Hacker News Reader

Comment by oroup | Hacker News Reader

The snatching of the computer before you have a chance to lock it issue seems like something that could be solved with software. I'm imagining a "swatd" service that listens for loud noises (gunfire, flashbangs, shouting, etc) or observes the camera for sudden motion and locks the machine. I'm sure there'd be some false positives from movies and the like, but for guys like this, better safe than sorry.

View on HN

If the target manages to lock the computer, the next thing to do is to freeze the RAM sticks and try to get the encryption key from there: http://citpsite.s3-website-us-east-1.amazonaws.com/oldsite-h...

"We also confirmed that decay rates vary dramatically with temperature. We obtained surface temperatures of approximately −50C with a simple cooling technique: discharging inverted cans of “canned air” duster spray directly onto the chips. At these temperatures, we typically found that fewer than 1% of bits decayed even after 10 minutes without power. To test the limits of this effect, we submerged DRAM modules in liquid nitrogen (ca. −196C) and saw decay of only 0.17% after 60 minutes out of the computer."

I just realized that an easier way, when you have a guy under surveillance using his computer in public, is to capture some decent footage of him entering his password before you bust him. Way less fun though.

Ulbricht's Samsung 700Z laptop used DDR3 RAM. These guys couldn't reproduce the "cold boot"/"RAM freeze" attack using DDR3 RAM: http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb...

But I don't see why they would need to freeze anything. I would think the feds should be able to make a device that plugs onto the DRAM connectors of chips and reads the content, although I'm not sure.

The Linux distribution Tails will automatically wipe RAM when shut down, which can be triggered by removing the USB drive it is running off of. I guess the thing to do would be to only work in a place where you can delay law enforcement long enough for the wipe to complete. But alas, it seems Ulbricht wasn't paranoid enough.

https://tails.boum.org/doc/advanced_topics/cold_boot_attacks...

Or, of course, thermite always works.

To prevent cold boot attacks you can store the key in a CPU register instead of memory: https://en.wikipedia.org/wiki/TRESOR

I think this could still be circumvented if this service was known. I guess you would intentionally not make this software available to anyone other than yourself.

What about some sort of 5-10 minute prompt? You cant ask repeated questions due to surveillance, or you could be also requiring some hash value. Perhaps based on some permutation of the current time? It's weak but I can't think of something else you could consistently make a unique hash of using just your brain and some changing property of reality.

Another idea, a heart rate or brain wave monitor connected via bluetooth. If it's disconnected, moved, or shifted it prompts a lock. If your heart rate increases or brain patterns are it also locks. The point is that it cant be removed from yourself, but others cannot stop you from locking it as well.

> Another idea, a heart rate or brain wave monitor connected via bluetooth

I like this idea. It may or may not be practical, but it's out of the box thinking and would certainly warrant some investigation / development.

Senors, software and such seem pretty error prone or otherwise defeatable. What about a "deadman's switch", a wrist strap connected to a short cable connected to a USB dongle. When the dongle is removed (laptop snatched) it would lock the laptop. The only way to defeat this would to somehow completely restrain someone from moving, and I can't see how you'd do that without seeing it coming. Even a tranquilizer takes a few seconds to kick in.

please don't make their only option be to either secure your cooperation, or sever your brainstem before you can twitch.

"Oh shit, he's moving his arm! It might have an rfid dongle!" bang

It has to be something they can't see, or they'll counteract it, possibly by shooting you as the other commenter said.

I was thinking if it would be feasible to implement an OpenCV-style facial recognition script that could require sustained attention from the user to preserve an open session on the computer. If that user stops watching the screen or is physically separated from the view of the camera, then the locking operation would take place automatically.

I'd be curious from a legal perspective if that would constitute obstruction if you always used it, by analogy to having a data destruction policy in place before the discovery phase of a lawsuit.

You could use a laptop with some kind of sudden motion sensor and use that to lock the machine if the machine is moved.

Thinkpads have this sensor that is meant to protect the hard drive from sudden shock. I bet it could be used for something like that.

http://www.thinkwiki.org/wiki/Active_Protection_System

A bit old, but Amit Singh did some interesting work with the sudden motion sensor on the Mac Powerbooks:

http://osxbook.com/book/bonus/chapter10/sms/

I was thinking of a Bluetooth connection to his phone, and if the connection is lost the computer shuts down. I'm assuming the FBI would quickly get him away from his computer, which would trigger this defense.

Or just take the battery out of the laptop and work with the plug. Snatching it away shuts it down.

Is there software out there that will lock your session when a new USB device is detected? Maybe it wouldn't have changed much for Ulbricht but I would like to use something like that. If someone tried to copy files to their own drive while I was distracted then they would unwittingly lock themselves out.

I recall seeing a video of a presentation about trashing a device that's plugged in via exploits (I think?) in the USB protocol, but I imagine that the "do things when something is detected" part would be comparatively easy to reproduce.

Unfortunately, I can't recall where it was, nor can I seem to find it. Sorry.

how about an rfid device that simply locks the computer when you're more than a few feet away?

If you are under surveillance it's likely they would have observed this already. Don't assume they would go beyond removing all of your valuables and clothes right then and there if they thought this setup was in place.

Some of the above methods can still be broken. Requiring a face present? Why not just print a big blowup photo and quickly insert in front of camera?

There are smart people getting around security.

It's hard to imagine they could simultaneously arrest and restrain a guy, while keeping him within 3 feet of his laptop, while preventing him from shutting the lid or locking the computer. Falling to the floor would be enough to break the connection and lock the computer.

If they're already in your house, then it's probably game over. Otherwise it should not be detectable to a third party observer that you have a small transmitter in your wrist bracelet.

That's not a bad idea. You could use some kind of USB dongle connected to a wearable? Once you walk away from computer it takes a picture of the screen( looks like nothing is changed), but the computer immediately locks down everything except what's currently on the screen. Only a password along with the wearable would unlock it? (It's probally not easily feasible, but it doesn't sound impossible?) "Oh, I scratched my head, and my computer hard drive shut down."

You could have something attached to your belt and keep the laptop on your lap. A gpg smartcard would do well, probably.

Reply on news.ycombinator.com