News for hackers. Stuff that matters.

A comment on Usbkill – anti-forensic tool to halt computer when new USB device is connected. Parent comment

Re:Usbkill – anti-forensic tool to halt computer when new US... by macNchz on Thursday August 06, 2020 @09:47AM (#24070799)
I have a Lenovo M93P Tiny which came with a chassis intrusion switch installed. It seems you can have it block startup/require a password when the case is opened and notify some central admin. I don’t know what happens if you open the case while it’s running, though.

I’m not sure if it’s something they offer on current models, or to individuals at all (I bought it used from a corporate IT asset liquidator so it was likely originally purchased as part of a bulk deal). Regardless it makes a great little Linux box!

[ Parent | on HN ]
Re:Usbkill – anti-forensic tool to halt computer when new US... by destory-everyth on Thursday August 06, 2020 @11:39AM (#24071914)
Work at a big bank , we won’t procure laptops without this and yes we will know when you have opened it and you won’t be able to boot it , I think something happens with bitlocker also but not sure.
[ Parent | on HN ]
Re:Usbkill – anti-forensic tool to halt computer when new US... by Nextgrid on Friday August 07, 2020 @04:43AM (#24079762)
Could you give examples of laptops with this feature? I never knew chassis intrusion sensors were a thing on laptops.

Also, does it still work if you open the machine with the power disconnected and battery removed?

[ Parent | on HN ]
Re:Usbkill – anti-forensic tool to halt computer when new US... by sammex on Friday August 07, 2020 @05:19AM (#24079979)
I'm pretty sure most thinkpads have case intrustion detection. It's callled "Bottom Cover Tamper Access Detection" in BIOS.
[ Parent | on HN ]
Re:Usbkill – anti-forensic tool to halt computer when new US... by R0b0t1 on Thursday August 06, 2020 @11:50AM (#24072049)
That feature is fairly common but practically quite useless and easy to circumvent if you can find the model information. Even with PCI-DSS enclosure compliance you can get in if you can take power tools to it. The assumption is power tools would be too obvious to use in a typical installation.
[ Parent | on HN ]