6 ms·

The snatching of the computer before you have a chance to lock it issue seems like something that could be solved with software. I'm imagining a "swatd" service

by oroup 12y ago

The snatching of the computer before you have a chance to lock it issue seems like something that could be solved with software. I'm imagining a "swatd" service that listens for loud noises (gunfire, flashbangs, shouting, etc) or observes the camera for sudden motion and locks the machine. I'm sure there'd be some false positives from movies and the like, but for guys like this, better safe than sorry.

StoneTable 12y ago
You could use a laptop with some kind of sudden motion sensor and use that to lock the machine if the machine is moved.
- tacoman 12y ago
  Thinkpads have this sensor that is meant to protect the hard drive from sudden shock. I bet it could be used for something like that. http://www.thinkwiki.org/wiki/Active_Protection_System http://www.thinkwiki.org/wiki/Active_Protection_System
- lsllc 12y ago
  A bit old, but Amit Singh did some interesting work with the sudden motion sensor on the Mac Powerbooks: http://osxbook.com/book/bonus/chapter10/sms/ http://osxbook.com/book/bonus/chapter10/sms/
saboot 12y ago
I think this could still be circumvented if this service was known. I guess you would intentionally not make this software available to anyone other than yourself. What about some sort of 5-10 minute prompt? You cant ask repeated questions due to surveillance, or you could be also requiring some hash value. Perhaps based on some permutation of the current time? It's weak but I can't think of something else you could consistently make a unique hash of using just your brain and some changing property of reality. Another idea, a heart rate or brain wave monitor connected via bluetooth. If it's disconnected, moved, or shifted it prompts a lock. If your heart rate increases or brain patterns are it also locks. The point is that it cant be removed from yourself, but others cannot stop you from locking it as well.
- PhantomGremlin 12y ago
  > Another idea, a heart rate or brain wave monitor connected via bluetooth I like this idea. It may or may not be practical, but it's out of the box thinking and would certainly warrant some investigation / development.
squidbot 12y ago
Senors, software and such seem pretty error prone or otherwise defeatable. What about a "deadman's switch", a wrist strap connected to a short cable connected to a USB dongle. When the dongle is removed (laptop snatched) it would lock the laptop. The only way to defeat this would to somehow completely restrain someone from moving, and I can't see how you'd do that without seeing it coming. Even a tranquilizer takes a few seconds to kick in.
- knodi123 12y ago
  please don't make their only option be to either secure your cooperation, or sever your brainstem before you can twitch. "Oh shit, he's moving his arm! It might have an rfid dongle!" bang
- FeeTinesAMady 12y ago
  It has to be something they can't see, or they'll counteract it, possibly by shooting you as the other commenter said.
kryptiskt 12y ago
If the target manages to lock the computer, the next thing to do is to freeze the RAM sticks and try to get the encryption key from there: http://citpsite.s3-website-us-east-1.amazonaws.com/oldsite-htdocs/pub/coldboot.pdf http://citpsite.s3-website-us-east-1.amazonaws.com/oldsite-h... "We also confirmed that decay rates vary dramatically with temperature. We obtained surface temperatures of approximately −50C with a simple cooling technique: discharging inverted cans of “canned air” duster spray directly onto the chips. At these temperatures, we typically found that fewer than 1% of bits decayed even after 10 minutes without power. To test the limits of this effect, we submerged DRAM modules in liquid nitrogen (ca. −196C) and saw decay of only 0.17% after 60 minutes out of the computer."
- kryptiskt 12y ago
  I just realized that an easier way, when you have a guy under surveillance using his computer in public, is to capture some decent footage of him entering his password before you bust him. Way less fun though.
- runeks 12y ago
  Ulbricht's Samsung 700Z laptop used DDR3 RAM. These guys couldn't reproduce the "cold boot"/"RAM freeze" attack using DDR3 RAM: http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldboot.pdf http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb... But I don't see why they would need to freeze anything. I would think the feds should be able to make a device that plugs onto the DRAM connectors of chips and reads the content, although I'm not sure.
- 8_hours_ago 12y ago
  The Linux distribution Tails will automatically wipe RAM when shut down, which can be triggered by removing the USB drive it is running off of. I guess the thing to do would be to only work in a place where you can delay law enforcement long enough for the wipe to complete. But alas, it seems Ulbricht wasn't paranoid enough. https://tails.boum.org/doc/advanced_topics/cold_boot_attacks/index.en.html https://tails.boum.org/doc/advanced_topics/cold_boot_attacks... Or, of course, thermite always works.
- 12y ago
skeoh 12y ago
Is there software out there that will lock your session when a new USB device is detected? Maybe it wouldn't have changed much for Ulbricht but I would like to use something like that. If someone tried to copy files to their own drive while I was distracted then they would unwittingly lock themselves out.
- gknoy 12y ago
  I recall seeing a video of a presentation about trashing a device that's plugged in via exploits (I think?) in the USB protocol, but I imagine that the "do things when something is detected" part would be comparatively easy to reproduce. Unfortunately, I can't recall where it was, nor can I seem to find it. Sorry.
evo 12y ago
I was thinking if it would be feasible to implement an OpenCV-style facial recognition script that could require sustained attention from the user to preserve an open session on the computer. If that user stops watching the screen or is physically separated from the view of the camera, then the locking operation would take place automatically. I'd be curious from a legal perspective if that would constitute obstruction if you always used it, by analogy to having a data destruction policy in place before the discovery phase of a lawsuit.
Pinatubo 12y ago
I was thinking of a Bluetooth connection to his phone, and if the connection is lost the computer shuts down. I'm assuming the FBI would quickly get him away from his computer, which would trigger this defense. Or just take the battery out of the laptop and work with the plug. Snatching it away shuts it down.
shittyanalogy 12y ago
how about an rfid device that simply locks the computer when you're more than a few feet away?
- saboot 12y ago
  If you are under surveillance it's likely they would have observed this already. Don't assume they would go beyond removing all of your valuables and clothes right then and there if they thought this setup was in place. Some of the above methods can still be broken. Requiring a face present? Why not just print a big blowup photo and quickly insert in front of camera? There are smart people getting around security.
  - Pinatubo 12y ago
    It's hard to imagine they could simultaneously arrest and restrain a guy, while keeping him within 3 feet of his laptop, while preventing him from shutting the lid or locking the computer. Falling to the floor would be enough to break the connection and lock the computer.
  - MichaelGG 12y ago
    If they're already in your house, then it's probably game over. Otherwise it should not be detectable to a third party observer that you have a small transmitter in your wrist bracelet.
- marincounty 12y ago
  That's not a bad idea. You could use some kind of USB dongle connected to a wearable? Once you walk away from computer it takes a picture of the screen( looks like nothing is changed), but the computer immediately locks down everything except what's currently on the screen. Only a password along with the wearable would unlock it? (It's probally not easily feasible, but it doesn't sound impossible?) "Oh, I scratched my head, and my computer hard drive shut down."
  - tokenizerrr 12y ago
    You could have something attached to your belt and keep the laptop on your lap. A gpg smartcard would do well, probably.

by oroup 12y ago

StoneTable 12y ago

You could use a laptop with some kind of sudden motion sensor and use that to lock the machine if the machine is moved.

tacoman 12y ago
Thinkpads have this sensor that is meant to protect the hard drive from sudden shock. I bet it could be used for something like that. http://www.thinkwiki.org/wiki/Active_Protection_System http://www.thinkwiki.org/wiki/Active_Protection_System
lsllc 12y ago
A bit old, but Amit Singh did some interesting work with the sudden motion sensor on the Mac Powerbooks: http://osxbook.com/book/bonus/chapter10/sms/ http://osxbook.com/book/bonus/chapter10/sms/

saboot 12y ago

I think this could still be circumvented if this service was known. I guess you would intentionally not make this software available to anyone other than yourself. What about some sort of 5-10 minute prompt? You cant ask repeated questions due to surveillance, or you could be also requiring some hash value. Perhaps based on some permutation of the current time? It's weak but I can't think of something else you could consistently make a unique hash of using just your brain and some changing property of reality. Another idea, a heart rate or brain wave monitor connected via bluetooth. If it's disconnected, moved, or shifted it prompts a lock. If your heart rate increases or brain patterns are it also locks. The point is that it cant be removed from yourself, but others cannot stop you from locking it as well.

PhantomGremlin 12y ago
> Another idea, a heart rate or brain wave monitor connected via bluetooth I like this idea. It may or may not be practical, but it's out of the box thinking and would certainly warrant some investigation / development.

squidbot 12y ago

Senors, software and such seem pretty error prone or otherwise defeatable. What about a "deadman's switch", a wrist strap connected to a short cable connected to a USB dongle. When the dongle is removed (laptop snatched) it would lock the laptop. The only way to defeat this would to somehow completely restrain someone from moving, and I can't see how you'd do that without seeing it coming. Even a tranquilizer takes a few seconds to kick in.

knodi123 12y ago
please don't make their only option be to either secure your cooperation, or sever your brainstem before you can twitch. "Oh shit, he's moving his arm! It might have an rfid dongle!" bang
FeeTinesAMady 12y ago
It has to be something they can't see, or they'll counteract it, possibly by shooting you as the other commenter said.

kryptiskt 12y ago

If the target manages to lock the computer, the next thing to do is to freeze the RAM sticks and try to get the encryption key from there: http://citpsite.s3-website-us-east-1.amazonaws.com/oldsite-htdocs/pub/coldboot.pdf http://citpsite.s3-website-us-east-1.amazonaws.com/oldsite-h... "We also confirmed that decay rates vary dramatically with temperature. We obtained surface temperatures of approximately −50C with a simple cooling technique: discharging inverted cans of “canned air” duster spray directly onto the chips. At these temperatures, we typically found that fewer than 1% of bits decayed even after 10 minutes without power. To test the limits of this effect, we submerged DRAM modules in liquid nitrogen (ca. −196C) and saw decay of only 0.17% after 60 minutes out of the computer."

kryptiskt 12y ago
I just realized that an easier way, when you have a guy under surveillance using his computer in public, is to capture some decent footage of him entering his password before you bust him. Way less fun though.
runeks 12y ago
Ulbricht's Samsung 700Z laptop used DDR3 RAM. These guys couldn't reproduce the "cold boot"/"RAM freeze" attack using DDR3 RAM: http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldboot.pdf http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb... But I don't see why they would need to freeze anything. I would think the feds should be able to make a device that plugs onto the DRAM connectors of chips and reads the content, although I'm not sure.
8_hours_ago 12y ago
The Linux distribution Tails will automatically wipe RAM when shut down, which can be triggered by removing the USB drive it is running off of. I guess the thing to do would be to only work in a place where you can delay law enforcement long enough for the wipe to complete. But alas, it seems Ulbricht wasn't paranoid enough. https://tails.boum.org/doc/advanced_topics/cold_boot_attacks/index.en.html https://tails.boum.org/doc/advanced_topics/cold_boot_attacks... Or, of course, thermite always works.
12y ago

skeoh 12y ago

Is there software out there that will lock your session when a new USB device is detected? Maybe it wouldn't have changed much for Ulbricht but I would like to use something like that. If someone tried to copy files to their own drive while I was distracted then they would unwittingly lock themselves out.

gknoy 12y ago
I recall seeing a video of a presentation about trashing a device that's plugged in via exploits (I think?) in the USB protocol, but I imagine that the "do things when something is detected" part would be comparatively easy to reproduce. Unfortunately, I can't recall where it was, nor can I seem to find it. Sorry.

evo 12y ago

I was thinking if it would be feasible to implement an OpenCV-style facial recognition script that could require sustained attention from the user to preserve an open session on the computer. If that user stops watching the screen or is physically separated from the view of the camera, then the locking operation would take place automatically. I'd be curious from a legal perspective if that would constitute obstruction if you always used it, by analogy to having a data destruction policy in place before the discovery phase of a lawsuit.

Pinatubo 12y ago

I was thinking of a Bluetooth connection to his phone, and if the connection is lost the computer shuts down. I'm assuming the FBI would quickly get him away from his computer, which would trigger this defense. Or just take the battery out of the laptop and work with the plug. Snatching it away shuts it down.

shittyanalogy 12y ago

how about an rfid device that simply locks the computer when you're more than a few feet away?

saboot 12y ago
If you are under surveillance it's likely they would have observed this already. Don't assume they would go beyond removing all of your valuables and clothes right then and there if they thought this setup was in place. Some of the above methods can still be broken. Requiring a face present? Why not just print a big blowup photo and quickly insert in front of camera? There are smart people getting around security.
- Pinatubo 12y ago
  It's hard to imagine they could simultaneously arrest and restrain a guy, while keeping him within 3 feet of his laptop, while preventing him from shutting the lid or locking the computer. Falling to the floor would be enough to break the connection and lock the computer.
- MichaelGG 12y ago
  If they're already in your house, then it's probably game over. Otherwise it should not be detectable to a third party observer that you have a small transmitter in your wrist bracelet.
marincounty 12y ago
That's not a bad idea. You could use some kind of USB dongle connected to a wearable? Once you walk away from computer it takes a picture of the screen( looks like nothing is changed), but the computer immediately locks down everything except what's currently on the screen. Only a password along with the wearable would unlock it? (It's probally not easily feasible, but it doesn't sound impossible?) "Oh, I scratched my head, and my computer hard drive shut down."
- tokenizerrr 12y ago
  You could have something attached to your belt and keep the laptop on your lap. A gpg smartcard would do well, probably.