TL;DR: Don't build a burner device. Probably this is not the risk you are looking for.
Introduction
Every year before DEF CON people starts to give advice to attendees to bring "burner devices" to DEF CON. Some people also start to create long lists on how to build burner devices, especially laptops. But the deeper we look into the topic, the more confusing it gets. Why are we doing this? Why are we recommending this? Are we focusing on the right things?
What is a "burner device" used for?
For starters, the whole "burner device" concept is totally misunderstood, even within the ITSEC community. A "burner device" is used for non-attribution. You know, for example, you are a spy and you don't want the country where you live to know that you are communicating with someone else. I believe this is not the situation for most attendees at DEF CON. More info about the meaning of "burner" https://twitter.com/Viss/status/877400669669306369
Burner phone means it has a throwaway SIM card with a throwaway phone, used for one specific operation only. You don't use the "burner device" to log in to your e-mail account or to VPN to your work or home.
But let's forget this word misuse issue for a moment, and focus on the real problem.
The bad advice
The Internet is full of articles focusing on the wrong things, especially when it comes to "burner devices". Like how to build a burner laptop, without explaining why you need it or how to use it.
The problem with this approach is that people end up "burning" (lame wordplay, sorry) significant resources for building a secure "burner device". But people are not educated about how they should use these devices.
The threats
I believe the followings are some real threats which are higher when you travel:
1. The laptop getting lost or stolen.
2. The laptop getting inspected/copied at the border.
These two risks have nothing to do with DEF CON, this is true for every travel.
Some other risks which are usually mentioned when it comes to "burner devices" and DEF CON:
3. Device getting owned via physical access while in a hotel room.
4. Network traffic Man-in-the-middle attacked. Your password displayed on a Wall of Sheep. Or having fun with Shellshock with DHCP. Information leak of NTLM hashes or similar.
5. Pwning the device via some nasty things like WiFi/TCP/Bluetooth/LTE/3G/GSM stack. These are unicorn attacks.
6. Pwning your device by pwning a service on your device. Like leaving your upload.php file in the root folder you use at CTFs and Nginx is set to autostart. The author of this article cannot comment on this incident whether it happened in real life or is just an imaginary example.
How to mitigate these risks?
Laptop getting stolen/lost/inspected at the border?
1. Bring a cheap, empty device with you. Or set up a fake OS/fake account to log in if you really need your day-to-day laptop. This dummy account should not decrypt the real files in the real account.
Device getting owned while in a hotel room with physical access
1. Don't bring any device with you.
2. If you bring any, make it tamper-resistant. How to do that depends on your enemy, but you can start by using nail glitter and Full Disk Encryption. Tools like Do Not Disturb help. It also helps if your OS supports suspending DMA devices before the user logs in.
3. If you can't make the device tamper-resistant, use a device that has a good defense against physical attackers, like iOS.
4. Probably you are not that important anyway that anyone will spend time and resources on you. If they do, probably you will only make your life miserable with all the hardening, but still, get pwned.
Network traffic Man-in-the-middle attacked
1. Don't bring any device with you.
2. Use services that are protected against MiTM. Like TLS.
3. Update your OS to the latest and greatest versions. Not everyone at DEF CON has a 0dayz worth of 100K USD, and even the ones who have won't waste it on you.
4. Use fail-safe VPN. Unfortunately, not many people talk about this or have proper solutions for the most popular operating systems.
5. For specific attacks like Responder, disable LLMNR, NBT-NS, WPAD, and IPv6 and use a non-work account on the machine. If you don't have the privileges to do so on your machine, you probably should not bring this device with you. Or ask your local IT to disable these services and set up a new account for you.
Pwning the device via some nasty thing like WiFi/TCP/Bluetooth/LTE/3G/GSM stack
1. Don't bring any device with you.
2. If you bring any, do not use this device to log in to work, personal email, social media, etc.
3. Don't worry, these things don't happen very often.
Pwning your device by pwning a service on your device
Just set up a firewall profile where all services are hidden from the outside. You rarely need any service accessible on your device at a hacker conference.
Conclusion
If you are still so afraid to go there, just don't go there. Watch the talks at home. But how is the hotel WiFi at a random place different from a hacker conference? Turns out, it is not much different, so you better spend time and resources on hardening your daily work devices for 365 days, instead of building a "burner device".
You probably need a "burner device" if you are a spy for a foreign government. Or you are the head of a criminal organization. Otherwise, you don't need a burner device. Maybe you need to bring a cheap replacement device.
Related articles
- Game Hacking
- Hack Tool Apk No Root
- How To Hack
- Pentest Tools Kali Linux
- Tools For Hacker
- Pentest Box Tools Download
- Pentest Tools Download
- Nsa Hacker Tools
- Ethical Hacker Tools
- Hacking Tools For Windows 7
- Blackhat Hacker Tools
- Top Pentest Tools
- Pentest Tools Nmap
- Pentest Tools Linux
- Hacker Tools Software
- Nsa Hacker Tools
- Pentest Tools Bluekeep
- What Are Hacking Tools
- Hacking Tools For Windows Free Download
- Tools 4 Hack
- Hacker Tools Free
- Pentest Tools Website
- Pentest Tools For Ubuntu
- Hacker
- Hacker Tools Apk Download
- Hack Tools Online
- Hacker Tools For Mac
- Hack Tools For Games
- Hack Tools
- Pentest Tools Bluekeep
- Pentest Tools For Windows
- Hacker Tools List
- How To Hack
- Hacker
- Tools For Hacker
- Hacking Tools For Games
- Hacking Tools For Beginners
- Tools Used For Hacking
- Hacking Tools Online
- Hack Website Online Tool
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Android
- Hacking Tools Hardware
- Pentest Tools Github
- Hacker Techniques Tools And Incident Handling
- Nsa Hack Tools
- Hack Tools For Windows
- Hacker
- Pentest Tools Online
- Hack Tools For Ubuntu
- Pentest Tools Port Scanner
- Underground Hacker Sites
- Android Hack Tools Github
- Pentest Tools For Android
- Hack Tool Apk
- Hack Tools Mac
- Pentest Tools List
- Hacker Tools Free
- Hacking Tools Windows
- Tools Used For Hacking
- Pentest Tools For Android
- Hack Tool Apk
- Hacking Tools Windows 10
- Hackers Toolbox
- What Are Hacking Tools
- Hacking Tools For Beginners
- World No 1 Hacker Software
- Hacker Tools List
- Hacker Tools Software
- What Is Hacking Tools
- Pentest Reporting Tools
- Pentest Tools For Mac
- Hackers Toolbox
- Hacking Tools Windows
- Pentest Tools Android
- Tools 4 Hack
- Pentest Tools Find Subdomains
- Best Hacking Tools 2019
- Hacking Tools Mac
- Pentest Tools Url Fuzzer
- Pentest Tools Free
- Pentest Tools Port Scanner
- Hacker Tool Kit
- Hacks And Tools
- Hak5 Tools
- Hacking Tools Name
- Hacker Tools For Ios
- Pentest Reporting Tools
- Install Pentest Tools Ubuntu
- Hacker Tools For Ios
- Hacking Tools Free Download
- Pentest Tools Apk
- Free Pentest Tools For Windows
- Pentest Tools For Windows
- Install Pentest Tools Ubuntu
- Hack Tool Apk
- Hack Website Online Tool
- Pentest Box Tools Download
- Pentest Recon Tools
- Tools Used For Hacking
- Pentest Tools Subdomain
- Best Pentesting Tools 2018
- Hack App
- Pentest Tools Port Scanner
- Hack Tools For Pc
- Hacking Tools And Software
- Pentest Tools List
- Hacker Tools Free
- Hacker Tools Hardware
- Hacking Tools For Kali Linux
- Hack Tools For Mac
- Pentest Tools For Mac
- Pentest Tools Subdomain
- Hak5 Tools
- Hacker Tools 2019
- Hack App
- Pentest Tools Free
- Hacker Tools For Pc
- Hack Apps
- Hacking Tools
- Hacking Tools For Beginners
- Usb Pentest Tools
- Hacker Tools 2019
- What Are Hacking Tools
- World No 1 Hacker Software
- Hacker Tools For Windows
- Hack Tools Pc
- Nsa Hack Tools
- Android Hack Tools Github
- Hacker Tools Windows
- Best Hacking Tools 2020
- Hack Tools Online
- Pentest Tools Tcp Port Scanner
- Pentest Tools Port Scanner
- Hacking Tools Free Download
- Ethical Hacker Tools
- Hacking Tools Free Download
- Hacker Security Tools
- Hacker Tools For Mac
- Pentest Tools Kali Linux
- Hacking Tools Software
- Pentest Tools Url Fuzzer
- Hacking Tools 2019
- How To Make Hacking Tools
- Top Pentest Tools
- Hacking Tools For Windows
- Hack App
- Tools 4 Hack
- Hacker Tools For Mac
- Hacking Tools For Windows 7
- Hack And Tools
- Pentest Tools Nmap
- Hack Tools 2019
- Pentest Tools Open Source
- How To Install Pentest Tools In Ubuntu
- New Hack Tools
- Growth Hacker Tools
- Pentest Tools Find Subdomains
- Hacks And Tools
- Install Pentest Tools Ubuntu
- Hacking Tools
- Hacks And Tools
- Hack Tools For Games
- Hacker Tools Online
- World No 1 Hacker Software
- Hacking Tools Windows 10
- Pentest Tools Url Fuzzer
- Hacking Tools Kit
- Hacker Tools Online
- Hacking Tools Download
- Pentest Tools Linux
No comments:
Post a Comment