Internet privacy and security course
About translation
Previous Next

Chapter 138

Emergency data erasure of the computer. How hackers cheat forensics.

You perhaps have seen a video of arrests and searches of hackers or other cybercriminals more than once, when law enforcement officials rush into a residential building, turn on a computer, and under recording show irrefutable evidence of criminal activity.

Here is one of these videos:

From the point of view of modern forensics, this is a wrong approach. According to scientific canons, all devices must be disconnected from the power supply, sealed and researched in the laboratory by specialists. Although this is an ambiguous recommendation, since the same electromagnetic drive erasure systems are able to activate automatically and destroy data when the position of the system unit changes from vertical to horizontal.

But all these recommendations are ignored, as there is too much temptation to receive confessions and access to devices, while the suspect has not recovered from the shock yet, has not received the advice of a lawyer or cellmates.

And this is paying off, as most of the cybercriminals caught off guard give access to devices and point to evidence, doing this in terms of cooperation, for which they are promised the mildest sentence (they, however, are not told that the judgment is declared by the court, and not by the police or an investigator).

Usually, a person from the side who is not interested in hackers’ crime investigation may have a logical question that after all there is encryption of the operating system and cryptocontainers, why don't hackers use it?

They use it, but a hacker can simply get a finger squeezed between the door to make them get a password, because encryption is an excellent solution in theory, but in practice it was better not to have situation when one needs to reveal a password.

Sometimes a detainee is pressured to be sent to a detention center before the trial, and in case of a refusal to give out information and get a written claim not to leave the house or house arrest if they agree to cooperate.

A USB killer can solve a hacker’s problem, if a similar device disguised as a USB flash drive is inserted into a USB port, it will irreversibly disable the motherboard and the computer will “die”. But most importantly, on-site there will be almost impossible to establish the cause of the "death" of the computer, and the hacker will always be able to sigh and say: "Oh, it has already been on its last legs for a while".

Here is a video demonstration of laptop erasure:

The USB killer will not destroy the hard drive, and it will be removed in the laboratory, but by that time the hacker will already have a lawyer and it will be at the investigation stage, no one will stick their finger in the door or change the preventive measure.

USB killers can be found in online stores and on AliExpress. A similar flash drive is placed near the computer, an inscription is put on it, for example, “data” or “work materials” (the task of this inscription is to attract attention). The hacker can voluntarily issue the USB flash drive or wait for the curious malefactors to insert it into the device themselves.

For sure there is a small chance that they will insert it into their device, and then problems cannot be avoided. But the detained hacker already has big problems, and the task of the trap is to disable the computer with the data at the moment when the detainee themself cannot do it.

Previous
4118
Next