it. I am sure many users around the world would like to use it, specially when your country doesn’t allow access to certain Internet resources.
In case ip spoofing in Kali Linux is a requirement for you, try torsocks. It uses SOCKS proxy which is not commonly used, so chances are you will have fast browsing experiences compared to standard TOR settings.
I think I covered most of anonsurf and browsing anonymously part well. Did I make any mistakes? Do you have a suggestion? Let me know. Comments section is open as always and doesn’t require registration or any validation… so do help others and contribute where applicable.