gitmyhub

usbkill

Python ★ 4.6k updated 2y ago

« usbkill » is an anti-forensic kill-switch that waits for a change on your USB ports and then immediately shuts down your computer.

A Python script that watches USB ports and instantly shuts down your computer if any device is plugged in or unplugged, acting as a physical kill switch.

Pythonsetup: easycomplexity 1/5

usbkill is a small Python script that watches your computer's USB ports and, if anything changes (a device is plugged in or unplugged), immediately shuts the machine down. The idea is to give someone a physical kill switch: if your computer is taken from you or if law enforcement plugs in a device to copy data, the shutdown happens before they can do anything.

The project page specifically calls out situations like police raids or laptop theft, and references the well-known case of Ross Ulbricht. A common law enforcement technique is to keep a computer's screen active using a device called a mouse jiggler so it never locks. usbkill counters that by triggering on USB activity rather than waiting for a screensaver timeout.

The program runs as a background process with root permissions. A popular usage pattern is to tie a USB key to your wrist on a cord, insert it, and start usbkill. If the computer is grabbed away from you, the key is pulled out and the machine shuts down instantly. The README also stresses that disk encryption is necessary alongside this tool, because without it, a powered-off drive can still be read.

Features listed for version 1.0-rc.4 include support for Linux, BSD, and macOS; a configurable whitelist so you can exempt trusted USB devices; adjustable polling interval (default 250 milliseconds); optional RAM and swap wiping on shutdown; and the ability to define custom commands that run just before the machine powers off. There is one optional dependency, the secure-delete package, needed only if you want it to wipe files or memory.

It is a single Python file, started from the terminal with sudo. No install process beyond having Python is required.

Where it fits