hephaest0s/usbkill
Usbkill
usbkill is a physical access defense tool and system monitor that triggers immediate power-off or shutdown sequences when unauthorized USB device changes are detected. It functions as a USB device shutdown trigger and volatile memory wiper designed to prevent forensic data recovery by automating system termination upon hardware tampering.
The tool includes a USB device whitelist manager that ignores trusted hardware to prevent accidental shutdowns during legitimate device usage. It provides anti-forensic data protection by executing destructive commands to erase RAM and swap space before the system shuts down.
The project covers hardware activity monitoring and shutdown automation, allowing for the execution of custom cleanup scripts and sequential command execution immediately before a system power-off.
Features
- Physical Port Security - Secures physical ports by triggering system shutdown when unauthorized USB devices are connected.
- Shutdown Hooks - Executes designated cleanup binaries and destructive commands as shutdown hooks during system power-off.
- USB Device Identification - Detects and distinguishes USB hardware peripherals to automate security responses and lockdown procedures.
- USB Activity Shutdown Triggers - Triggers immediate power-off sequences when unauthorized USB device changes are detected.
- USB Device Connection Watchers - Implements event-driven monitoring to detect USB device connection and disconnection events in real time.
- Anti-Forensic Data Protection - Prevents data recovery from volatile storage by wiping memory and swap space during emergency power-off.
- Power Management - Controls system power states to force a hard stop of the operating system upon security triggers.
- Secure Data Erasure - Ensures data cannot be recovered from memory by forensic-level overwriting of RAM and swap space.
- Physical Access Defense Tools - Provides a security utility that automates system termination upon hardware tampering to prevent forensic recovery.
- Volatile Memory Wipers - Executes destructive commands to erase RAM and swap space before the system shuts down.
- Volatile Memory Overwriting - Wipes RAM and swap space with random data to prevent forensic data recovery before power-off.
- Sequential Task Execution - Executes a strict linear sequence of cleanup scripts and binaries before initiating system shutdown.
- USB Device Whitelist Managers - Manages a configuration of trusted hardware to prevent accidental shutdowns during legitimate usage.
- Hardware Device Whitelists - Matches connected device IDs against a trusted list to prevent accidental shutdowns during authorized use.
