hephaest0s / usbkill

« usbkill » is an anti-forensic kill-switch that waits for a change on your USB ports and then immediately shuts down your computer.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Windows Operating System Support

OpenSourceCS opened this issue · comments

Is Windows 8 supported?

No, I don't think so, the function kill_computer() has checks for Darwin, bsd and Linux only. But support for windows would be a good idea.

So far, the biggest obstacle to a Windows port seems to be enumerating the connected USB devices in a clean and reliable way - libusb seems to require a device driver, which isn't ideal.

This Stack Overflow snippet seems like the most promising candidate for doing it, but it depends on the Python for Windows extensions:

import win32com.client
wmi = win32com.client.GetObject ("winmgmts:")
for usb in wmi.InstancesOf ("Win32_USBHub"):
    print usb.DeviceID

USB\VID_1BCF&PID_0824\5&13735D69&0&1 ...

http://stackoverflow.com/a/8265634/4286300 This answer on stackoverflow is also good I think, it works and you can keep track of the device ID's...

That depends on lsusb, which isn't present on Windows 😞

Yes, it is not supported for the moment. Plus, you must activate Bitlocker which is not available on all versions, have 128 bits keys by default and may be backdoored.

Why do you need to activate bit locker?

@nabeelomer You're meant to encrypt your disk so nobody can get to your data after the computer shuts down.

That being said, I think a Windows version has some uses, even without full-disk encryption (although I'm fairly sure there are free tools to achieve that) - I'll give it a look later today.

@strangebroadcasts : Yes, you could use VeraCrypt/TrueCrypt with Hidden Operating System function.

https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System

Windows will not be supported. If you want (any) security you shouldn't use windows. If you find you absolutely have to use windows, then virtualize on a real OS and run usbkill on that, which would be much more secure already.

However, I do want to help windows users. So here is my advice for them:
Step 1: Don't use windows.

thanks for your advice

@hephaest0s I don't know about python, but I can write a same kind of application with support for Windows, Linux and Darwin (and a lot more) in C++ or Java or Rust and frankly, windows may be ugly, but it is still quite secure.

I found a way to enumerate devices in Windows using a call out to powershell for my own similar project. You could consider that approach. Still unsure if it's the best option, but it seems to work during testing thusfar. As always, tighter operating system integration would be the best option, but that involves making syscalls, which is a bit more work from Go. That said "don't use Windows" isn't the WORST advice you've ever been given ;)

I agree, everything in windows is a lot more complex but it is more powerful. You will have to talk directly to the USB driver to enumerate the devices, but powershell does the job for you, you don't have to go deep into the win32 api. When you come to think of it (remove the performance part, it serves the purpose) its a clever idea.