This post will describe how to use BusKill as a dead man switch to trigger your laptop to self-destruct if it’s physically separated from you. This guide is specific to QubesOS users.

What if someone literally steals your laptop while you’re working with classified information inside a Whonix DispVM? They’d also be able to recover data from previous DispVMs–as Disposable VM’s rootfs virtual files are not securely shredded after your DispVM is destroyed.

QubesOS: A reasonably secure OS

This is part one of a two-part series. For part two, see Disarm BusKill in QubesOS (2/2)

A Laptop Kill Cord for QubesOS (1/2)
Disarm BusKill in QubesOS (2/2)

Are you a security researcher, journalist, or intelligence operative that works in QubesOS–exploiting Qubes’ brilliant security-through-compartimentalization to keep your data safe? Do you make use of Whonix Disposable VMs for your work? Great! This post is for you.

I’m sure your QubesOS laptop has Full Disk Encryption and you’re using a strong passphrase. But what if someone literally steals your laptop while you’re working with classified information inside a Whonix DispVM? Not only will they get access to all of your AppVM’s private data and the currently-running Whonix DispVM’s data, but there’s a high chance they’d be able to recover data from previous DispVMs–as Disposable VM’s rootfs virtual files (volatile.img) are not securely shredded after your DispVM is destroyed by Qubes!

Let’s say you’re a journalist, activist, whistleblower, or a human rights worker in an oppressive regime. Or an intelligence operative behind enemy lines doing research or preparing a top-secret document behind a locked door. What do you do to protect your data, sources, or assets when the secret police suddenly batter down your door? How quickly can you actually act to shutdown your laptop and shred your RAM and/or FDE encryption keys?

BusKill utilizes a magnetic trip-wire that tethers your body to your laptop. If you suddenly jump to your feet or fall off your chair (in response to the battering ram crashing through your door) or your laptop is ripped off your table by a group of armed thugs, the data bus’ magnetic connection will be severed. This event causes a configurable trigger to execute.

The BusKill trigger can be anything from:

locking your screen or
shutting down the computer or
initiating a self-destruct sequence

This post will describe how to setup such a system in QubesOS with BusKill

Disclaimer

This guide contains experimental files, commands, and software. The information contained in this article may or may not lead to corruption or total permanent deletion of some or all of your data. We’ve done our best to carefully guide the user so they know the risks of each BusKill trigger, but we cannot be responsible for any data loss that has occurred as a result of following this guide.

The contents of this guide is provided openly and is licensed under the CC-BY-SA license. The software included in this guide is licensed under the GNU GPLv3 license. All content here is consistent with the limitations of liabilities outlined in its respective licenses.

We highly recommend that any experiments with the scripts included in this article are used exclusively on a disposable machine containing no valuable data.

If data loss is a concern for you, then leave now and do not proceed with following this guide. You have been warned.

Release Note

Also be aware that, due to the risks outlined above, BusKill will not be released with this “self-destruct” trigger.

If you purchase a BusKill cable, it will only ship with non-destructive triggers that lock the screen or shutdown the computer. Advanced users can follow guides to add additional destructive triggers, such as the one described in this post, but they should do so at their own risk–taking carefully into consideration all of the warnings outlined above and throughout this article.

Again, if you buy a BusKill cable, the worst that can happen is your computer will abruptly shutdown.

Assumptions

This guide necessarily makes several assumptions outlined below.

sys-usb

In this guide, we assume that your QubesOS install has a USB-Qube named ‘sys-usb‘ for handling USB events on behalf of dom0.

If you decided to combine your USB and networking Qubes at install time, then replace all references in this guide for ‘sys-usb‘ to ‘sys-net‘.

If you decided to run your ‘sys-usb‘ VM as a DispoableVM at install time, then replace all references in this guide for ‘sys-usb‘ its Disposable TemplateVM (eg ‘fedora-36-dvm‘).

..And if you chose not to isolate your USB devices, then may god help you.

Udev Device Matching

BusKill in Linux uses udev to detect when the USB’s cable is severed. The exact udev rule that you use in the files below will depend on the drive you choose to use in your BusKill cable.

In this guide, we identify our BusKill-specific drive with the ‘ENV{ID_MODEL}=="Micromax_A74"‘ udev property. You should replace this property with one that matches your BusKill-specific drive.

To determine how to query your USB drive for device-specific identifiers, see Introducing BusKill: A Kill Cord for your Laptop. Note that the `udevadm monitor --environment --udev` command should be run in the ‘sys-usb‘ Qube.

ⓘ Note: If you’d prefer to buy a BusKill cable than make your own, you can buy one fully assembled here.

QubesOS Version

This guide was written for QubesOS v4.0.

[user@dom0 ~]$ cat /etc/redhat-release
Qubes release 4.0 (R4.0)
[user@dom0 ~]$

BusKill Files

This section will describe what files should be created and where.

sys-usb

To protect dom0 from USB peripherals (ie: vulnerable drivers parsing a malicious partition table), our udev rule to detect when the BusKill cable’s connection is severed will live on ‘sys-usb‘ in the ‘/etc/udev/rules.d/‘ directory. But to set this up the Qubes way, we’ll put them in ‘/rw/config/‘ and use ‘rc.local‘ to put them in-place when ‘sys-usb‘ boots.

First, we create our udev rule file ‘sys-usb:/rw/config/buskill.rules‘.

Execute the following on your ‘sys-usb‘ Qube:

cat << EOF | sudo tee /rw/config/buskill.rules
################################################################################
# File:    sys-usb:/etc/udev/rules.d/buskill.rules -> /rw/config/buskill.rules
# Purpose: Add buskill rules. For more info, see: https://buskill.in/qubes-os/
# Authors: Michael Altfield <michael@buskill.in>
# Created: 2020-01-02
# License: GNU GPLv3
################################################################################
ACTION=="remove", SUBSYSTEM=="usb", ENV{ID_MODEL}=="Micromax_A74", RUN+="/usr/bin/qrexec-client-vm dom0 buskill.lock"
#ACTION=="remove", SUBSYSTEM=="usb", ENV{ID_MODEL}=="Micromax_A74", RUN+="/usr/bin/qrexec-client-vm dom0 buskill.softShutdown"
#ACTION=="remove", SUBSYSTEM=="usb", ENV{ID_MODEL}=="Micromax_A74", RUN+="/usr/bin/qrexec-client-vm dom0 buskill.hardReboot"
#ACTION=="remove", SUBSYSTEM=="usb", ENV{ID_MODEL}=="Micromax_A74", RUN+="/usr/bin/qrexec-client-vm dom0 buskill.selfDestruct+--yes"
EOF
sudo ln -s /rw/config/buskill.rules /etc/udev/rules.d/
sudo udevadm control --reload

The above file defines a number of udev rules that execute distinct triggers when the BusKill device is removed from the system. All are commented-out except the top one, which tells ‘sys-usb‘ to execute the command `/usr/bin/qrexec-client-vm dom0 buskill.lock`.

The `qrexec-client-vm` command allows one VM to execute a command on another VM (assuming dom0 permits it–which we’ll setup below). In this case, we’re executing the command on ‘dom0‘ herself. And the command we’re executing is ‘buskill.lock‘

Now let’s add the following lines to ‘sys-usb:/rw/config/rc.local‘.

Execute the following on your ‘sys-usb‘ Qube:

grep 'buskill' /rw/config/rc.local || cat << EOF | sudo tee --append /rw/config/rc.local

# Add buskill rules. For more info, see: https://buskill.in/qubes-os/‎
sudo ln -s /rw/config/buskill.rules /etc/udev/rules.d/
sudo udevadm control --reload
EOF
sync

dom0

All of our triggers (lock screen, shutdown, self-destruct, etc) can actually only be executed from dom0. However, because QubesOS makes it intentionally difficult to put new files in dom0, we’ll be putting them in ‘/tmp/buskill/qubes-rpc‘ in your AppVM, creating a tarball, copying the tarball to dom0, and then extracting it to ‘/etc/qubes-rpc‘ inside dom0.

First, let’s create a staging dir where we’ll be adding files that will be later copied to dom0.