CINXE.COM

<!DOCTYPE html> <html lang="en-US"> <head> <meta charset="UTF-8"> <link rel="profile" href="https://gmpg.org/xfn/11"> <meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1'/>  <title>LUKS Header Shredder (BusKill Self-Destruct Trigger) - BusKill</title> <meta name="description" content="This self-destruct sequence will securely wipe your LUKS header, rendering your data permanently inaccessible if your BusKill tripwire's is triggered."/> <link rel="canonical" href="https://www.buskill.in/luks-self-destruct/"/> <meta property="og:locale" content="en_US"/> <meta property="og:type" content="article"/> <meta property="og:title" content="LUKS Header Shredder (BusKill Self-Destruct Trigger) - BusKill"/> <meta property="og:description" content="This self-destruct sequence will securely wipe your LUKS header, rendering your data permanently inaccessible if your BusKill tripwire's is triggered."/> <meta property="og:url" content="https://www.buskill.in/luks-self-destruct/"/> <meta property="og:site_name" content="BusKill"/> <meta property="article:publisher" content="https://www.facebook.com/buskillin"/> <meta property="article:published_time" content="2021-12-28T15:48:54+00:00"/> <meta property="article:modified_time" content="2025-01-22T21:34:29+00:00"/> <meta property="og:image" content="https://www.buskill.in/wp-content/uploads/sites/8/2020/10/luksHeaderShredder_featuredImage.jpg"/> <meta property="og:image:width" content="1200"/> <meta property="og:image:height" content="628"/> <meta property="og:image:type" content="image/jpeg"/> <meta name="author" content="Michael Altfield"/> <meta name="twitter:card" content="summary_large_image"/> <meta name="twitter:creator" content="@MichaelAltfield"/> <meta name="twitter:site" content="@BusKillin"/> <meta name="twitter:label1" content="Written by"/> <meta name="twitter:data1" content="Michael Altfield"/> <meta name="twitter:label2" content="Est. reading time"/> <meta name="twitter:data2" content="30 minutes"/> <script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"Article","@id":"https://www.buskill.in/luks-self-destruct/#article","isPartOf":{"@id":"https://www.buskill.in/luks-self-destruct/"},"author":{"name":"Michael Altfield","@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#/schema/person/0f6b3ce8782228dbc6ac106fa99d6dd1"},"headline":"LUKS Header Shredder (BusKill Self-Destruct Trigger)","datePublished":"2021-12-28T15:48:54+00:00","dateModified":"2025-01-22T21:34:29+00:00","mainEntityOfPage":{"@id":"https://www.buskill.in/luks-self-destruct/"},"wordCount":7559,"commentCount":0,"publisher":{"@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#organization"},"image":{"@id":"https://www.buskill.in/luks-self-destruct/#primaryimage"},"thumbnailUrl":"https://www.buskill.in/wp-content/uploads/sites/8/2020/10/luksHeaderShredder_featuredImage.jpg","keywords":["anti-forensics","buskill","cryptsetup","dead man switch","demo","dm-crypt","forensics","hexdump","kali","kill cord","linux","luks","self-destruct","trigger","ubuntu"],"articleSection":["Featured","News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https://www.buskill.in/luks-self-destruct/#respond"]}]},{"@type":"WebPage","@id":"https://www.buskill.in/luks-self-destruct/","url":"https://www.buskill.in/luks-self-destruct/","name":"LUKS Header Shredder (BusKill Self-Destruct Trigger) - BusKill","isPartOf":{"@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#website"},"primaryImageOfPage":{"@id":"https://www.buskill.in/luks-self-destruct/#primaryimage"},"image":{"@id":"https://www.buskill.in/luks-self-destruct/#primaryimage"},"thumbnailUrl":"https://www.buskill.in/wp-content/uploads/sites/8/2020/10/luksHeaderShredder_featuredImage.jpg","datePublished":"2021-12-28T15:48:54+00:00","dateModified":"2025-01-22T21:34:29+00:00","description":"This self-destruct sequence will securely wipe your LUKS header, rendering your data permanently inaccessible if your BusKill tripwire's is triggered.","breadcrumb":{"@id":"https://www.buskill.in/luks-self-destruct/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://www.buskill.in/luks-self-destruct/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https://www.buskill.in/luks-self-destruct/#primaryimage","url":"https://www.buskill.in/wp-content/uploads/sites/8/2020/10/luksHeaderShredder_featuredImage.jpg","contentUrl":"https://www.buskill.in/wp-content/uploads/sites/8/2020/10/luksHeaderShredder_featuredImage.jpg","width":1200,"height":628,"caption":"LUKS Header Shredder"},{"@type":"BreadcrumbList","@id":"https://www.buskill.in/luks-self-destruct/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.buskill.in/"},{"@type":"ListItem","position":2,"name":"Blog","item":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/blog/"},{"@type":"ListItem","position":3,"name":"LUKS Header Shredder (BusKill Self-Destruct Trigger)"}]},{"@type":"WebSite","@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#website","url":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/","name":"BusKill","description":"The USB kill cord for your laptop","publisher":{"@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#organization","name":"BusKill","url":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#/schema/logo/image/","url":"https://www.buskill.in/wp-content/uploads/sites/8/2020/02/buskill_logo_202002.jpg","contentUrl":"https://www.buskill.in/wp-content/uploads/sites/8/2020/02/buskill_logo_202002.jpg","width":332,"height":332,"caption":"BusKill"},"image":{"@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#/schema/logo/image/"},"sameAs":["https://www.facebook.com/buskillin","https://x.com/BusKillin"]},{"@type":"Person","@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#/schema/person/0f6b3ce8782228dbc6ac106fa99d6dd1","name":"Michael Altfield","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"http://buskillvampfih2iucxhit3qp36i2zzql3u6pmkeafvlxs3tlmot5yad.onion/#/schema/person/image/","url":"https://secure.gravatar.com/avatar/6cf31feac952aa2ff12540264f2fac51?s=96&d=mm&r=g","contentUrl":"https://secure.gravatar.com/avatar/6cf31feac952aa2ff12540264f2fac51?s=96&d=mm&r=g","caption":"Michael Altfield"},"description":"Hi, I'm Michael Altfield. I write articles about opsec, privacy, and devops ➡ About Michael","sameAs":["https://tech.michaelaltfield.net/","https://www.linkedin.com/in/michael-altfield-769a5b39","https://x.com/MichaelAltfield"],"url":"https://www.buskill.in/author/tech/"}]}</script>  <link rel="alternate" type="application/rss+xml" title="BusKill » Feed" href="https://www.buskill.in/feed/"/> <link rel="alternate" type="application/rss+xml" title="BusKill » Comments Feed" href="https://www.buskill.in/comments/feed/"/> <link rel="alternate" type="application/rss+xml" title="BusKill » LUKS Header Shredder (BusKill Self-Destruct Trigger) Comments Feed" href="https://www.buskill.in/luks-self-destruct/feed/"/> <script type="text/javascript">//<![CDATA[ window._wpemojiSettings={"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/www.buskill.in\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.6.2"}};!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings); //]]></script> <style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley,img.emoji{display:inline!important;border:none!important;box-shadow:none!important;height:1em!important;width:1em!important;margin:0 .07em!important;vertical-align:-.1em!important;background:none!important;padding:0!important}</style> <link rel='stylesheet' id='wp-block-library-css' href='https://www.buskill.in/wp-includes/css/dist/block-library/A.style.min.css,qver=6.6.2.pagespeed.cf.wKYjcZoIuW.css' type='text/css' media='all'/> <style id='classic-theme-styles-inline-css' type='text/css'>.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style> <style id='global-styles-inline-css' type='text/css'>:root{--wp--preset--aspect-ratio--square:1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black:#000;--wp--preset--color--cyan-bluish-gray:#abb8c3;--wp--preset--color--white:#fff;--wp--preset--color--pale-pink:#f78da7;--wp--preset--color--vivid-red:#cf2e2e;--wp--preset--color--luminous-vivid-orange:#ff6900;--wp--preset--color--luminous-vivid-amber:#fcb900;--wp--preset--color--light-green-cyan:#7bdcb5;--wp--preset--color--vivid-green-cyan:#00d084;--wp--preset--color--pale-cyan-blue:#8ed1fc;--wp--preset--color--vivid-cyan-blue:#0693e3;--wp--preset--color--vivid-purple:#9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple:linear-gradient(135deg,rgba(6,147,227,1) 0%,#9b51e0 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan:linear-gradient(135deg,#7adcb4 0%,#00d082 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange:linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red:linear-gradient(135deg,rgba(255,105,0,1) 0%,#cf2e2e 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray:linear-gradient(135deg,#eee 0%,#a9b8c3 100%);--wp--preset--gradient--cool-to-warm-spectrum:linear-gradient(135deg,#4aeadc 0%,#9778d1 20%,#cf2aba 40%,#ee2c82 60%,#fb6962 80%,#fef84c 100%);--wp--preset--gradient--blush-light-purple:linear-gradient(135deg,#ffceec 0%,#9896f0 100%);--wp--preset--gradient--blush-bordeaux:linear-gradient(135deg,#fecda5 0%,#fe2d2d 50%,#6b003e 100%);--wp--preset--gradient--luminous-dusk:linear-gradient(135deg,#ffcb70 0%,#c751c0 50%,#4158d0 100%);--wp--preset--gradient--pale-ocean:linear-gradient(135deg,#fff5cb 0%,#b6e3d4 50%,#33a7b5 100%);--wp--preset--gradient--electric-grass:linear-gradient(135deg,#caf880 0%,#71ce7e 100%);--wp--preset--gradient--midnight:linear-gradient(135deg,#020381 0%,#2874fc 100%);--wp--preset--font-size--small:13px;--wp--preset--font-size--medium:20px;--wp--preset--font-size--large:36px;--wp--preset--font-size--x-large:42px;--wp--preset--font-family--inter:"Inter" , sans-serif;--wp--preset--font-family--cardo:Cardo;--wp--preset--spacing--20:.44rem;--wp--preset--spacing--30:.67rem;--wp--preset--spacing--40:1rem;--wp--preset--spacing--50:1.5rem;--wp--preset--spacing--60:2.25rem;--wp--preset--spacing--70:3.38rem;--wp--preset--spacing--80:5.06rem;--wp--preset--shadow--natural:6px 6px 9px rgba(0,0,0,.2);--wp--preset--shadow--deep:12px 12px 50px rgba(0,0,0,.4);--wp--preset--shadow--sharp:6px 6px 0 rgba(0,0,0,.2);--wp--preset--shadow--outlined:6px 6px 0 -3px rgba(255,255,255,1) , 6px 6px rgba(0,0,0,1);--wp--preset--shadow--crisp:6px 6px 0 rgba(0,0,0,1)}:where(.is-layout-flex){gap:.5em}:where(.is-layout-grid){gap:.5em}body .is-layout-flex{display:flex}.is-layout-flex{flex-wrap:wrap;align-items:center}.is-layout-flex > :is(*, div){margin:0}body .is-layout-grid{display:grid}.is-layout-grid > :is(*, div){margin:0}:where(.wp-block-columns.is-layout-flex){gap:2em}:where(.wp-block-columns.is-layout-grid){gap:2em}:where(.wp-block-post-template.is-layout-flex){gap:1.25em}:where(.wp-block-post-template.is-layout-grid){gap:1.25em}.has-black-color{color:var(--wp--preset--color--black)!important}.has-cyan-bluish-gray-color{color:var(--wp--preset--color--cyan-bluish-gray)!important}.has-white-color{color:var(--wp--preset--color--white)!important}.has-pale-pink-color{color:var(--wp--preset--color--pale-pink)!important}.has-vivid-red-color{color:var(--wp--preset--color--vivid-red)!important}.has-luminous-vivid-orange-color{color:var(--wp--preset--color--luminous-vivid-orange)!important}.has-luminous-vivid-amber-color{color:var(--wp--preset--color--luminous-vivid-amber)!important}.has-light-green-cyan-color{color:var(--wp--preset--color--light-green-cyan)!important}.has-vivid-green-cyan-color{color:var(--wp--preset--color--vivid-green-cyan)!important}.has-pale-cyan-blue-color{color:var(--wp--preset--color--pale-cyan-blue)!important}.has-vivid-cyan-blue-color{color:var(--wp--preset--color--vivid-cyan-blue)!important}.has-vivid-purple-color{color:var(--wp--preset--color--vivid-purple)!important}.has-black-background-color{background-color:var(--wp--preset--color--black)!important}.has-cyan-bluish-gray-background-color{background-color:var(--wp--preset--color--cyan-bluish-gray)!important}.has-white-background-color{background-color:var(--wp--preset--color--white)!important}.has-pale-pink-background-color{background-color:var(--wp--preset--color--pale-pink)!important}.has-vivid-red-background-color{background-color:var(--wp--preset--color--vivid-red)!important}.has-luminous-vivid-orange-background-color{background-color:var(--wp--preset--color--luminous-vivid-orange)!important}.has-luminous-vivid-amber-background-color{background-color:var(--wp--preset--color--luminous-vivid-amber)!important}.has-light-green-cyan-background-color{background-color:var(--wp--preset--color--light-green-cyan)!important}.has-vivid-green-cyan-background-color{background-color:var(--wp--preset--color--vivid-green-cyan)!important}.has-pale-cyan-blue-background-color{background-color:var(--wp--preset--color--pale-cyan-blue)!important}.has-vivid-cyan-blue-background-color{background-color:var(--wp--preset--color--vivid-cyan-blue)!important}.has-vivid-purple-background-color{background-color:var(--wp--preset--color--vivid-purple)!important}.has-black-border-color{border-color:var(--wp--preset--color--black)!important}.has-cyan-bluish-gray-border-color{border-color:var(--wp--preset--color--cyan-bluish-gray)!important}.has-white-border-color{border-color:var(--wp--preset--color--white)!important}.has-pale-pink-border-color{border-color:var(--wp--preset--color--pale-pink)!important}.has-vivid-red-border-color{border-color:var(--wp--preset--color--vivid-red)!important}.has-luminous-vivid-orange-border-color{border-color:var(--wp--preset--color--luminous-vivid-orange)!important}.has-luminous-vivid-amber-border-color{border-color:var(--wp--preset--color--luminous-vivid-amber)!important}.has-light-green-cyan-border-color{border-color:var(--wp--preset--color--light-green-cyan)!important}.has-vivid-green-cyan-border-color{border-color:var(--wp--preset--color--vivid-green-cyan)!important}.has-pale-cyan-blue-border-color{border-color:var(--wp--preset--color--pale-cyan-blue)!important}.has-vivid-cyan-blue-border-color{border-color:var(--wp--preset--color--vivid-cyan-blue)!important}.has-vivid-purple-border-color{border-color:var(--wp--preset--color--vivid-purple)!important}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background:var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple)!important}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background:var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan)!important}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background:var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange)!important}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background:var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red)!important}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background:var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray)!important}.has-cool-to-warm-spectrum-gradient-background{background:var(--wp--preset--gradient--cool-to-warm-spectrum)!important}.has-blush-light-purple-gradient-background{background:var(--wp--preset--gradient--blush-light-purple)!important}.has-blush-bordeaux-gradient-background{background:var(--wp--preset--gradient--blush-bordeaux)!important}.has-luminous-dusk-gradient-background{background:var(--wp--preset--gradient--luminous-dusk)!important}.has-pale-ocean-gradient-background{background:var(--wp--preset--gradient--pale-ocean)!important}.has-electric-grass-gradient-background{background:var(--wp--preset--gradient--electric-grass)!important}.has-midnight-gradient-background{background:var(--wp--preset--gradient--midnight)!important}.has-small-font-size{font-size:var(--wp--preset--font-size--small)!important}.has-medium-font-size{font-size:var(--wp--preset--font-size--medium)!important}.has-large-font-size{font-size:var(--wp--preset--font-size--large)!important}.has-x-large-font-size{font-size:var(--wp--preset--font-size--x-large)!important}:where(.wp-block-post-template.is-layout-flex){gap:1.25em}:where(.wp-block-post-template.is-layout-grid){gap:1.25em}:where(.wp-block-columns.is-layout-flex){gap:2em}:where(.wp-block-columns.is-layout-grid){gap:2em}:root :where(.wp-block-pullquote){font-size:1.5em;line-height:1.6}</style> <style id='related-posts-by-taxonomy-css' media='all'>.rpbt-post-date{display:block;font-size:smaller}.rpbt-screen-reader-text{border:0;clip:rect(1px,1px,1px,1px);-webkit-clip-path:inset(50%);clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-wrap:normal!important}</style> <style id='woocommerce-inline-inline-css' type='text/css'>.woocommerce form .form-row .required{visibility:visible}</style> <link rel='stylesheet' id='siteorigin-corp-style-css' href='https://www.buskill.in/wp-content/A.themes,,_siteorigin-corp,,_style.min.css,,qver==1.20.7+themes,,_siteorigin-corp,,_css,,_siteorigin-corp-icons.min.css,,qver==.min+themes,,_siteorigin-corp,,_woocommerce.min.css,,qver==1.20.7+plugins,,_aurora-heatmap,,_style.css,,qver==1.7.0,Mcc.VRBfRl0jCq.css.pagespeed.cf.-vFE24bxaB.css' type='text/css' media='all'/> <style id='kadence-blocks-global-variables-inline-css' type='text/css'>:root{--global-kb-font-size-sm:clamp(0.8rem, 0.73rem + 0.217vw, 0.9rem);--global-kb-font-size-md:clamp(1.1rem, 0.995rem + 0.326vw, 1.25rem);--global-kb-font-size-lg:clamp(1.75rem, 1.576rem + 0.543vw, 2rem);--global-kb-font-size-xl:clamp(2.25rem, 1.728rem + 1.63vw, 3rem);--global-kb-font-size-xxl:clamp(2.5rem, 1.456rem + 3.26vw, 4rem);--global-kb-font-size-xxxl:clamp(2.75rem, 0.489rem + 7.065vw, 6rem)}:root{--global-palette1:#3182ce;--global-palette2:#2b6cb0;--global-palette3:#1a202c;--global-palette4:#2d3748;--global-palette5:#4a5568;--global-palette6:#718096;--global-palette7:#edf2f7;--global-palette8:#f7fafc;--global-palette9:#fff}</style> <link rel='stylesheet' id='parent-style-css' href='https://www.buskill.in/wp-content/themes/A.siteorigin-corp,,_style.css,,qver==6.6.2+siteorigin-corp-buskill,,_style.css,,qver==0.0.1+siteorigin-corp-buskill,,_fonts,,_fonts.css,,qver==6.6.2+siteorigin-corp-buskill,,_fonts,,_fontawesome,,_css,,_all.css,,qver==6.6.2,Mcc.O7h_YmGVdO.css.pagespeed.cf.qRAAudFlBb.css' type='text/css' media='all'/> <script type="text/javascript" src="https://www.buskill.in/wp-includes/js/jquery/jquery.min.js,qver=3.7.1.pagespeed.jm.PoWN7KAtLT.js" id="jquery-core-js"></script> <script type="text/javascript" src="https://www.buskill.in/wp-includes/js/jquery/jquery-migrate.min.js,qver=3.4.1.pagespeed.jm.bhhu-RahTI.js" id="jquery-migrate-js"></script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js,qver=2.7.0-wc.9.3.3.pagespeed.jm.7mW3IicG32.js" id="jquery-blockui-js" defer="defer" data-wp-strategy="defer"></script> <script type="text/javascript" id="wc-add-to-cart-js-extra">//<![CDATA[ var wc_add_to_cart_params={"ajax_url":"\/wp-admin\/admin-ajax.php","wc_ajax_url":"\/?wc-ajax=%%endpoint%%","i18n_view_cart":"View cart","cart_url":"https:\/\/www.buskill.in\/cart\/","is_cart":"","cart_redirect_after_add":"no"}; //]]></script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js,qver=9.3.3.pagespeed.ce.hkGx-grXHD.js" id="wc-add-to-cart-js" defer="defer" data-wp-strategy="defer"></script> <script type="text/javascript" id="js-cookie-js" defer="defer" data-wp-strategy="defer">//<![CDATA[ !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self,function(){var n=e.Cookies,o=e.Cookies=t();o.noConflict=function(){return e.Cookies=n,o}}())}(this,function(){"use strict";function e(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)e[o]=n[o]}return e}return function t(n,o){function r(t,r,i){if("undefined"!=typeof document){"number"==typeof(i=e({},o,i)).expires&&(i.expires=new Date(Date.now()+864e5*i.expires)),i.expires&&(i.expires=i.expires.toUTCString()),t=encodeURIComponent(t).replace(/%(2[346B]|5E|60|7C)/g,decodeURIComponent).replace(/[()]/g,escape);var c="";for(var u in i)i[u]&&(c+="; "+u,!0!==i[u]&&(c+="="+i[u].split(";")[0]));return document.cookie=t+"="+n.write(r,t)+c}}return Object.create({set:r,get:function(e){if("undefined"!=typeof document&&(!arguments.length||e)){for(var t=document.cookie?document.cookie.split("; "):[],o={},r=0;r<t.length;r++){var i=t[r].split("="),c=i.slice(1).join("=");try{var u=decodeURIComponent(i[0]);if(o[u]=n.read(c,u),e===u)break}catch(f){}}return e?o[e]:o}},remove:function(t,n){r(t,"",e({},n,{expires:-1}))},withAttributes:function(n){return t(this.converter,e({},this.attributes,n))},withConverter:function(n){return t(e({},this.converter,n),this.attributes)}},{attributes:{value:Object.freeze(o)},converter:{value:Object.freeze(n)}})}({read:function(e){return'"'===e[0]&&(e=e.slice(1,-1)),e.replace(/(%[\dA-F]{2})+/gi,decodeURIComponent)},write:function(e){return encodeURIComponent(e).replace(/%(2[346BF]|3[AC-F]|40|5[BDE]|60|7[BCD])/g,decodeURIComponent)}},{path:"/"})}); //]]></script> <script type="text/javascript" id="woocommerce-js-extra">//<![CDATA[ var woocommerce_params={"ajax_url":"\/wp-admin\/admin-ajax.php","wc_ajax_url":"\/?wc-ajax=%%endpoint%%"}; //]]></script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js,qver=9.3.3.pagespeed.ce.sDiQv39NQm.js" id="woocommerce-js" defer="defer" data-wp-strategy="defer"></script> <script type="text/javascript" id="aurora-heatmap-js-extra">//<![CDATA[ var aurora_heatmap={"_mode":"reporter","ajax_url":"https:\/\/www.buskill.in\/wp-admin\/admin-ajax.php","action":"aurora_heatmap","reports":"click_pc,click_mobile","debug":"0","ajax_delay_time":"3000","ajax_interval":"10","ajax_bulk":null}; //]]></script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/aurora-heatmap/js/aurora-heatmap.min.js,qver=1.7.0.pagespeed.ce.a2314VvSTm.js" id="aurora-heatmap-js"></script> <link rel="https://api.w.org/" href="https://www.buskill.in/wp-json/"/><link rel="alternate" title="JSON" type="application/json" href="https://www.buskill.in/wp-json/wp/v2/posts/4738"/><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://www.buskill.in/xmlrpc.php?rsd"/> <meta name="generator" content="WordPress 6.6.2"/> <meta name="generator" content="WooCommerce 9.3.3"/> <link rel='shortlink' href='https://www.buskill.in/?p=4738'/> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://www.buskill.in/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F"/> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://www.buskill.in/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&format=xml"/> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="pingback" href="https://www.buskill.in/xmlrpc.php"> <noscript><style>.woocommerce-product-gallery{opacity:1!important}</style></noscript> <style type="text/css" id="siteorigin-corp-settings-custom" data-siteorigin-settings="true">.site-footer .widgets{padding:25px 0}@media (max-width:768px){#masthead .search-toggle{margin:0 20px 0 0}.site-header .shopping-cart{margin:0 37px 0 0}#masthead #mobile-menu-button{display:inline-block}#masthead .main-navigation:not(.mega-menu) ul:not(.shopping-cart) {display:none}#masthead .main-navigation .search-icon{display:none}.site-header.centered .site-branding{margin:0;padding-right:20px;text-align:left}.centered.site-header .site-header-inner{flex-direction:row}.site-header.centered .main-navigation{text-align:left}}@media (min-width:769px){#masthead #mobile-navigation{display:none}}</style> <style id='wp-fonts-local' type='text/css'>@font-face{font-family:Inter;font-style:normal;font-weight:300 900;font-display:fallback;src:url(https://www.buskill.in/wp-content/plugins/woocommerce/assets/fonts/Inter-VariableFont_slnt,wght.woff2) format('woff2');font-stretch:normal}@font-face{font-family:Cardo;font-style:normal;font-weight:400;font-display:fallback;src:url(https://www.buskill.in/wp-content/plugins/woocommerce/assets/fonts/cardo_normal_400.woff2) format('woff2')}</style> <link rel="icon" href="https://www.buskill.in/wp-content/uploads/sites/8/2020/02/xfavico_150b.202002.png.pagespeed.ic.QyNQFid9cf.jpg" sizes="32x32"/> <link rel="icon" href="https://www.buskill.in/wp-content/uploads/sites/8/2020/02/xfavico_150b.202002.png.pagespeed.ic.QyNQFid9cf.jpg" sizes="192x192"/> <link rel="apple-touch-icon" href="https://www.buskill.in/wp-content/uploads/sites/8/2020/02/xfavico_150b.202002.png.pagespeed.ic.QyNQFid9cf.jpg"/> <meta name="msapplication-TileImage" content="https://www.buskill.in/wp-content/uploads/sites/8/2020/02/favico_150b.202002.png"/> </head> <body class="post-template-default single single-post postid-4738 single-format-standard theme-siteorigin-corp woocommerce-no-js blog-full css3-animations no-js page-layout-default sidebar no-topbar"> <div id="page" class="site"> <a class="skip-link screen-reader-text" href="#content">Skip to content</a> <header id="masthead" class="site-header mobile-menu"> <div class="corp-container"> <div class="site-header-inner"> <div class="site-branding"> <p class="site-title"> <a href="https://www.buskill.in/" rel="home"> BusKill </a> </p> </div> <nav id="site-navigation" class="main-navigation link-underline "> <div class="menu-main-menu-container"><ul id="primary-menu" class="menu"><li id="menu-item-5962" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-5962"><a href="/#demo">What is BusKill?</a></li> <li id="menu-item-4633" class="corp-scroll menu-item menu-item-type-custom menu-item-object-custom menu-item-4633"><a href="/demo/">Demo</a></li> <li id="menu-item-4640" class="corp-scroll menu-item menu-item-type-custom menu-item-object-custom menu-item-4640"><a href="/#faq">FAQ</a></li> <li id="menu-item-4643" class="menu-button corp-scroll menu-item menu-item-type-custom menu-item-object-custom menu-item-4643"><a href="/store/">Buy Now</a></li> <li id="menu-item-4284" class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-4284"><a href="https://www.buskill.in/blog/">News</a></li> </ul></div> <ul class="shopping-cart"> <li> <a class="shopping-cart-link" href="https://www.buskill.in/cart/" title="View shopping cart"> <span class="screen-reader-text">View shopping cart</span> <svg xmlns="http://www.w3.org/2000/svg" width="16.97" height="16" viewBox="0 0 16.97 16"> <path id="cart" class="cls-1" d="M1313.9,36.289l-2.01,6a0.994,0.994,0,0,1-.95.711h-7.35a0.962,0.962,0,0,1-.35-0.072c-0.04-.015-0.07-0.037-0.11-0.056a0.969,0.969,0,0,1-.19-0.131,0.644,0.644,0,0,1-.1-0.1c-0.04-.056-0.08-0.117-0.12-0.184-0.02-.043-0.04-0.084-0.06-0.13-0.01-.024-0.02-0.043-0.03-0.068l-2.09-7.07A1.779,1.779,0,0,0,1298.98,34h-0.99a1,1,0,0,1,0-2h0.99a3.773,3.773,0,0,1,3.49,2.669l0.1,0.332h10.38a1,1,0,0,1,.8.4A0.969,0.969,0,0,1,1313.9,36.289Zm-10.74.71,1.18,4h5.85l1.41-4h-8.44Zm0.81,7a2,2,0,1,1-2,2A2,2,0,0,1,1303.97,44Zm6.99,0a2,2,0,1,1-2,2A2,2,0,0,1,1310.96,44Z" transform="translate(-1297 -32)"/> </svg> <span class="shopping-cart-text">View Cart</span> <span class="shopping-cart-count">0</span> </a> <ul class="shopping-cart-dropdown" id="cart-drop"> <div class="widget woocommerce widget_shopping_cart"><div class="widget_shopping_cart_content"></div></div> </ul> </li> </ul> <button id="search-button" class="search-toggle" aria-label="Open Search"> <span class="open"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="26" height="28" viewBox="0 0 26 28"> <path d="M18 13c0-3.859-3.141-7-7-7s-7 3.141-7 7 3.141 7 7 7 7-3.141 7-7zM26 26c0 1.094-0.906 2-2 2-0.531 0-1.047-0.219-1.406-0.594l-5.359-5.344c-1.828 1.266-4.016 1.937-6.234 1.937-6.078 0-11-4.922-11-11s4.922-11 11-11 11 4.922 11 11c0 2.219-0.672 4.406-1.937 6.234l5.359 5.359c0.359 0.359 0.578 0.875 0.578 1.406z"></path> </svg> </span> </button> <a href="#menu" id="mobile-menu-button"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="27" height="32" viewBox="0 0 27 32"> <path d="M27.429 24v2.286q0 0.464-0.339 0.804t-0.804 0.339h-25.143q-0.464 0-0.804-0.339t-0.339-0.804v-2.286q0-0.464 0.339-0.804t0.804-0.339h25.143q0.464 0 0.804 0.339t0.339 0.804zM27.429 14.857v2.286q0 0.464-0.339 0.804t-0.804 0.339h-25.143q-0.464 0-0.804-0.339t-0.339-0.804v-2.286q0-0.464 0.339-0.804t0.804-0.339h25.143q0.464 0 0.804 0.339t0.339 0.804zM27.429 5.714v2.286q0 0.464-0.339 0.804t-0.804 0.339h-25.143q-0.464 0-0.804-0.339t-0.339-0.804v-2.286q0-0.464 0.339-0.804t0.804-0.339h25.143q0.464 0 0.804 0.339t0.339 0.804z"></path> </svg> <span class="screen-reader-text">Menu</span> </a> </nav> <div id="fullscreen-search"> <div class="corp-container"> <span>Type and press enter to search</span> <form id="fullscreen-search-form" method="get" action="https://www.buskill.in"> <input type="search" name="s" placeholder="" aria-label="Search for" value=""/> <button type="submit" aria-label="Search"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="26" height="28" viewBox="0 0 26 28"> <path d="M18 13c0-3.859-3.141-7-7-7s-7 3.141-7 7 3.141 7 7 7 7-3.141 7-7zM26 26c0 1.094-0.906 2-2 2-0.531 0-1.047-0.219-1.406-0.594l-5.359-5.344c-1.828 1.266-4.016 1.937-6.234 1.937-6.078 0-11-4.922-11-11s4.922-11 11-11 11 4.922 11 11c0 2.219-0.672 4.406-1.937 6.234l5.359 5.359c0.359 0.359 0.578 0.875 0.578 1.406z"></path> </svg> </button> </form> </div> <button id="search-close-button" class="search-close-button" aria-label="Close search"> <span class="close"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24" height="24" viewBox="0 0 24 24"> <path d="M18.984 6.422l-5.578 5.578 5.578 5.578-1.406 1.406-5.578-5.578-5.578 5.578-1.406-1.406 5.578-5.578-5.578-5.578 1.406-1.406 5.578 5.578 5.578-5.578z"></path> </svg> </span> </button> </div> </div> </div> </header> <div id="content" class="site-content"> <div class="corp-container"> <div id="primary" class="content-area"> <main id="main" class="site-main"> <article id="post-4738" class="post-4738 post type-post status-publish format-standard has-post-thumbnail hentry category-featured category-news tag-anti-forensics tag-buskill tag-cryptsetup tag-dead-man-switch tag-demo tag-dm-crypt tag-forensics tag-hexdump tag-kali tag-kill-cord tag-linux tag-luks tag-self-destruct tag-trigger tag-ubuntu"> <div class="corp-content-wrapper"> <header class="entry-header"> <h1 class="entry-title">LUKS Header Shredder (BusKill Self-Destruct Trigger)</h1> <div class="entry-meta"> <span class="entry-date"><time class="published" datetime="2021-12-28T15:48:54+00:00">December 28, 2021</time><time class="updated" datetime="2025-01-22T21:34:29+00:00">January 22, 2025</time></span><span class="byline"><span class="author vcard"><a class="url fn n" href="https://www.buskill.in/author/tech/" rel="author">Michael Altfield</a></span></span> </div> </header> <div class="entry-content"> <div class="ShariffSC" style="margin-bottom:19px;"><div class="shariff shariff-align-flex-start shariff-widget-align-flex-start" style="display:none"><ul class="shariff-buttons theme-default orientation-horizontal buttonsize-medium"><li class="shariff-button facebook shariff-nocustomcolor" style="background-color:#4273c8"><a href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on Facebook" aria-label="Share on Facebook" role="button" rel="nofollow" class="shariff-link" style="; background-color:#3b5998; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 32"><path fill="#3b5998" d="M17.1 0.2v4.7h-2.8q-1.5 0-2.1 0.6t-0.5 1.9v3.4h5.2l-0.7 5.3h-4.5v13.6h-5.5v-13.6h-4.5v-5.3h4.5v-3.9q0-3.3 1.9-5.2t5-1.8q2.6 0 4.1 0.2z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button twitter shariff-nocustomcolor" style="background-color:#595959"><a href="https://twitter.com/share?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&text=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29&via=BusKillin" title="Share on X" aria-label="Share on X" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#000; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill="#000" d="M14.258 10.152L23.176 0h-2.113l-7.747 8.813L7.133 0H0l9.352 13.328L0 23.973h2.113l8.176-9.309 6.531 9.309h7.133zm-2.895 3.293l-.949-1.328L2.875 1.56h3.246l6.086 8.523.945 1.328 7.91 11.078h-3.246zm0 0"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button reddit shariff-nocustomcolor" style="background-color:#ff5700"><a href="https://www.reddit.com/submit?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on Reddit" aria-label="Share on Reddit" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#ff4500; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path fill="#ff4500" d="M440.3 203.5c-15 0-28.2 6.2-37.9 15.9-35.7-24.7-83.8-40.6-137.1-42.3L293 52.3l88.2 19.8c0 21.6 17.6 39.2 39.2 39.2 22 0 39.7-18.1 39.7-39.7s-17.6-39.7-39.7-39.7c-15.4 0-28.7 9.3-35.3 22l-97.4-21.6c-4.9-1.3-9.7 2.2-11 7.1L246.3 177c-52.9 2.2-100.5 18.1-136.3 42.8-9.7-10.1-23.4-16.3-38.4-16.3-55.6 0-73.8 74.6-22.9 100.1-1.8 7.9-2.6 16.3-2.6 24.7 0 83.8 94.4 151.7 210.3 151.7 116.4 0 210.8-67.9 210.8-151.7 0-8.4-.9-17.2-3.1-25.1 49.9-25.6 31.5-99.7-23.8-99.7zM129.4 308.9c0-22 17.6-39.7 39.7-39.7 21.6 0 39.2 17.6 39.2 39.7 0 21.6-17.6 39.2-39.2 39.2-22 .1-39.7-17.6-39.7-39.2zm214.3 93.5c-36.4 36.4-139.1 36.4-175.5 0-4-3.5-4-9.7 0-13.7 3.5-3.5 9.7-3.5 13.2 0 27.8 28.5 120 29 149 0 3.5-3.5 9.7-3.5 13.2 0 4.1 4 4.1 10.2.1 13.7zm-.8-54.2c-21.6 0-39.2-17.6-39.2-39.2 0-22 17.6-39.7 39.2-39.7 22 0 39.7 17.6 39.7 39.7-.1 21.5-17.7 39.2-39.7 39.2z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button diaspora shariff-nocustomcolor" style="background-color:#b3b3b3"><a href="https://share.diasporafoundation.org/?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&title=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29" title="Share on diaspora*" aria-label="Share on diaspora*" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#999; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 33 32"><path fill="#999" d="M20.6 28.2c-0.8-1.2-2.1-2.9-2.9-4-0.8-1.1-1.4-1.9-1.4-1.9s-1.2 1.6-2.8 3.8c-1.5 2.1-2.8 3.8-2.8 3.8 0 0-5.5-3.9-5.5-3.9 0 0 1.2-1.8 2.8-4s2.8-4 2.8-4.1c0-0.1-0.5-0.2-4.4-1.5-2.4-0.8-4.4-1.5-4.4-1.5 0 0 0.2-0.8 1-3.2 0.6-1.8 1-3.2 1.1-3.3s2.1 0.6 4.6 1.5c2.5 0.8 4.6 1.5 4.6 1.5s0.1 0 0.1-0.1c0 0 0-2.2 0-4.8s0-4.7 0.1-4.7c0 0 0.7 0 3.3 0 1.8 0 3.3 0 3.4 0 0 0 0.1 1.4 0.2 4.6 0.1 5.2 0.1 5.3 0.2 5.3 0 0 2-0.7 4.5-1.5s4.4-1.5 4.4-1.5c0 0.1 2 6.5 2 6.5 0 0-2 0.7-4.5 1.5-3.4 1.1-4.5 1.5-4.5 1.6 0 0 1.2 1.8 2.6 3.9 1.5 2.1 2.6 3.9 2.6 3.9 0 0-5.4 4-5.5 4 0 0-0.7-0.9-1.5-2.1z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button linkedin shariff-nocustomcolor" style="background-color:#1488bf"><a href="https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on LinkedIn" aria-label="Share on LinkedIn" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#0077b5; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 27 32"><path fill="#0077b5" d="M6.2 11.2v17.7h-5.9v-17.7h5.9zM6.6 5.7q0 1.3-0.9 2.2t-2.4 0.9h0q-1.5 0-2.4-0.9t-0.9-2.2 0.9-2.2 2.4-0.9 2.4 0.9 0.9 2.2zM27.4 18.7v10.1h-5.9v-9.5q0-1.9-0.7-2.9t-2.3-1.1q-1.1 0-1.9 0.6t-1.2 1.5q-0.2 0.5-0.2 1.4v9.9h-5.9q0-7.1 0-11.6t0-5.3l0-0.9h5.9v2.6h0q0.4-0.6 0.7-1t1-0.9 1.6-0.8 2-0.3q3 0 4.9 2t1.9 6z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button whatsapp shariff-nocustomcolor" style="background-color:#5cbe4a"><a href="https://api.whatsapp.com/send?text=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F%20LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29" title="Share on Whatsapp" aria-label="Share on Whatsapp" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#34af23; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path fill="#34af23" d="M17.6 17.4q0.2 0 1.7 0.8t1.6 0.9q0 0.1 0 0.3 0 0.6-0.3 1.4-0.3 0.7-1.3 1.2t-1.8 0.5q-1 0-3.4-1.1-1.7-0.8-3-2.1t-2.6-3.3q-1.3-1.9-1.3-3.5v-0.1q0.1-1.6 1.3-2.8 0.4-0.4 0.9-0.4 0.1 0 0.3 0t0.3 0q0.3 0 0.5 0.1t0.3 0.5q0.1 0.4 0.6 1.6t0.4 1.3q0 0.4-0.6 1t-0.6 0.8q0 0.1 0.1 0.3 0.6 1.3 1.8 2.4 1 0.9 2.7 1.8 0.2 0.1 0.4 0.1 0.3 0 1-0.9t0.9-0.9zM14 26.9q2.3 0 4.3-0.9t3.6-2.4 2.4-3.6 0.9-4.3-0.9-4.3-2.4-3.6-3.6-2.4-4.3-0.9-4.3 0.9-3.6 2.4-2.4 3.6-0.9 4.3q0 3.6 2.1 6.6l-1.4 4.2 4.3-1.4q2.8 1.9 6.2 1.9zM14 2.2q2.7 0 5.2 1.1t4.3 2.9 2.9 4.3 1.1 5.2-1.1 5.2-2.9 4.3-4.3 2.9-5.2 1.1q-3.5 0-6.5-1.7l-7.4 2.4 2.4-7.2q-1.9-3.2-1.9-6.9 0-2.7 1.1-5.2t2.9-4.3 4.3-2.9 5.2-1.1z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button threema shariff-nocustomcolor shariff-mobile" style="background-color:#4fbc24"><a href="threema://compose?text=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29%20https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on Threema" aria-label="Share on Threema" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#1f1f1f; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path fill="#1f1f1f" d="M30.8 10.9c-0.3-1.4-0.9-2.6-1.8-3.8-2-2.6-5.5-4.5-9.4-5.2-1.3-0.2-1.9-0.3-3.5-0.3s-2.2 0-3.5 0.3c-4 0.7-7.4 2.6-9.4 5.2-0.9 1.2-1.5 2.4-1.8 3.8-0.1 0.5-0.2 1.2-0.2 1.6 0 0.4 0.1 1.1 0.2 1.6 0.4 1.9 1.3 3.4 2.9 5 0.8 0.8 0.8 0.8 0.7 1.3 0 0.6-0.5 1.6-1.7 3.6-0.3 0.5-0.5 0.9-0.5 0.9 0 0.1 0.1 0.1 0.5 0 0.8-0.2 2.3-0.6 5.6-1.6 1.1-0.3 1.3-0.4 2.3-0.4 0.8 0 1.1 0 2.3 0.2 1.5 0.2 3.5 0.2 4.9 0 5.1-0.6 9.3-2.9 11.4-6.3 0.5-0.9 0.9-1.8 1.1-2.8 0.1-0.5 0.2-1.1 0.2-1.6 0-0.7-0.1-1.1-0.2-1.6-0.3-1.4 0.1 0.5 0 0zM20.6 17.3c0 0.4-0.4 0.8-0.8 0.8h-7.7c-0.4 0-0.8-0.4-0.8-0.8v-4.6c0-0.4 0.4-0.8 0.8-0.8h0.2l0-1.6c0-0.9 0-1.8 0.1-2 0.1-0.6 0.6-1.2 1.1-1.7s1.1-0.7 1.9-0.8c1.8-0.3 3.7 0.7 4.2 2.2 0.1 0.3 0.1 0.7 0.1 2.1v0 1.7h0.1c0.4 0 0.8 0.4 0.8 0.8v4.6zM15.6 7.3c-0.5 0.1-0.8 0.3-1.2 0.6s-0.6 0.8-0.7 1.3c0 0.2 0 0.8 0 1.5l0 1.2h4.6v-1.3c0-1 0-1.4-0.1-1.6-0.3-1.1-1.5-1.9-2.6-1.7zM25.8 28.2c0 1.2-1 2.2-2.1 2.2s-2.1-1-2.1-2.1c0-1.2 1-2.1 2.2-2.1s2.2 1 2.2 2.2zM18.1 28.2c0 1.2-1 2.2-2.1 2.2s-2.1-1-2.1-2.1c0-1.2 1-2.1 2.2-2.1s2.2 1 2.2 2.2zM10.4 28.2c0 1.2-1 2.2-2.1 2.2s-2.1-1-2.1-2.1c0-1.2 1-2.1 2.2-2.1s2.2 1 2.2 2.2z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button telegram shariff-nocustomcolor" style="background-color:#4084A6"><a href="https://telegram.me/share/url?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&text=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29" title="Share on Telegram" aria-label="Share on Telegram" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#0088cc; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path fill="#0088cc" d="M30.8 6.5l-4.5 21.4c-.3 1.5-1.2 1.9-2.5 1.2L16.9 24l-3.3 3.2c-.4.4-.7.7-1.4.7l.5-7L25.5 9.2c.6-.5-.1-.8-.9-.3l-15.8 10L2 16.7c-1.5-.5-1.5-1.5.3-2.2L28.9 4.3c1.3-.5 2.3.3 1.9 2.2z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button sms shariff-nocustomcolor shariff-mobile" style="background-color:#d7d9d8"><a href="sms:?&body=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on SMS" aria-label="Share on SMS" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#a1e877; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg xmlns="http://www.w3.org/2000/svg" width="510" height="510" viewBox="0 0 510 510"><path fill="#a1e877" d="M459 0H51C23 0 0 23 0 51v459l102-102h357c28.1 0 51-22.9 51-51V51C510 23 487.1 0 459 0zM178.5 229.5h-51v-51h51V229.5zM280.5 229.5h-51v-51h51V229.5zM382.5 229.5h-51v-51h51V229.5z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button mailto shariff-nocustomcolor" style="background-color:#a8a8a8"><a href="mailto:?body=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&subject=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29" title="Send by email" aria-label="Send by email" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#999; color:#fff"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path fill="#999" d="M32 12.7v14.2q0 1.2-0.8 2t-2 0.9h-26.3q-1.2 0-2-0.9t-0.8-2v-14.2q0.8 0.9 1.8 1.6 6.5 4.4 8.9 6.1 1 0.8 1.6 1.2t1.7 0.9 2 0.4h0.1q0.9 0 2-0.4t1.7-0.9 1.6-1.2q3-2.2 8.9-6.1 1-0.7 1.8-1.6zM32 7.4q0 1.4-0.9 2.7t-2.2 2.2q-6.7 4.7-8.4 5.8-0.2 0.1-0.7 0.5t-1 0.7-0.9 0.6-1.1 0.5-0.9 0.2h-0.1q-0.4 0-0.9-0.2t-1.1-0.5-0.9-0.6-1-0.7-0.7-0.5q-1.6-1.1-4.7-3.2t-3.6-2.6q-1.1-0.7-2.1-2t-1-2.5q0-1.4 0.7-2.3t2.1-0.9h26.3q1.2 0 2 0.8t0.9 2z"/></svg></span><span class="shariff-text">email</span> </a></li><li class="shariff-button bitcoin shariff-nocustomcolor" style="background-color:#191919"><a href="https://www.buskill.in/wp-content/plugins/shariff/services/../bitcoin.php?bitcoinaddress=1DXyJpmu2KQMw2v4QJVzzjZo6f87BBndu6" title="Donate with Bitcoin" aria-label="Donate with Bitcoin" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#f7931a; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 23 32"><path fill="#f7931a" d="M20.8 11.4q0.3 3.3-2.3 4.6 2.1 0.5 3.1 1.8t0.8 3.8q-0.1 1.3-0.6 2.2t-1.2 1.6-1.7 1-2.2 0.6-2.6 0.3v4.6h-2.7v-4.5q-1.4 0-2.2 0v4.5h-2.7v-4.6q-0.3 0-1 0t-1 0h-3.6l0.6-3.3h2q0.9 0 1-0.9v-7.2h0.3q-0.1 0-0.3 0v-5.1q-0.2-1.2-1.6-1.2h-2v-2.9l3.8 0q1.1 0 1.7 0v-4.5h2.8v4.4q1.5 0 2.2 0v-4.4h2.8v4.5q1.4 0.1 2.5 0.4t2 0.8 1.5 1.4 0.7 2zM17 21.2q0-0.6-0.3-1.1t-0.7-0.8-1-0.5-1.2-0.3-1.3-0.2-1.2-0.1-1.2 0-0.8 0v6q0.1 0 0.7 0t0.9 0 0.9 0 1-0.1 1-0.2 1-0.2 0.8-0.4 0.7-0.5 0.4-0.7 0.2-0.9zM15.7 12.7q0-0.6-0.2-1t-0.5-0.7-0.9-0.5-1-0.3-1.1-0.1-1 0-1 0-0.7 0v5.5q0.1 0 0.6 0t0.8 0 0.9 0 1-0.1 0.9-0.2 0.9-0.3 0.7-0.5 0.5-0.7 0.2-0.9z"/></svg></span><span class="shariff-text">donate</span> </a></li></ul></div></div><p>This post will describe how to add a trigger that initiates a “self-destruct” sequence when your BusKill laptop kill cord’s connection is severed–rendering your data permanently & irrevocably destroyed in the event that your laptop were physically separated from you (ie: by a snach-and-run thief).</p> <p><a href="https://www.buskill.in/wp-content/uploads/sites/8/2020/10/luksHeaderShredder_featuredImage.jpg"><img fetchpriority="high" decoding="async" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/10/xluksHeaderShredder_featuredImage-1024x536.jpg.pagespeed.ic.ZXb_1R5IeA.jpg" alt="LUKS Header Shredder" width="1024" height="536" class="aligncenter size-full wp-image-5054"/></a></p> <p>Many people were disappointed when the <a href="/buskill-laptop-kill-cord-dead-man-switch/">original post</a> introducing BusKill only <em>alluded</em> to a self-destruct trigger, without actually describing how to use it with BusKill. This was done for two reasons:</p> <ol> <li>Most people probably don’t <em>actually</em> want an accidental false-positive to destroy all their data and<br/> </li> <li>A self-destruct sequence should be taken seriously. Its implementation should be thoroughly thought-out, tested, and forensically analyzed</li> </ol> <p>This article will provide that thorough analysis and explain to the reader how to implement a self-destruct trigger with BusKill on linux machines that have FDE with LUKS.</p> <div style="position: relative; padding-top: 56.25%;"><iframe title="BusKill Self-Destruct: LUKS Header Shredder" width="100%" height="100%" src="https://makertube.net/videos/embed/f5ce7825-cd8e-439b-b506-33cd711ec2c2?title=0" frameborder="0" allowfullscreen="" sandbox="allow-same-origin allow-scripts allow-popups allow-forms" style="position: absolute; inset: 0px;"></iframe></div> <p>Can’t see video above? Watch it on <a href="https://makertube.net/w/wmuhNrD9TyerNMMXzAaKyf">PeerTube</a> or on <a href="https://youtu.be/WA8sL4236jM">YouTube at youtu.be/WA8sL4236jM</a></p> <p><span id="more-4738"></span></p> <blockquote><p> Note: This is a very long article providing a detailed explanation on our forensic analysis in Kali to prove the efficacy of our self-destruct script. If you’d like, you can <a href="#selfdestruct">skip to the Install Steps</a>.</p> <p>But <strong>please read the <a href="#disclaimer">disclaimer</a> first</strong>, to understand the risks. </p></blockquote> <h1 id="disclaimer">Disclaimer</h1> <p>This guide contains experimental files, commands, and software. The information contained in this article may or may not lead to corruption or total permanent deletion of some or all of your data. We’ve done our best to carefully guide the reader so they know the risks of each BusKill trigger, but we cannot be responsible for any data loss that has occurred as a result of following this guide.</p> <p>The contents of this guide is provided openly and is licensed under the <a href="https://creativecommons.org/licenses/by-sa/4.0/">CC-BY-SA</a> license. The software included in this guide is licensed under the <a href="https://www.gnu.org/licenses/gpl-3.0.html">GNU GPLv3</a> license. All content here is consistent with the limitations of liabilities outlined in its respective licenses.</p> <p>We highly recommend that any experiments with the scripts included in this article are used exclusively on a disposable machine containing no valuable data.</p> <p>If data loss is a concern for you, then leave now and do not proceed with following this guide. You have been warned.</p> <h2>Release Note</h2> <p>Also be aware that, due to the risks outlined above, BusKill will <em>not</em> be released with this “self-destruct” trigger. </p> <blockquote class="right"><p> BusKill will not be released with this “self-destruct” trigger. If you <a href="/buy">purchase</a> a BusKill cable, it will <em>only</em> ship with non-destructive triggers </p></blockquote> <p>If you <a href="/buy">purchase</a> a BusKill cable, it will only ship with non-destructive triggers that lock the screen or shutdown the computer. Advanced users can follow guides to add additional destructive triggers, such as the one described in this post, but they should do so at their own risk–taking carefully into consideration all of the warnings outlined above and throughout this article.</p> <p><strong>If you <a href="/buy">buy</a> a BusKill cable, the worst that can happen is your computer will abruptly shutdown.</strong></p> <h1>Investigating the LUKS Header</h1> <p>Before we go through the process of wiping our FDE LUKS header, let’s take some time to dig into the LUKS header’s structure and poke at it. That way, we can compare the actual bits on the storage drive before & after the self-destruct trigger has run, and we can do a forensic analysis to validate that our self-destruct trigger is working.</p> <p>Some of this data will necessarily be unencrypted metadata areas, some will be a bunch of 0s buffering between areas, and some will be areas of just uninteligible/encrypted data.</p> <h2>Create Example LUKS Volume</h2> <p>In this article, I’m going to be publishing hexdumps of an encrypted LUKS volume’s header. This header contains the master key, salts, and other data that <em>you</em> absolutely <strong>never</strong> want to share with others.</p> <p>For the purposes of this guide, we’ll be creating an ephemeral LUKS volume on a file. This has the added benefit of permitting the reader to follow-along with the commands on their own system without requiring our device names to match.</p> <p>First, let’s create a 20M file from random data</p> <pre class="brush: bash; title: ; notranslate" title=""> user@host:~$ head -c 20M /dev/urandom > luksVol1 user@host:~$ du -sh luksVol1 20M luksVol1 user@host:~$ </pre> <p>Now make it a LUKS volume. This command will make you type ‘<code>YES</code>‘ to confirm before it will overwrite ‘<code>luksVol1</code>‘. It will also ask you for a passphrase.</p> <pre class="brush: bash; title: ; notranslate" title=""> user@host:~$ sudo cryptsetup luksFormat luksVol1 [sudo] password for user: WARNING! ======== This will overwrite data on luksVol1 irrevocably. Are you sure? (Type uppercase yes): YES Enter passphrase for luksVol1: Verify passphrase: user@host:~$ sudo cryptsetup -v isLuks luksVol1 Command successful. user@host:~$ </pre> <p>Success! Now that we have a luks volume setup in our file, we can start poking at the bytes on that file to see how the LUKS header is encoded. This is critical to how we design our self-destruct trigger script, so that we can verify that we’re <em>actually</em> wiping the master encryption key, salt, etc–rendering all the drive’s data useless to an adversary–even if the passphrase were known.</p> <h2>LUKS 0xbabe</h2> <p><a href="https://clemens.endorphin.org/">Clemens Fruhwirth</a> had a bit of fun with this one. The beginning of every LUKS partition (the <a href="https://en.wikipedia.org/wiki/File_format#Magic_number">magic number</a> field) starts with <code>LUKS BABE</code>!</p> <p>More specifically, in hex that’s</p> <pre class="brush: bash; title: ; notranslate" title=""> 0x4c55 0x4b53 0xbabe </pre> <p>And <a href="https://www.ascii-code.com/">where</a></p> <pre class="brush: bash; title: ; notranslate" title=""> 0x4c = L 0x55 = U 0x4b = K 0x53 = S </pre> <p>We can see this, for example, on our newly created luks container file using `<code>head</code>` to grab the first 6 bytes and pass it to `<code>od</code>`.</p> <pre class="brush: bash; title: ; notranslate" title=""> user@host:~$ head --bytes 6 luksVol1 | od --format c --endian big 0000000 L U K S 272 276 0000006 user@host:~$ head --bytes 6 luksVol1 | od --format x2 --endian big 0000000 4c55 4b53 babe 0000006 user@host:~$ </pre> <p>A better tool for this is hexdump:</p> <pre class="brush: bash; title: ; notranslate" title=""> user@host:~$ hexdump -Cn 6 luksVol1 00000000 4c 55 4b 53 ba be |LUKS..| 00000006 user@host:~$ </pre> <h2>Hexdumps refresher</h2> <p>Before proceeding, I’ll provide a brief refresher for those of us that don’t look at hexdumps every day. If you <em>do</em> look at hexdumps often, feel free to <a href="#decodingLuks">skip this section</a>.</p> <p>First remember that a single bit can represent two values: a zero or a one. Four bits together (1111) can represent up to 1+2+4+8 = 15. Including zero, that’s 16 values.</p> <p>A single digit in hex (0-F = base-16) can also represent up to 16 values.</p> <p>A byte has 8 bits. That’s twice the length of the four-bits or a single hex digit shown above. Therefore, hexdumps usually group hex digits together in twos by defaut, as that represents a single byte.</p> <p>Also conveniently, 8 bits = 2 hex digits = 1 ASCII character.</p> <p>Now let’s consider this hexdump of the first 128 (decimal = base-10) = 0x80 (hex = base-16) = 1000 0000 (binary = base-2) bytes.</p> <pre class="brush: bash; title: ; notranslate" title=""> user@host:~$ hexdump -Cn 128 luksVol1 00000000 4c 55 4b 53 ba be 00 02 00 00 00 00 00 00 40 00 |LUKS..........@.| 00000010 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 |................| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000040 00 00 00 00 00 00 00 00 73 68 61 32 35 36 00 00 |........sha256..| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 00 00 00 00 00 00 00 00 63 48 e4 17 34 7a be 49 |........cH..4z.I| 00000070 cd 9a 15 8b 81 88 07 ef f6 04 16 f4 fc 7d 36 aa |.............}6.| 00000080 user@host:~$ </pre> <p>Every line in the above output is broken into 3 sections:</p> <ol> <li>On the left: The offset (or start) byte of the line, encoded in hex</li> <li>In the middle: The data encoded in hex</li> <li>On the right: The data encoded as ASCII characters (whare a dot (.) means that the value cannot be represented in ASCII)</li> </ol> <p><strong>[1]</strong> The first section shows an offset of ‘<code>00000000</code>‘, telling us that <em>this</em> line of data starts at the <code>0</code><sup>th</sup> byte of data on our encrypted container <code>luksVol1</code>. The second line is ‘<code>00000010</code>‘. Again, that’s implicitly in hex, so <code>00000010</code> (hex) = <code>16</code> (decimal) = <code>0001 0000</code> (binary).</p> <p>The last line with data is ‘<code>00000070</code>‘, so the first byte on that last line (<code>0xcd</code>) is the <code>0x70</code><sup>th</sup> (hex) = <code>112</code><sup>th</sup> (decimal) byte in our ‘<code>luksVol1</code>‘ file. And the last byte on that line is the <code>0x7F</code><sup>th</sup> (hex) = <code>127</code><sup>th</sup> (decimal) byte. Remember that we’re counting from 0 here.</p> <p>The next byte (not shown) that <em>would</em> appear in this file is the <code>0x80</code><sup>th</sup> (hex) = <code>128</code><sup>th</sup> byte of the file. Note that we passed `<code>hexdump</code>` the ‘<code>-n 128</code>‘ argument, indicating that we only wanted to see the first <code>128</code> bytes (in decimal). Note that this `<code>hexdump -n</code>` argument, counts from 1, not 0.</p> <p><strong>[2]</strong> shows all our data in hex. Again, a single digit in hex fits 4 binary bits. <code>0xF</code> (hex) = <code>15</code> (decimal) = <code>1111</code> (binary). So each hex digit is grouped in twos before being delimited by a space, such that the space between the hex data here delimits each byte (8 bits).</p> <p>Here we see the first byte of the first row is <code>0x4c</code> (hex) = <code>76</code> (decimal) = <code>0100 1100</code> (binary). A single line in a hexdump contains 32 hex digits = 16 bytes. The first set of 8 bytes are delimited by the second set of 8 bytes on a single line by a double-space.</p> <p>On the first line of our hexdump output above, “<code>0x02</code>” is the <code>7</code><sup>th</sup> (decimal) byte and “<code>0x00</code>” is the <code>8</code><sup>th</sup> (decimal) byte of our LUKS container. The last byte of our first line (<code>0x00</code>) is the <code>15</code><sup>th</sup> (decimal) byte of the file, and the next byte that drops down to the next line (also <code>0x00</code>) is the <code>16</code><sup>th</sup> (decimal) byte of the file.</p> <p><strong>[3]</strong> Delimited at the end of the line in pipes (<code>|...|</code>) is the same data represented by <strong>[2]</strong>, but displayed as characters in ASCII instead of hex. An ASCII character is represented by a single byte = two hex digits. Here we see the first four bytes of the device are <code>0x4c554b53</code>, which translates into “LUKS” in ASCII.</p> <p>The next two bytes (<code>0xbabe</code>) translate into “Masculine ordinal indicator” (º) followed by “Fraction three quarters” (¾) — which apparently our hexdump tool decided not to print, and just put a dot (.) instead *shrug*</p> <h2 id="decodingLuks">Decoding the LUKS container’s header</h2> <p>At the time of writing, there’s actually two distinct specifications for how the bits are encoded on a LUKS container.</p> <p>The first is LUKS1, which was <a href="https://serverfault.com/questions/1007317/when-was-luks-first-released">first described</a> in a paper titled <a href="https://gitlab.com/cryptsetup/cryptsetup/-/wikis/LUKS-standard/on-disk-format.pdf">LUKS On-Disk Format Specification</a> published by Clemens Fruhwirth for his <a href="https://clemens.endorphin.org/p/about-me.html">master’s thesis</a> in 2005.</p> <p>The second is LUKS2, which was formally documented in a paper titled <a href="https://gitlab.com/cryptsetup/LUKS2-docs/blob/master/luks2_doc_wip.pdf">LUKS2 On-Disk Format Specification</a> published by Milan Brož (Principal Program Manager, Red Hat) in 2018.</p> <p>In this article, our example LUKS containers all use LUKS2. LUKS2 was</p> <ol> <li>first added in <a href="https://gitlab.com/cryptsetup/cryptsetup/-/blob/bca8a32674140d2e15ff1fdb18d1cc005e1ead19/docs/v2.0.0-ReleaseNotes">`<code>cryptsetup</code>` v2.0.0</a> in 2017,</li> <li>became the default LUKS version in <a href="https://gitlab.com/cryptsetup/cryptsetup/-/blob/6a740033def543bda71b0f5cf1b775121fd3631c/docs/v2.1.0-ReleaseNotes">`<code>cryptsetup</code>` v2.1.0</a> in 2019, and</li> <li>became the default LUKS version with <a href="https://www.debian.org/releases/jessie/mips64el/release-notes/ch-whats-new.en.html#cryptsetup-luks2">Debian 10</a> released in 2020.</li> </ol> <p>The On-Disk Format for LUKS2 is very different from LUKS1. The only two data fields that match exactly are the ‘<code>LUKS 0xbabe</code>‘ “magic number” field and the <code>version</code> field.</p> <table> <tr> <th>offset</th> <th>length</th> <th>name</th> <th>data type</th> <th>description</th> <tr> <td>0</td> <td>6</td> <td>magic number</td> <td>byte[]</td> <td>‘L’,’U’,’K’,’S’, 0xba, 0xbe</td> </tr> <tr> <td>6</td> <td>2</td> <td>version</td> <td>uint16_t</td> <td>LUKS version</td> </tr> </table> <p>As the table above shows, our first field is the so-called <code>LUKS_MAGIC</code> field that starts at byte 0 and is 6 bytes long.</p> <pre class="brush: bash; title: ; notranslate" title=""> user@host:~$ hexdump -Cn 6 -s 0 luksVol1 00000000 4c 55 4b 53 ba be |LUKS..| 00000006 user@host:~$ </pre> <p>Next is the version; it’s 2 bytes long, starts at byte 6, and it’s an unsigned 16-bit unsigned integer (<code>uint16_t</code>). Here we can see that our new LUKS file volume is using LUKS version 2.</p> <pre class="brush: bash; title: ; notranslate" title=""> user@host:~$ hexdump -Cn 2 -s 6 luksVol1 00000006 00 02 |..| 00000008 user@host:~$ </pre> <p>After that is where the two On-Disk Formats diverge.</p> <h2>luksErase</h2> <p>In January 2014, Kali Linux <a href="https://www.kali.org/tutorials/emergency-self-destruction-luks-kali//">published</a> an article titled <a href="https://www.kali.org/tutorials/nuke-kali-linux-luks/">How to Nuke your Encrypted Kali Installation</a> that described how to use an old <a href="http://lxer.com/module/newswire/view/103692/index.html">`<code>cryptsetup</code>` patch</a> (from 2008 by Juergen Pabel) that would permit the user to type a special <a href="https://en.wikipedia.org/wiki/Duress_code">duress password</a> when decrypting the drive on-boot. When entered, this duress password would wipe (nuke) the encrypted drive where Kali was installed.</p> <p>This sparked a <a href="https://marc.info/?l=dm-crypt&m=138904273622981&w=2">discussion</a> on the <a href="https://en.wikipedia.org/wiki/Dm-crypt">dm-crypt</a> mailing list that ultimately lead to the creation of the <code>luksErase</code> command in <a href="https://gitlab.com/cryptsetup/cryptsetup/-/blob/v1_6_4/docs/v1.6.4-ReleaseNotes">`<code>cryptsetup</code>` v1.6.4</a> (released February 2014).</p> <blockquote><p> In 2008, Juergen Pabel submitted his patch for the LUKS “nuke” feature to Clemens Fruhwirth (then maintainer of LUKS), but it was never merged into `<code>cryptsetup</code>`.<br/>  <br/> In 2018 (ten years later), a <a href="https://gitlab.com/cryptsetup/cryptsetup/-/issues/400">feature request</a> was submitted again, but it was rejected by the current maintainer of LUKS (Milan Brož) </p></blockquote> <p>Calling `<code><a href="https://en.wikipedia.org/wiki/Magic_number_%28programming%29">luksErase</a></code>` overwrites the keyslots area–effectively rendering <em>all</em> of the encrypted data permanently irrecoverable. However, it does <em>not</em> wipe the plaintext metadata in the header.</p> <p>I submitted a <a href="https://gitlab.com/cryptsetup/cryptsetup/-/issues/544">feature request</a> asking for the `luksErase` command to have the ability to wipe the plaintext metadata in the header as well, but–meanwhile–we’ll just have to do that ourselves.</p> <h2>LUKS plaintext metadata</h2> <p>In order to wipe the <em>entire</em> LUKS header, including the plaintext metadata, we’ll call `<code>cryptsetup luksErase</code>` followed by a command to overwrite the plaintext metadata area of the LUKS container. But, to do this, we first must determine the start byte and end byte of the metadata area.</p> <p>And it’s good to be precise. If we overwrite past the end of the header, then the encrypted data bit will be corrupted (breaking the header restore process in the event that a user wishes to recover from a false-positive self-destruct). If we overwrite too little, then we may provide partial metadata as forensic evidence to the user’s adversary.</p> <h2>LUKS1 metadata</h2> <figure id="attachment_5078" aria-describedby="caption-attachment-5078" style="width: 500px" class="wp-caption alignright"><a href="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/luksHeaderShredder_luks1PhdrLayout.jpg"><img decoding="async" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/500xNxluksHeaderShredder_luks1PhdrLayout-900x1024.jpg.pagespeed.ic.UDAZ_ZeeS-.jpg" alt="Image of a table showing the LUKS1 encoding" width="500" class="size-large wp-image-5078"/></a><figcaption id="caption-attachment-5078" class="wp-caption-text">Excerpt from the <a href="https://gitlab.com/cryptsetup/cryptsetup/-/wikis/LUKS-standard/on-disk-format.pdf">LUKS1 whitepaper</a> showing Figure 1: PHDR layout</figcaption></figure> <p>In LUKS1, the partition header is a short and relatively fixed-length of <code>1052672</code> or <code>2097152</code> bytes. The exact length can be determined by inspecting the ‘<code>payload-offset</code>‘ field and multiplying it by <code>512</code> (see “Figure 1: PHDR layout” of <a href="https://gitlab.com/cryptsetup/cryptsetup/-/wikis/LUKS-standard/on-disk-format.pdf">LUKS1 On-Disk Format Specification</a>). This field starts at an offset of <code>104</code> bytes and is <code>4</code> bytes long.</p> <p>For example, the following hexdump shows the <code>payload-offset</code> field has a value of <code>0x1000</code> (hex) = <code>4096</code> (decimal). Multiplying that by 512, we know that the LUKS container’s header ends at byte <code>4096*512</code> = byte <code>2097152</code>.</p> <pre class="brush: bash; title: ; notranslate" title=""> root@disp4117:~# hexdump -Cs 104 -n 4 luksVol1 00000068 00 00 10 00 |....| 0000006c root@disp4117:~# </pre> <p>Overwriting the first 2097152 bytes of a LUKS1 header is actually superfluous; it overwrites the plaintext metadata <em>and</em> the keyslots area (that we’ll already overwrite with `<code>cryptsetup luksErase</code>`)–but it’s an easier boundry to decode, and overwriting 2MiB is fast enough for our needs..</p> <h3>LUKS2 metadata</h3> <p>In LUKS2, the header is actually made-up of six distinct headers, including</p> <ol> <li>A primary binary header (exactly 4096 bytes)</li> <li>The “1<sup>st</sup> JSON” area (16384-4194304 bytes)</li> <li>A secondary binary header (exactly 4096 bytes)</li> <li>The “2<sup>nd</sup> JSON” area (16384-4194304 bytes)</li> <li>The Keyslots area (variable length)</li> <li>The Alignment Padding area</li> </ol> <figure id="attachment_5061" aria-describedby="caption-attachment-5061" style="width: 1024px" class="wp-caption aligncenter"><a href="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/luksHeaderShredder_luks1vsluks2Headers.jpg"><img decoding="async" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/xluksHeaderShredder_luks1vsluks2Headers-1024x166.jpg.pagespeed.ic.QNGMFDliJ7.jpg" alt="Figure shows the difference in the LUKS1 header vs LUKS2 header" width="1024" height="166" class="size-large wp-image-5061"/></a><figcaption id="caption-attachment-5061" class="wp-caption-text">Excerpt from the <a href="https://gitlab.com/cryptsetup/LUKS2-docs/blob/master/luks2_doc_wip.pdf">LUKS2 Whitepaper</a> showing the difference between the LUKS1 and LUKS2 headers</figcaption></figure> <p>The easiest way to determine the <a href="https://security.stackexchange.com/questions/227359/how-to-determine-start-and-end-bytes-of-luks-header">end byte of a LUKS2 header’s metadata</a> is to get the `<code>hdr_size</code>` field and double it.</p> <p>In LUKS2, the `<code>hdr_size</code>` field is the size of the first two header areas (the “primary binary header” area plus the “1<sup>st</sup> header area). So <a href="https://security.stackexchange.com/questions/227362/why-is-my-luks-header-listed-twice?noredirect=1&lq=1">double</a> <em>that</em> ends where the keyslots area begins–which is where the metadata ends.</p> <p>OK, with all that prerequisite knowledge out of the way, let’s proceed with installing a fresh version of Ubuntu, nuking it, and analyzing the result.</p> <h1>Self-Destruct Test</h1> <p>In this section, we will do a forensics analysis of a drive before & after BusKll triggers a self-destruct sequence.</p> <h2>ATA Secure Erase</h2> <p>First, we’ll trigger an <a href="https://en.wikipedia.org/wiki/Write_amplification#Secure_erase">ATA Secure Erase</a> on the laptop’s SSD, and we’ll do a forensic analysis of this drive in its fresh state before installing Ubuntu with FDE.</p> <p>To preform this analysis, I’ll be using Kali Linux and its `<code>bulk_extractor</code>` tool.</p> <p>After booting to Kali, we do a quick check on the drive’s partition structure. What you see here was created by a previous Ubuntu Desktop install.</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# fdisk -l /dev/sda Disk /dev/sda: 111.81 GiB, 120034123776 bytes, 234441648 sectors Disk model: WDC WDS120G2G0B- Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0xcb6eced1 Device Boot Start End Sectors Size Id Type /dev/sda1 * 2048 1050623 1048576 512M b W95 FAT32 /dev/sda2 1052670 234440703 233388034 111.3G 5 Extended /dev/sda5 1052672 2549759 1497088 731M 83 Linux /dev/sda6 2551808 234440703 231888896 110.6G 83 Linux root@kali:~# </pre> <p>Now–in order to proceed with the ATA Secure Erase–we have to suspend to disk to <a href="https://wiki.archlinux.org/index.php/Solid_state_drive/Memory_cell_clearing#Step_1_-_Make_sure_the_drive_security_is_not_frozen">unfreeze</a> the drive.</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# hdparm -I /dev/sda | grep frozen frozen root@kali:~# echo -n mem > /sys/power/state </pre> <p>After it comes back, we go through the process to trigger an ATA Secure Erase. Note that these commands may vary (or not be applicable at all) to your storage device:</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# hdparm -I /dev/sda | grep frozen not frozen root@kali:~# hdparm --user-master u --security-set-pass PASSWD /dev/sda security_password: "PASSWD" /dev/sda: Issuing SECURITY_SET_PASS command, password="PASSWD", user=user, mode=high root@kali:~# hdparm --user-master u --security-erase PASSWD /dev/sda security_password: "PASSWD" /dev/sda: Issuing SECURITY_ERASE command, password="PASSWD", user=user root@kali:~# </pre> <p>Note that the dive’s partition structure has been factory reset, and it’s filled with all zeros.</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# fdisk -l /dev/sda Disk /dev/sda: 111.81 GiB, 120034123776 bytes, 234441648 sectors Disk model: WDC WDS120G2G0B- Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes root@kali:~# root@kali:~# hexdump -C /dev/sda 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 1bf2976000 root@kali:~# </pre> <h2>Forensic Analysis 0 (after factory reset)</h2> <p>And, just to be sure, we’ll attempt to find any recognizable patterns. We’ll also be doing this again <em>after</em> the Ubuntu install to compare the differences.</p> <blockquote><p> Note that, in addition to using all the default scanners in `<code>bulk_extractor</code>`, we’re also passing-in regular expressions of the following byte sequences specific to our LUKS header:<br/>  </p> <ol> <li>magic = 0x4c554b53babe</li> <li>“keyslot” = 0x6b6579736c6f74</li> <li>“stripe” = 0x737472697065</li> <li>“offset” = 0x6f6666736574</li> <li>“encrypt” = 0x656e6372797074</li> <li>“segment” = 0x7365676d656e74</li> </ol> </blockquote> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# mkdir bulk_out root@kali:~# bulk_extractor -o bulk_out -f $'\x4c\x55\x4b\x53\xba\xbe' -f $'\x6b\x65\x79\x73\x6c\x6f\x74' -f $'\x73\x74\x72\x69\x70\x65' -f $'\x6f\x66\x66\x73\x65\x74' -f $'\x65\x6e\x63\x72\x79\x70\x74' -f $'\x73\x65\x67\x6d\x65\x6e\x74' /dev/sda ... root@kali:~# cat bulk_out/*.txt root@kali:~# </pre> <p>No surprise; it found nothing.</p> <h2>Install Ubuntu</h2> <p>Now, let’s install Ubuntu on our freshly wiped drive.</p> <p>Of course, I’ll be choosing FDE at install time.</p> <figure id="attachment_5062" aria-describedby="caption-attachment-5062" style="width: 1421px" class="wp-caption aligncenter"><a href="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/luksHeaderShredder_ubuntuInstallFDE.jpg"><img loading="lazy" decoding="async" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/xluksHeaderShredder_ubuntuInstallFDE.jpg.pagespeed.ic.LEDsMVaKB2.jpg" alt="Screenshot of Ubuntu Install Wizard" width="1421" height="1068" class="size-full wp-image-5062"/></a><figcaption id="caption-attachment-5062" class="wp-caption-text">BusKill assumes the user enabled FDE. This screenshot shows the option to enable FDE when installing Ubuntu 2020.04</figcaption></figure> <p><br style="clear:both"/></p> <h2>Forensic Analysis 1 (after Ubuntu install)</h2> <p>Now that Ubuntu is installed, let’s poke at the drive again in Kali and see what we can learn without decrypting it.</p> <p>First, we see that the drive now has 4 partitions:</p> <ol> <li>/dev/sda1 is an unencrypted 512M W95 FAT32 dumb partition with an MBR</li> <li>/dev/sda2 is an unencrypted “extended” partition containing two “logical” partitions</li> <li>/dev/sda5 is an unencrypted 731M logical /boot parititon </li> <li>/dev/sda6 is the LUKS-encrypted 111G / partition</li> </ol> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~/bulk_out_sda6# fdisk -l /dev/sda Disk /dev/sda: 111.81 GiB, 120034123776 bytes, 234441648 sectors Disk model: WDC WDS120G2G0B- Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x8d666a9a Device Boot Start End Sectors Size Id Type /dev/sda1 * 2048 1050623 1048576 512M b W95 FAT32 /dev/sda2 1052670 234440703 233388034 111.3G 5 Extended /dev/sda5 1052672 2549759 1497088 731M 83 Linux /dev/sda6 2551808 234440703 231888896 110.6G 83 Linux root@kali:~/bulk_out_sda6# </pre> <blockquote><p> Note that Ubuntu’s default <a href="https://unix.stackexchange.com/questions/518377/where-does-the-debian-installer-choose-mbr-vs-gpt">partition layout</a> may differ from above if, for example, you have disks larger than 2T </p></blockquote> <p>We can verify this by doing a `<code>hexdump</code>` on the encrytped ‘<code>/dev/sda6</code>‘ partition, which shows the LUKS magic number, version, ‘<code>hdr_size</code>‘, etc.</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# hexdump -Cn 4832 /dev/sda6 00000000 4c 55 4b 53 ba be 00 02 00 00 00 00 00 00 40 00 |LUKS..........@.| 00000010 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 |................| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000040 00 00 00 00 00 00 00 00 73 68 61 32 35 36 00 00 |........sha256..| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 00 00 00 00 00 00 00 00 5e 4d 69 a0 3c 96 b1 9c |........^Mi.<...| 00000070 f7 84 2f 71 82 bb af 05 2f 4a 4c fe 60 f5 74 16 |../q..../JL.`.t.| 00000080 ea 52 a8 8b 34 7a 0f b4 a9 36 82 2a c1 4f 3f 89 |.R..4z...6.*.O?.| 00000090 c7 4e e4 5d 4a d1 39 b3 c7 e1 c5 20 4d bf c3 a8 |.N.]J.9.... M...| 000000a0 53 01 38 33 a4 f0 2e ae 31 31 37 35 39 64 62 61 |S.83....11759dba| 000000b0 2d 61 33 36 32 2d 34 30 38 37 2d 39 31 34 66 2d |-a362-4087-914f-| 000000c0 38 61 62 64 32 61 61 66 31 35 66 33 00 00 00 00 |8abd2aaf15f3....| 000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001c0 7b cf a2 6c 86 ae 22 03 48 75 49 7a 8b 92 1e 28 |{..l..".HuIz...(| 000001d0 fa 64 a0 bc cf e7 7a 83 1b 75 d9 96 09 79 b5 8e |.d....z..u...y..| 000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00001000 7b 22 6b 65 79 73 6c 6f 74 73 22 3a 7b 22 30 22 |{"keyslots":{"0"| 00001010 3a 7b 22 74 79 70 65 22 3a 22 6c 75 6b 73 32 22 |:{"type":"luks2"| 00001020 2c 22 6b 65 79 5f 73 69 7a 65 22 3a 36 34 2c 22 |,"key_size":64,"| 00001030 61 66 22 3a 7b 22 74 79 70 65 22 3a 22 6c 75 6b |af":{"type":"luk| 00001040 73 31 22 2c 22 73 74 72 69 70 65 73 22 3a 34 30 |s1","stripes":40| 00001050 30 30 2c 22 68 61 73 68 22 3a 22 73 68 61 32 35 |00,"hash":"sha25| 00001060 36 22 7d 2c 22 61 72 65 61 22 3a 7b 22 74 79 70 |6"},"area":{"typ| 00001070 65 22 3a 22 72 61 77 22 2c 22 6f 66 66 73 65 74 |e":"raw","offset| ... </pre> <figure id="attachment_5056" aria-describedby="caption-attachment-5056" style="width: 1024px" class="wp-caption aligncenter"><a href="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/luksHeaderShredder_kaliForensicsAfterInstall1_cropped1.jpg"><img loading="lazy" decoding="async" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/xluksHeaderShredder_kaliForensicsAfterInstall1_cropped1-1024x720.jpg.pagespeed.ic.Lx4SVhY4H0.jpg" alt="A screenshot in Kali with a hexdump showing a valid LUKS header" width="1024" height="720" class="size-large wp-image-5056"/></a><figcaption id="caption-attachment-5056" class="wp-caption-text">A forensic analysis of the LUKS header after a fresh Ubuntu install</figcaption></figure> <p>Now let’s use `<code>bulk_extractor</code>` again on our new encrypted LUKS partition.</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# bulk_extractor -q -1 -o bulk_out_sda6 -f $'\x4c\x55\x4b\x53\xba\xbe' -f $'\x6b\x65\x79\x73\x6c\x6f\x74' -f $'\x73\x74\x72\x69\x70\x65' -f $'\x6f\x66\x66\x73\x65\x74' -f $'\x65\x6e\x63\x72\x79\x70\x74' -f $'\x73\x65\x67\x6d\x65\x6e\x74' /dev/sda6 ... root@kali:~# root@kali:~# cd bulk_out_sda6 root@kali:~/bulk_out_sda6# find . -name \*.txt | grep -vi histogram | xargs cat # BANNER FILE NOT PROVIDED (-b option) # BULK_EXTRACTOR-Version: 1.6.0 ($Rev: 10844 $) # Feature-Recorder: json # Filename: /dev/sda6 # Feature-File-Version: 1.1 4828 {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offset":"32768","size":"258048","encryption":"aes-xts-plain64","key_size":64},"kdf":{"type":"argon2i","time":4,"memory":612334,"cpus":4,"salt":"ohyuAKaNOvY/727uMiYgZ6zgVR/FSVTc4UTunJjkXh8="}}},"tokens":{},"segments":{"0":{"type":"crypt","offset":"16777216","size":"dynamic","iv_tweak":"0","encryption":"aes-xts-plain64","sector_size":512}},"digests":{"0":{"type":"pbkdf2","keyslots":["0"],"segments":["0"],"hash":"sha256","iterations":66737,"salt":"VQ+dkN5lo0vw4oxAuJY4wU0DGP+1X6lhouurxBOi180=","digest":"Qc1HkrLGbL2iqQb1TqZq7UKjReRmLcObGqScyqUi3Vo="}},"config":{"json_size":"12288","keyslots_size":"16744448"}} 03101a951dfb1f6b277f90081e2f0331 21212 {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offset":"32768","size":"258048","encryption":"aes-xts-plain64","key_size":64},"kdf":{"type":"argon2i","time":4,"memory":612334,"cpus":4,"salt":"ohyuAKaNOvY/727uMiYgZ6zgVR/FSVTc4UTunJjkXh8="}}},"tokens":{},"segments":{"0":{"type":"crypt","offset":"16777216","size":"dynamic","iv_tweak":"0","encryption":"aes-xts-plain64","sector_size":512}},"digests":{"0":{"type":"pbkdf2","keyslots":["0"],"segments":["0"],"hash":"sha256","iterations":66737,"salt":"VQ+dkN5lo0vw4oxAuJY4wU0DGP+1X6lhouurxBOi180=","digest":"Qc1HkrLGbL2iqQb1TqZq7UKjReRmLcObGqScyqUi3Vo="}},"config":{"json_size":"12288","keyslots_size":"16744448"}} 03101a951dfb1f6b277f90081e2f0331 # BANNER FILE NOT PROVIDED (-b option) # BULK_EXTRACTOR-Version: 1.6.0 ($Rev: 10844 $) # Feature-Recorder: find # Filename: /dev/sda6 # Feature-File-Version: 1.1 0 LUKS\xBA\xBE LUKS\xBA\xBE\x00\x02\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00 4098 keyslot \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{"keyslots":{"0":{"type": 4165 stripe "type":"luks1","stripes":4000,"hash":" 4218 offset :{"type":"raw","offset":"32768","size" 4251 encrypt size":"258048","encryption":"aes-xts-pl 4424 segment }},"tokens":{},"segments":{"0":{"type": 4456 offset "type":"crypt","offset":"16777216","si 4508 encrypt "iv_tweak":"0","encryption":"aes-xts-pl 4591 keyslot type":"pbkdf2","keyslots":["0"],"segmen 4608 segment eyslots":["0"],"segments":["0"],"hash": 4802 keyslot _size":"12288","keyslots_size":"1674444 20482 keyslot \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{"keyslots":{"0":{"type": 20549 stripe "type":"luks1","stripes":4000,"hash":" 20602 offset :{"type":"raw","offset":"32768","size" 20635 encrypt size":"258048","encryption":"aes-xts-pl 20808 segment }},"tokens":{},"segments":{"0":{"type": 20840 offset "type":"crypt","offset":"16777216","si 20892 encrypt "iv_tweak":"0","encryption":"aes-xts-pl 20975 keyslot type":"pbkdf2","keyslots":["0"],"segmen 20992 segment eyslots":["0"],"segments":["0"],"hash": 21186 keyslot _size":"12288","keyslots_size":"1674444 # BANNER FILE NOT PROVIDED (-b option) # BULK_EXTRACTOR-Version: 1.6.0 ($Rev: 10844 $) # Feature-Recorder: email # Filename: /dev/sda6 # Feature-File-Version: 1.1 935334046 d7R@y5.LU \x86\xEFO\xE7%睁F\x90\x05*\x9F\xC5\xD6\xC1d7R@y5.LU\xC8/\xB7\x9FP\xE0|m\xEF\x0A\x89\xA1\xAE\x0C\x80\xA2 # BANNER FILE NOT PROVIDED (-b option) # BULK_EXTRACTOR-Version: 1.6.0 ($Rev: 10844 $) # Feature-Recorder: domain # Filename: /dev/sda6 # Feature-File-Version: 1.1 935334050 y5.LU %睁F\x90\x05*\x9F\xC5\xD6\xC1d7R@y5.LU\xC8/\xB7\x9FP\xE0|m\xEF\x0A\x89\xA1\xAE\x0C\x80\xA2 root@kali:~/bulk_out_sda6# </pre> <p>The above output shows that `<code>bulk_extractor</code>` picked-up the following from our LUKS-encrypted partition:</p> <ol> <li>The ‘<code>json</code>‘ scanner picked-up the two plaintext metadata JSON areas from the LUKS header.</li> <li>The ‘<code>find</code>‘ scanner picked-up 21 distinct entries that matched one of our byte sequences</li> <li>The ‘<code>email</code>‘ scanner picked-up a bogus email address “d7R@y5.LU” — which is probably just a coincidence of random data</li> <li>Same as above, the ‘<code>domain</code>‘ scanner picked-up the same bogus “y5.LU” domain from above</li> </ol> <p>And for completeness, let’s use `<code>bulk_extractor</code>` again on the entire ‘<code>/dev/sda</code>‘ drive–not just the LUKS-encrypted partition:</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# bulk_extractor -q -1 -o bulk_out -f $'\x4c\x55\x4b\x53\xba\xbe' -f $'\x6b\x65\x79\x73\x6c\x6f\x74' -f $'\x73\x74\x72\x69\x70\x65' -f $'\x6f\x66\x66\x73\x65\x74' -f $'\x65\x6e\x63\x72\x79\x70\x74' -f $'\x73\x65\x67\x6d\x65\x6e\x74' /dev/sda ... root@kali:~# root@kali:~# cd bulk_out root@kali:~/bulk_out# find . -name \*.txt | grep -Evi '_histogram|_services' | xargs tail --silent -n+6 | wc -l 2400 root@kali:~/bulk_out# </pre> <p>I’ve simplified the details of the report above for brevity, but it’s sufficient to note that it detected 2,400 matches from the following features: url, telephone, find, email, domain, zip, elf, and zip.</p> <p>Interestingly, `<code>bulk_extractor</code>` found 8 LUKS magic number sequences across the entire disk, but only one of them actually looks like the start of a LUKS container. My best guess is that the other 7 are from binaries or the <a href="https://linux.die.net/man/3/libmagic">magic patterns database file</a>.</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~/bulk_out# grep 'LUKS\\xBA\\xBE' find.txt 701434826 LUKS\xBA\xBE \xFE\xF0\x07ONE\x00LVM2 001\x00LUKS\xBA\xBE\x00CD\x0D\x00\xF3\x0CCDROM\x00JFS 765575408 LUKS\xBA\xBE _mega\x1C\x002SUB\xC5\x00\xF0\x07\x00LUKS\xBA\xBE\x00SKUL\xBA\xBE\x00crypto_\x15 782257838 LUKS\xBA\xBE \x0A\x00access denied\x00LUKS\xBA\xBE\x00%s != %s\x0A\x00Ciphe 795806644 LUKS\xBA\xBE \xFE\xF0\x07ONE\x00LVM2 001\x00LUKS\xBA\xBE\x00CD\x0D\x00\xF3\x0CCDROM\x00JFS 883016223 LUKS\xBA\xBE _mega\x1C\x002SUB\xC5\x00\xF0\x07\x00LUKS\xBA\xBE\x00SKUL\xBA\xBE\x00crypto_\x15 900664248 LUKS\xBA\xBE \xFE\xF0\x07ONE\x00LVM2 001\x00LUKS\xBA\xBE\x00CD\x0D\x00\xF3\x0CCDROM\x00JFS 975291012 LUKS\xBA\xBE _mega\x1C\x002SUB\xC5\x00\xF0\x07\x00LUKS\xBA\xBE\x00SKUL\xBA\xBE\x00crypto_\x15 1306525696 LUKS\xBA\xBE \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00LUKS\xBA\xBE\x00\x02\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00 root@kali:~/bulk_out# hexdump -Cs 701434826 -n 80 /dev/sda 29cf0bca 4c 55 4b 53 ba be 00 43 44 0d 00 f3 0c 43 44 52 |LUKS...CD....CDR| 29cf0bda 4f 4d 00 4a 46 53 31 00 5f 42 48 52 66 53 5f 4d |OM.JFS1._BHRfS_M| 29cf0bea 00 52 65 49 73 45 72 34 08 00 23 46 73 09 00 15 |.ReIsEr4..#Fs...| 29cf0bfa 32 0a 00 af 33 46 73 00 4f 43 46 53 56 32 e8 00 |2...3Fs.OCFSV2..| 29cf0c0a 0c 39 67 7a 69 07 82 2a 3e 14 2c 47 11 63 f7 b5 |.9gzi..*>.,G.c..| 29cf0c1a root@kali:~/bulk_out# hexdump -Cs 765575408 -n 80 /dev/sda 2da1c0f0 4c 55 4b 53 ba be 00 53 4b 55 4c ba be 00 63 72 |LUKS...SKUL...cr| 2da1c100 79 70 74 6f 5f 15 00 33 00 00 40 a9 01 15 80 92 |ypto_..3..@.....| 2da1c110 0e 03 08 00 13 02 08 00 13 04 08 00 13 08 08 00 |................| 2da1c120 14 10 c2 18 03 08 00 02 41 00 c0 44 4d 5f 69 6e |........A..DM_in| 2da1c130 74 65 67 72 69 74 79 0d 00 00 0a 10 70 74 79 5f |tegrity.....pty_| 2da1c140 root@kali:~/bulk_out# hexdump -Cs 782257838 -n 80 /dev/sda 2ea04eae 4c 55 4b 53 ba be 00 25 73 20 21 3d 20 25 73 0a |LUKS...%s != %s.| 2ea04ebe 00 43 69 70 68 65 72 20 25 73 20 69 73 6e 27 74 |.Cipher %s isn't| 2ea04ece 20 61 76 61 69 6c 61 62 6c 65 00 69 6e 76 61 6c | available.inval| 2ea04ede 69 64 20 6b 65 79 73 69 7a 65 20 25 64 00 65 63 |id keysize %d.ec| 2ea04eee 62 00 70 6c 61 69 6e 00 63 62 63 2d 00 70 63 62 |b.plain.cbc-.pcb| 2ea04efe root@kali:~/bulk_out# hexdump -Cs 795806644 -n 80 /dev/sda 2f6f0bb4 4c 55 4b 53 ba be 00 43 44 0d 00 f3 0c 43 44 52 |LUKS...CD....CDR| 2f6f0bc4 4f 4d 00 4a 46 53 31 00 5f 42 48 52 66 53 5f 4d |OM.JFS1._BHRfS_M| 2f6f0bd4 00 52 65 49 73 45 72 34 08 00 23 46 73 09 00 15 |.ReIsEr4..#Fs...| 2f6f0be4 32 0a 00 af 33 46 73 00 4f 43 46 53 56 32 e8 00 |2...3Fs.OCFSV2..| 2f6f0bf4 0c 39 67 7a 69 07 82 2a 3e 14 2c 47 11 63 f7 b5 |.9gzi..*>.,G.c..| 2f6f0c04 root@kali:~/bulk_out# hexdump -Cs 883016223 -n 80 /dev/sda 34a1c21f 4c 55 4b 53 ba be 00 53 4b 55 4c ba be 00 63 72 |LUKS...SKUL...cr| 34a1c22f 79 70 74 6f 5f 15 00 33 00 00 40 a9 01 15 80 92 |ypto_..3..@.....| 34a1c23f 0e 03 08 00 13 02 08 00 13 04 08 00 13 08 08 00 |................| 34a1c24f 14 10 c2 18 03 08 00 02 41 00 c0 44 4d 5f 69 6e |........A..DM_in| 34a1c25f 74 65 67 72 69 74 79 0d 00 00 0a 10 70 74 79 5f |tegrity.....pty_| 34a1c26f root@kali:~/bulk_out# hexdump -Cs 900664248 -n 80 /dev/sda 35af0bb8 4c 55 4b 53 ba be 00 43 44 0d 00 f3 0c 43 44 52 |LUKS...CD....CDR| 35af0bc8 4f 4d 00 4a 46 53 31 00 5f 42 48 52 66 53 5f 4d |OM.JFS1._BHRfS_M| 35af0bd8 00 52 65 49 73 45 72 34 08 00 23 46 73 09 00 15 |.ReIsEr4..#Fs...| 35af0be8 32 0a 00 af 33 46 73 00 4f 43 46 53 56 32 e8 00 |2...3Fs.OCFSV2..| 35af0bf8 0c 39 67 7a 69 07 82 2a 3e 14 2c 47 11 63 f7 b5 |.9gzi..*>.,G.c..| 35af0c08 root@kali:~/bulk_out# hexdump -Cs 975291012 -n 80 /dev/sda 3a21c284 4c 55 4b 53 ba be 00 53 4b 55 4c ba be 00 63 72 |LUKS...SKUL...cr| 3a21c294 79 70 74 6f 5f 15 00 33 00 00 40 a9 01 15 80 92 |ypto_..3..@.....| 3a21c2a4 0e 03 08 00 13 02 08 00 13 04 08 00 13 08 08 00 |................| 3a21c2b4 14 10 c2 18 03 08 00 02 41 00 c0 44 4d 5f 69 6e |........A..DM_in| 3a21c2c4 74 65 67 72 69 74 79 0d 00 00 0a 10 70 74 79 5f |tegrity.....pty_| 3a21c2d4 root@kali:~/bulk_out# hexdump -Cs 1306525696 -n 80 /dev/sda 4de00000 4c 55 4b 53 ba be 00 02 00 00 00 00 00 00 40 00 |LUKS..........@.| 4de00010 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 |................| 4de00020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 4de00040 00 00 00 00 00 00 00 00 73 68 61 32 35 36 00 00 |........sha256..| 4de00050 root@kali:~/bulk_out# </pre> <h2 id="selfdestruct">Self-Destruct</h2> <p>Now we’ll boot into Ubuntu, setup BusKill with this self-destruct trigger, and trip it!</p> <p>First, download the <a href="https://github.com/BusKill/buskill-linux/blob/master/triggers/buskill-lock.sh">lockscreen</a> and <a href="https://github.com/BusKill/buskill-linux/blob/master/triggers/buskill-selfdestruct.sh">self-destruct</a> triggers from the ‘<code>buskill-linux</code>‘ repo on GitHub and put them in <code>/user/local/bin/</code></p> <pre class="brush: bash; title: ; notranslate" title=""> sudo wget -O /usr/local/bin/buskill-lock.sh https://raw.githubusercontent.com/BusKill/buskill-linux/master/triggers/buskill-lock.sh sudo wget -O /usr/local/bin/buskill-selfdestruct.sh https://raw.githubusercontent.com/BusKill/buskill-linux/master/triggers/buskill-selfdestruct.sh sudo chmod +x /usr/local/bin/buskill-lock.sh sudo chmod +x /usr/local/bin/buskill-selfdestruct.sh </pre> <p>Then add the udev rule that will call our `<code>self-destruct.sh</code>` trigger script when the BusKill cable’s connection is severed. In this guide, we identify our BusKill-specific drive with the ‘<code>ENV{ID_MODEL}=="Micromax_A74"</code>‘ <a href="https://wiki.archlinux.org/index.php/Udev#udev_rule_example">udev property</a>. You should replace this property with one that matches your BusKill-specific drive.</p> <blockquote><p> Note: to determine how to query your USB drive for device-specific identifiers, see <a href="/buskill-laptop-kill-cord-dead-man-switch/#software">Introducing BusKill: A Kill Cord for your Laptop</a>. </p></blockquote> <pre class="brush: bash; title: ; notranslate" title=""> cat << EOF | sudo tee /etc/udev/rules.d/buskill.rules ################################################################################ # File: /etc/udev/rules.d/buskill.rules # Purpose: Add buskill rules. More info: https://buskill.in/luks-self-destruct # Authors: Michael Altfield <michael@buskill.in> # Created: 2020-06-07 # License: GNU GPLv3 ################################################################################ ACTION=="remove", SUBSYSTEM=="usb", ENV{ID_MODEL}=="Micromax_A74", RUN+="/usr/local/bin/buskill-selfdestruct.sh --yes" EOF sudo udevadm control --reload </pre> <p>That’s it! When you remove a USB drive from your system matching the udev property defined in the udev rule above, the `<code>selfdestruct.sh</code>` script will be triggered.</p> <p>Fact: When I did this, I set a stop-watch on my first execution of the buskill self-destruct, and it counted 5.16 seconds between the time that I executed it and the time that my machine was fully shut-off. Excellent!</p> <figure class="wp-block-video aligncenter"> <video preload="metadata" autoplay="autoplay" loop="" muted="muted" playsinline="" width="640" height="360"><source type="video/webm" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/buskill_luksHeaderShredder_short.webm?_=1"><source type="video/mp4" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/buskill_luksHeaderShredder_short.mp4?_=1"><a href="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/buskill_luksHeaderShredder_short.webm">https://www.buskill.in/wp-content/uploads/sites/8/2020/06/buskill_luksHeaderShredder_short.webm</a><br/> <object type="application/x-shockwave-flash" data="http://www.youtube.com/v/WA8sL4236jM" width="640" height="360"><param name="movie" value="http://www.youtube.com/v/WA8sL4236jM"></object></video><br/> </figure> <h2>Forensic Analysis 2 (after self-destruct)</h2> <p>Did our self-destrut trigger work? Let’s check.</p> <p>First evidence: well, I can’t boot to Ubuntu anymore. But let’s dig deeper in Kali.</p> <figure id="attachment_5053" aria-describedby="caption-attachment-5053" style="width: 693px" class="wp-caption aligncenter"><a href="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/luksHeaderShredder_bootFail.jpg"><img loading="lazy" decoding="async" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/xluksHeaderShredder_bootFail.jpg.pagespeed.ic.mBLTmN0AAr.jpg" alt="Screenshot with black terminal background and text reding: "Cannot process volume group vgubuntu"" width="693" height="81" class="size-full wp-image-5053"/></a><figcaption id="caption-attachment-5053" class="wp-caption-text">The error message that’s shown when attempting to boot to Ubuntu after the self-destruct</figcaption></figure> <p>A `<code>hexdump</code>` on the encrytped ‘<code>/dev/sda6</code>‘ partition, no longer shows the LUKS magic number, version, ‘<code>hdr_size</code>‘, etc. Good so far.</p> <figure id="attachment_5059" aria-describedby="caption-attachment-5059" style="width: 1024px" class="wp-caption aligncenter"><a href="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/luksHeaderShredder_kaliForensicsAfterShred1.jpg"><img loading="lazy" decoding="async" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/06/xluksHeaderShredder_kaliForensicsAfterShred1-1024x576.jpg.pagespeed.ic.MYyyCjUU4Z.jpg" alt="A screenshot in Kali with a hexdump showing random data" width="1024" height="576" class="size-large wp-image-5059"/></a><figcaption id="caption-attachment-5059" class="wp-caption-text">A forensic analysis of the LUKS header after the self-destruct script ran shows it has been fully overwritten with random data</figcaption></figure> <p>Re-running `<code>bulk_extractor</code>` shows that it still finds the coincidental email/domain ‘<code>d7R@y5.LU</code>‘ and a new false-positive domain ‘<code>0W.ER</code>‘.</p> <p>But <strong>it appears that the buskill self-destruct script totally erradicated all of the json and the 21 LUKS byte sequence matches!</strong> Mission accomplished!</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# bulk_extractor -q 19 -o bulk_out_sda6 -f $'\x4c\x55\x4b\x53\xba\xbe' -f $'\x6b\x65\x79\x73\x6c\x6f\x74' -f $'\x73\x74\x72\x69\x70\x65' -f $'\x6f\x66\x66\x73\x65\x74' -f $'\x65\x6e\x63\x72\x79\x70\x74' -f $'\x73\x65\x67\x6d\x65\x6e\x74' /dev/sda6 ... root@kali:~# root@kali:~# cd bulk_out_sda6/ root@kali:~/bulk_out_sda6# find . -name \*.txt | grep -vi histogram | xargs cat # BANNER FILE NOT PROVIDED (-b option) # BULK_EXTRACTOR-Version: 1.6.0 ($Rev: 10844 $) # Feature-Recorder: email # Filename: /dev/sda6 # Feature-File-Version: 1.1 935334046 d7R@y5.LU \x86\xEFO\xE7%睁F\x90\x05*\x9F\xC5\xD6\xC1d7R@y5.LU\xC8/\xB7\x9FP\xE0|m\xEF\x0A\x89\xA1\xAE\x0C\x80\xA2 36662462829 xhV@0W.ER y4\x07w\xE2\xE6\xEBI\x1F1f\x0C,\x9AxhV@0W.ER`\x8E\x1DZ8\x0B\xEA\xDD\xF2\x8EȈ,\x8A\x8C# # BANNER FILE NOT PROVIDED (-b option) # BULK_EXTRACTOR-Version: 1.6.0 ($Rev: 10844 $) # Feature-Recorder: domain # Filename: /dev/sda6 # Feature-File-Version: 1.1 935334050 y5.LU %睁F\x90\x05*\x9F\xC5\xD6\xC1d7R@y5.LU\xC8/\xB7\x9FP\xE0|m\xEF\x0A\x89\xA1\xAE\x0C\x80\xA2 36662462833 0W.ER \xE2\xE6\xEBI\x1F1f\x0C,\x9AxhV@0W.ER`\x8E\x1DZ8\x0B\xEA\xDD\xF2\x8EȈ,\x8A\x8C# root@kali:~/bulk_out_sda6# </pre> <p>And a scan on the entire ‘<code>/dev/sda</code>‘ drive (not just the LUKS-encrypted parititon) shows:</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:~# bulk_extractor -q 9 -o bulk_out_sda -f $'\x4c\x55\x4b\x53\xba\xbe' -f $'\x6b\x65\x79\x73\x6c\x6f\x74' -f $'\x73\x74\x72\x69\x70\x65' -f $'\x6f\x66\x66\x73\x65\x74' -f $'\x65\x6e\x63\x72\x79\x70\x74' -f $'\x73\x65\x67\x6d\x65\x6e\x74' /dev/sda bulk_extractor version: 1.6.0 ... root@kali:~# cd bulk_out_sda root@kali:~/bulk_out_sda# find . -name \*.txt | grep -Evi '_histogram|_services' | xargs tail --silent -n+6 | wc -l 3205 root@kali:~/bulk_out_sda# </pre> <p>Interestingly, this run <em>after</em> the self-destruct yielded <em>more</em> matches (3,205 vs 2,400) on the entire ‘<code>/dev/sda</code>‘ device than before. My best guess is that this is a consequence of installing Ubuntu updates after the previous run of `<code>bulk_extractor</code>` (including a kernel upgrade from <code>5.4.0-14</code> to <code>5.4.0-18</code>), which added additional files to the unencrypted ‘<code>/boot</code>‘ partition ‘<code>/dev/sda5</code>‘.</p> <p>This is a great example of the type of data that might <em>not</em> be wiped when the BusKill self-destruct trigger is executed. Not only will all of these files be intact, but their metadata is <em>also</em> intact. Therefore, a forensics team would be able to collect enough evicence to conclude with relative or near-certainty:</p> <ol> <li>Which Linux distro you were running</li> <li>Which kernel version you were running</li> <li>What day you installed your OS</li> <li>What day you updated all previous kernel versions</li> </ol> <p>Note that the metadata indicating the timestamp that kernels were downlaoded/installed <em>might</em> be able <a href="https://2019.www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting">correlate</a> your previous browsing activites with network survalence records, <a href="https://2019.www.torproject.org/docs/faq.html.en#AmITotallyAnonymous">even if</a> you were browsing on the Tor anonymitity network.</p> <pre class="brush: bash; title: ; notranslate" title=""> root@kali:/# mount -o ro /dev/sda5 /mnt root@kali:/# ls -lah /mnt total 194M drwxr-xr-x 5 root root 4.0K Mar 20 18:05 . drwxr-xr-x 1 root root 160 Mar 20 18:41 .. -rw-r--r-- 1 root root 233K Jan 13 11:26 config-5.4.0-1002-oem -rw-r--r-- 1 root root 233K Feb 6 22:30 config-5.4.0-14-generic -rw-r--r-- 1 root root 233K Mar 7 16:23 config-5.4.0-18-generic drwxrwxr-x 2 root root 4.0K Mar 20 13:43 efi drwxr-xr-x 4 root root 4.0K Mar 20 18:05 grub lrwxrwxrwx 1 root root 27 Mar 20 18:03 initrd.img -> initrd.img-5.4.0-18-generic -rw-r--r-- 1 root root 79M Mar 20 18:05 initrd.img-5.4.0-14-generic -rw-r--r-- 1 root root 79M Mar 20 18:05 initrd.img-5.4.0-18-generic lrwxrwxrwx 1 root root 27 Mar 20 13:46 initrd.img.old -> initrd.img-5.4.0-14-generic drwx------ 2 root root 16K Mar 20 13:42 lost+found -rw-r--r-- 1 root root 179K Feb 13 23:09 memtest86+.bin -rw-r--r-- 1 root root 181K Feb 13 23:09 memtest86+.elf -rw-r--r-- 1 root root 181K Feb 13 23:09 memtest86+_multiboot.bin -rw------- 1 root root 4.5M Jan 13 11:26 System.map-5.4.0-1002-oem -rw------- 1 root root 4.5M Feb 6 22:30 System.map-5.4.0-14-generic -rw------- 1 root root 4.6M Mar 7 16:23 System.map-5.4.0-18-generic lrwxrwxrwx 1 root root 24 Mar 20 18:03 vmlinuz -> vmlinuz-5.4.0-18-generic -rw-r--r-- 1 root root 12M Mar 9 07:53 vmlinuz-5.4.0-14-generic -rw------- 1 root root 12M Mar 7 16:25 vmlinuz-5.4.0-18-generic lrwxrwxrwx 1 root root 24 Mar 20 13:49 vmlinuz.old -> vmlinuz-5.4.0-14-generic root@kali:/# root@kali:~# cd /mnt root@kali:/mnt# stat *5.4.0* ... File: System.map-5.4.0-1002-oem Size: 4697966 Blocks: 9176 IO Block: 4096 regular file Device: 805h/2053d Inode: 13 Links: 1 Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2020-01-13 11:26:40.000000000 +0000 Modify: 2020-01-13 11:26:40.000000000 +0000 Change: 2020-03-20 13:43:07.934486042 +0000 Birth: - File: System.map-5.4.0-14-generic Size: 4714929 Blocks: 9216 IO Block: 4096 regular file Device: 805h/2053d Inode: 14 Links: 1 Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2020-02-06 22:30:48.000000000 +0000 Modify: 2020-02-06 22:30:48.000000000 +0000 Change: 2020-03-20 13:43:08.014486046 +0000 Birth: - File: System.map-5.4.0-18-generic Size: 4732337 Blocks: 9248 IO Block: 4096 regular file Device: 805h/2053d Inode: 316 Links: 1 Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2020-03-20 18:02:55.482467287 +0000 Modify: 2020-03-07 16:23:40.000000000 +0000 Change: 2020-03-20 18:00:44.106622375 +0000 Birth: - </pre> <h1>Limitations/Improvements/Notes</h1> <p>This section will describe limitations, potential improvements, and additional notes about the information that was presented in this article.</p> <h2>Not a suitable replacement for TAILS</h2> <p></p> <div class="wp-block-media-text alignwide has-media-on-the-right is-stacked-on-mobile" style="grid-template-columns:auto"> <figure class="wp-block-media-text__media"> <figure id="attachment_4825" aria-describedby="caption-attachment-4825" style="width: 250px" class="wp-caption alignright"><a href="/tails/"><img loading="lazy" decoding="async" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/03/xtails-logo-square-inverted.png.pagespeed.ic.CyNCbvYFAk.png" alt="TAILS Logo" width="250" height="250" class="size-full wp-image-4825"/></a><figcaption id="caption-attachment-4825" class="wp-caption-text">TAILS is by far the best OS to use for security-critical situations. <a href="/tails/">Click here</a> to learn how to use BusKill in TAILS.</figcaption></figure><br/> </figure> <div class="wp-block-media-text__content"> <p>If you are an investigative journalist, activist, or political dissident operating in an oppressive regime where an adversary having access to your Internet activity could cause pain, suffering, or loss-of-life, then you should consider using <a href="/tails/">TAILS</a>.</p> </div> </div> <p><br style="clear:both"/></p> <h2>ATA Secure Erase</h2> <p>Ah, the good ‘ol days of magnetic spinning disks. Unfortunately, since the advent of SSDs, wear-leaveling can translate a command to “overwrite this sector” to actually “overwrite <em>who-knows-what</em>.”</p> <p>While LUKS was specifically designed with an <a href="clemens.endorphin.org/nmihde/nmihde-A4-ds.pdf">anti-forensics information splitter</a> to inflate the size of the master key, making it exponentially less likely that <em>all</em> of the key is remapped (rather than actually overwritten) when attempting to destroy the LUKS header, this technique (quoting the <a href="https://gitlab.com/cryptsetup/LUKS2-docs/blob/master/luks2_doc_wip.pdf">LUKS2 white paper</a>) is “no longer much effective on modern storage devices.”</p> <p>The best way to ensure safe erasure of the LUKS header on an SSD is therefore to use <a href="https://wiki.archlinux.org/index.php/Securely_wipe_disk#hdparm"><code>hdparam</code></a> to initiate an <a href="https://en.wikipedia.org/wiki/Write_amplification#Secure_erase">ATA Secure Erase</a>.</p> <p>Unfortunately, adding an ATA Secure Erase step to your self-destruct trigger necessarily means that <em>all</em> of your data is permanently lost, so even restoring a backup of the LUKS header would not permit data recovery in the event of a false-positive trigger.</p> <h2 id="headerbackup">Block Backup/Restore</h2> <p>In most cases, the LUKS header could be restored (regaining access to the drive’s data) after self-destruct sequence if a backup were made of the LUKS header.</p> <p>The procedure for making a backup of the LUKS header and restoring it is outside the scope of this article, but suffice it to say that such a backup should probably be encrypted using something like `<code>gpg</code>`, `<code>openssl</code>` or LUKS, and that backup should be physically located in safe space, such as a lock box in an <a href="https://rsf.org/en/ranking">free country</a>, avoiding the <a href="https://www.privacytools.io/providers/#ukusa">14 eyes</a>, and any <a href="https://www.privacytools.io/providers/#kdl">countries</a> that <a href="https://www.gp-digital.org/world-map-of-encryption/">limit</a> digital encryption rights.</p> <h2>Detached LUKS Header</h2> <p>LUKS <a href="https://gitlab.com/cryptsetup/cryptsetup/commit/a22a24bc986386e081bb366baabf2a3415d49d28">supports using a detached header</a>. With this configuration, your actual encrypted storage drive could be setup without any LUKS header actually stored on it–giving you total plausible deniability as your entire drive’s contents would be indistinguishable from a random distribution of bits.</p> <p>Using a detached LUKS header, you could <em>in theory</em> get a 2-32 MB <a href="https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Encrypted_/boot_and_a_detached_LUKS_header_on_USB">USB drive to store your LUKS header on</a>, then have BusKill just overwrite the entire drive when triggered. This is a more robust solution to ensure your master key’s destruction (less error prone, even for future iterations of LUKS), and it would also be more fail-safe to recover from a false-positive: just download your (client-side encrypted) LUKS header from the cloud or a safety deposit box located in a <a href="#headerbackup">free country</a>, and use that to decrypt & access your data again.</p> <h2>Cold Boot Attacks</h2> <p>One theoretical attack against an anti-forensics tool like the BusKill self-destruct trigger described in this article is a so-called <a href="https://en.wikipedia.org/wiki/Cold_boot_attack">Cold Boot</a> attack.</p> <p>As far as I know, there is no evidence to suggest that a single political prisoner was caught or convicted by an opressive regime due to the results of a cold boot attack. At the time of writing, cold boot attacks exist in a purely academic realm.</p> <p>Nevertheless, a welcome improvement to this BusKill self-destruct trigger would be to add a step to overwrite the RAM prior to shutdown. But such an implementation should be very carefully tested to ensure that it actually functions as intended across all linux distros–and that it doesn’t prevent the machine from being able to actually power-off. Otherwise, a poor implementation could actually make your self-destruct sequence <em>less</em> secure.</p> <p>If your risk model is high enough to require defenses against cold boot attacks, you should thoroughly consider switching to <a href="/tails">TAILS</a>–which has a <a href="https://tails.boum.org/contribute/design/memory_erasure">well-tested implementation</a> of RAM shredding.</p> <p>Or you could just use an ultrabook with RAM soldered in-place. Or get yourself some superglue.</p> <h2>Unencrypted Drives unaffected</h2> <p>This trigger has proven to leave zero digital <em>personal</em> evience on the laptop after the buskill trigger, but it was far from leaving zero digital forensic evidence.</p> <p>By default, Ubuntu still has over a gig of unencrypted partitions that have a ton of useful forensic data that is <em>not</em> wiped by the self-destruct sequence.</p> <p>I intentionally designed this self-destruct trigger not to wipe this data because</p> <ol> <li>These unencrypted partitions should only be storing generic data. While it will tell a story of what OS you’re using, which version, and potentially when you downloaded updates, it shouldn’t have any files here that are unique to you and don’t already exist on thousands of other machines around the world<br/> </li> <li>Writing >1G of random data to disk takes time. The self-destruct sequence described in this article was intentionally designed to prioritize cutting power to the RAM ASAP.</li> </ol> <p>That said, a welcome improvement may be a partitioning scheme that minimizes the size of the necessarily unencrypted partitions so that they could be quickly overwritten during the self-destruct sequence.</p> <h2>PRs Welcome!</h2> <p>Don’t like this BusKill self-destruct trigger implementation? Wish it did a RAM wipe? Wish it did an ATA secure erase? Wish it wiped all drives (not just LUKS ones)? Or wish it <em>didn’t</em> wipe all LUKS drives (only the rootfs one)?</p> <p>Feel free to fork our <a href="https://github.com/BusKill/buskill-linux">buskill-linux repo</a> on github, modify the <a href="https://github.com/BusKill/buskill-linux/blob/master/triggers/buskill-selfdestruct.sh">buskill-selfdestruct.sh</a> trigger, add your <a href="https://github.com/BusKill/buskill-linux/tree/master/triggers">own trigger</a>, and send us your a <a href="https://github.com/BusKill/buskill-linux/pulls?q=">pull request</a>.</p> <p>Just be sure to share your work with the community using #BusKill on twitter or mastodon. And if you’d like your own trigger to be featured on this blog, feel free to <a href="/contact">contact us</a> about it.</p> <h1>Further Reading</h1> <ol> <li><a href="https://clemens.endorphin.org/nmihde/nmihde-A4-ds.pdf">New Methods in Hard Disk Encryption (Anti-Forensics Information Splitter)</a> by Clemens Fruhwirth, 2004.</li> <li><a href="https://gitlab.com/cryptsetup/cryptsetup/-/wikis/LUKS-standard/on-disk-format.pdf">LUKS1 On-Disk Format Specification</a> by Clemens Fruhwirth and Milan Broz, 2005-2018.</li> <li><a href="https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions">Cryptsetup FAQ</a> (outdated)</li> <li><a href="https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation#Wipe_LUKS_header">Wipe LUKS Header – Arch Wiki</a></li> </ol> <h1>Similar Projects</h1> <ol> <li><a href="https://github.com/juliocesarfort/nukemyluks">Nuke My LUKS</a> (doesn’t work for LUKS2)</li> <li><a href="https://github.com/hephaest0s/usbkill">USBKill</a></li> <li><a href="https://github.com/NateBrune/silk-guardian">Silk Guardian</a></li> <li><a href="https://usbguard.github.io/">USB Guard</a></li> <li><a href="https://github.com/MonolithInd/suicideCrypt">Suicide Crypt</a></li> <li><a href="http://www.fiftythree.org/etherkiller/">Bus Killer</a> (No relation)</li> </ol> <blockquote><p> If you’d like to purchase a BusKill cable, <a href="/buy">click here</a>. </p></blockquote> <div class="ShariffSC" style="margin-bottom:19px;"><div class="shariff shariff-align-flex-start shariff-widget-align-flex-start" style="display:none"><ul class="shariff-buttons theme-default orientation-horizontal buttonsize-medium"><li class="shariff-button facebook shariff-nocustomcolor" style="background-color:#4273c8"><a href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on Facebook" aria-label="Share on Facebook" role="button" rel="nofollow" class="shariff-link" style="; background-color:#3b5998; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 32"><path fill="#3b5998" d="M17.1 0.2v4.7h-2.8q-1.5 0-2.1 0.6t-0.5 1.9v3.4h5.2l-0.7 5.3h-4.5v13.6h-5.5v-13.6h-4.5v-5.3h4.5v-3.9q0-3.3 1.9-5.2t5-1.8q2.6 0 4.1 0.2z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button twitter shariff-nocustomcolor" style="background-color:#595959"><a href="https://twitter.com/share?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&text=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29&via=BusKillin" title="Share on X" aria-label="Share on X" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#000; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill="#000" d="M14.258 10.152L23.176 0h-2.113l-7.747 8.813L7.133 0H0l9.352 13.328L0 23.973h2.113l8.176-9.309 6.531 9.309h7.133zm-2.895 3.293l-.949-1.328L2.875 1.56h3.246l6.086 8.523.945 1.328 7.91 11.078h-3.246zm0 0"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button reddit shariff-nocustomcolor" style="background-color:#ff5700"><a href="https://www.reddit.com/submit?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on Reddit" aria-label="Share on Reddit" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#ff4500; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path fill="#ff4500" d="M440.3 203.5c-15 0-28.2 6.2-37.9 15.9-35.7-24.7-83.8-40.6-137.1-42.3L293 52.3l88.2 19.8c0 21.6 17.6 39.2 39.2 39.2 22 0 39.7-18.1 39.7-39.7s-17.6-39.7-39.7-39.7c-15.4 0-28.7 9.3-35.3 22l-97.4-21.6c-4.9-1.3-9.7 2.2-11 7.1L246.3 177c-52.9 2.2-100.5 18.1-136.3 42.8-9.7-10.1-23.4-16.3-38.4-16.3-55.6 0-73.8 74.6-22.9 100.1-1.8 7.9-2.6 16.3-2.6 24.7 0 83.8 94.4 151.7 210.3 151.7 116.4 0 210.8-67.9 210.8-151.7 0-8.4-.9-17.2-3.1-25.1 49.9-25.6 31.5-99.7-23.8-99.7zM129.4 308.9c0-22 17.6-39.7 39.7-39.7 21.6 0 39.2 17.6 39.2 39.7 0 21.6-17.6 39.2-39.2 39.2-22 .1-39.7-17.6-39.7-39.2zm214.3 93.5c-36.4 36.4-139.1 36.4-175.5 0-4-3.5-4-9.7 0-13.7 3.5-3.5 9.7-3.5 13.2 0 27.8 28.5 120 29 149 0 3.5-3.5 9.7-3.5 13.2 0 4.1 4 4.1 10.2.1 13.7zm-.8-54.2c-21.6 0-39.2-17.6-39.2-39.2 0-22 17.6-39.7 39.2-39.7 22 0 39.7 17.6 39.7 39.7-.1 21.5-17.7 39.2-39.7 39.2z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button diaspora shariff-nocustomcolor" style="background-color:#b3b3b3"><a href="https://share.diasporafoundation.org/?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&title=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29" title="Share on diaspora*" aria-label="Share on diaspora*" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#999; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 33 32"><path fill="#999" d="M20.6 28.2c-0.8-1.2-2.1-2.9-2.9-4-0.8-1.1-1.4-1.9-1.4-1.9s-1.2 1.6-2.8 3.8c-1.5 2.1-2.8 3.8-2.8 3.8 0 0-5.5-3.9-5.5-3.9 0 0 1.2-1.8 2.8-4s2.8-4 2.8-4.1c0-0.1-0.5-0.2-4.4-1.5-2.4-0.8-4.4-1.5-4.4-1.5 0 0 0.2-0.8 1-3.2 0.6-1.8 1-3.2 1.1-3.3s2.1 0.6 4.6 1.5c2.5 0.8 4.6 1.5 4.6 1.5s0.1 0 0.1-0.1c0 0 0-2.2 0-4.8s0-4.7 0.1-4.7c0 0 0.7 0 3.3 0 1.8 0 3.3 0 3.4 0 0 0 0.1 1.4 0.2 4.6 0.1 5.2 0.1 5.3 0.2 5.3 0 0 2-0.7 4.5-1.5s4.4-1.5 4.4-1.5c0 0.1 2 6.5 2 6.5 0 0-2 0.7-4.5 1.5-3.4 1.1-4.5 1.5-4.5 1.6 0 0 1.2 1.8 2.6 3.9 1.5 2.1 2.6 3.9 2.6 3.9 0 0-5.4 4-5.5 4 0 0-0.7-0.9-1.5-2.1z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button linkedin shariff-nocustomcolor" style="background-color:#1488bf"><a href="https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on LinkedIn" aria-label="Share on LinkedIn" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#0077b5; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 27 32"><path fill="#0077b5" d="M6.2 11.2v17.7h-5.9v-17.7h5.9zM6.6 5.7q0 1.3-0.9 2.2t-2.4 0.9h0q-1.5 0-2.4-0.9t-0.9-2.2 0.9-2.2 2.4-0.9 2.4 0.9 0.9 2.2zM27.4 18.7v10.1h-5.9v-9.5q0-1.9-0.7-2.9t-2.3-1.1q-1.1 0-1.9 0.6t-1.2 1.5q-0.2 0.5-0.2 1.4v9.9h-5.9q0-7.1 0-11.6t0-5.3l0-0.9h5.9v2.6h0q0.4-0.6 0.7-1t1-0.9 1.6-0.8 2-0.3q3 0 4.9 2t1.9 6z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button whatsapp shariff-nocustomcolor" style="background-color:#5cbe4a"><a href="https://api.whatsapp.com/send?text=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F%20LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29" title="Share on Whatsapp" aria-label="Share on Whatsapp" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#34af23; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path fill="#34af23" d="M17.6 17.4q0.2 0 1.7 0.8t1.6 0.9q0 0.1 0 0.3 0 0.6-0.3 1.4-0.3 0.7-1.3 1.2t-1.8 0.5q-1 0-3.4-1.1-1.7-0.8-3-2.1t-2.6-3.3q-1.3-1.9-1.3-3.5v-0.1q0.1-1.6 1.3-2.8 0.4-0.4 0.9-0.4 0.1 0 0.3 0t0.3 0q0.3 0 0.5 0.1t0.3 0.5q0.1 0.4 0.6 1.6t0.4 1.3q0 0.4-0.6 1t-0.6 0.8q0 0.1 0.1 0.3 0.6 1.3 1.8 2.4 1 0.9 2.7 1.8 0.2 0.1 0.4 0.1 0.3 0 1-0.9t0.9-0.9zM14 26.9q2.3 0 4.3-0.9t3.6-2.4 2.4-3.6 0.9-4.3-0.9-4.3-2.4-3.6-3.6-2.4-4.3-0.9-4.3 0.9-3.6 2.4-2.4 3.6-0.9 4.3q0 3.6 2.1 6.6l-1.4 4.2 4.3-1.4q2.8 1.9 6.2 1.9zM14 2.2q2.7 0 5.2 1.1t4.3 2.9 2.9 4.3 1.1 5.2-1.1 5.2-2.9 4.3-4.3 2.9-5.2 1.1q-3.5 0-6.5-1.7l-7.4 2.4 2.4-7.2q-1.9-3.2-1.9-6.9 0-2.7 1.1-5.2t2.9-4.3 4.3-2.9 5.2-1.1z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button threema shariff-nocustomcolor shariff-mobile" style="background-color:#4fbc24"><a href="threema://compose?text=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29%20https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on Threema" aria-label="Share on Threema" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#1f1f1f; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path fill="#1f1f1f" d="M30.8 10.9c-0.3-1.4-0.9-2.6-1.8-3.8-2-2.6-5.5-4.5-9.4-5.2-1.3-0.2-1.9-0.3-3.5-0.3s-2.2 0-3.5 0.3c-4 0.7-7.4 2.6-9.4 5.2-0.9 1.2-1.5 2.4-1.8 3.8-0.1 0.5-0.2 1.2-0.2 1.6 0 0.4 0.1 1.1 0.2 1.6 0.4 1.9 1.3 3.4 2.9 5 0.8 0.8 0.8 0.8 0.7 1.3 0 0.6-0.5 1.6-1.7 3.6-0.3 0.5-0.5 0.9-0.5 0.9 0 0.1 0.1 0.1 0.5 0 0.8-0.2 2.3-0.6 5.6-1.6 1.1-0.3 1.3-0.4 2.3-0.4 0.8 0 1.1 0 2.3 0.2 1.5 0.2 3.5 0.2 4.9 0 5.1-0.6 9.3-2.9 11.4-6.3 0.5-0.9 0.9-1.8 1.1-2.8 0.1-0.5 0.2-1.1 0.2-1.6 0-0.7-0.1-1.1-0.2-1.6-0.3-1.4 0.1 0.5 0 0zM20.6 17.3c0 0.4-0.4 0.8-0.8 0.8h-7.7c-0.4 0-0.8-0.4-0.8-0.8v-4.6c0-0.4 0.4-0.8 0.8-0.8h0.2l0-1.6c0-0.9 0-1.8 0.1-2 0.1-0.6 0.6-1.2 1.1-1.7s1.1-0.7 1.9-0.8c1.8-0.3 3.7 0.7 4.2 2.2 0.1 0.3 0.1 0.7 0.1 2.1v0 1.7h0.1c0.4 0 0.8 0.4 0.8 0.8v4.6zM15.6 7.3c-0.5 0.1-0.8 0.3-1.2 0.6s-0.6 0.8-0.7 1.3c0 0.2 0 0.8 0 1.5l0 1.2h4.6v-1.3c0-1 0-1.4-0.1-1.6-0.3-1.1-1.5-1.9-2.6-1.7zM25.8 28.2c0 1.2-1 2.2-2.1 2.2s-2.1-1-2.1-2.1c0-1.2 1-2.1 2.2-2.1s2.2 1 2.2 2.2zM18.1 28.2c0 1.2-1 2.2-2.1 2.2s-2.1-1-2.1-2.1c0-1.2 1-2.1 2.2-2.1s2.2 1 2.2 2.2zM10.4 28.2c0 1.2-1 2.2-2.1 2.2s-2.1-1-2.1-2.1c0-1.2 1-2.1 2.2-2.1s2.2 1 2.2 2.2z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button telegram shariff-nocustomcolor" style="background-color:#4084A6"><a href="https://telegram.me/share/url?url=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&text=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29" title="Share on Telegram" aria-label="Share on Telegram" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#0088cc; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path fill="#0088cc" d="M30.8 6.5l-4.5 21.4c-.3 1.5-1.2 1.9-2.5 1.2L16.9 24l-3.3 3.2c-.4.4-.7.7-1.4.7l.5-7L25.5 9.2c.6-.5-.1-.8-.9-.3l-15.8 10L2 16.7c-1.5-.5-1.5-1.5.3-2.2L28.9 4.3c1.3-.5 2.3.3 1.9 2.2z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button sms shariff-nocustomcolor shariff-mobile" style="background-color:#d7d9d8"><a href="sms:?&body=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F" title="Share on SMS" aria-label="Share on SMS" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#a1e877; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg xmlns="http://www.w3.org/2000/svg" width="510" height="510" viewBox="0 0 510 510"><path fill="#a1e877" d="M459 0H51C23 0 0 23 0 51v459l102-102h357c28.1 0 51-22.9 51-51V51C510 23 487.1 0 459 0zM178.5 229.5h-51v-51h51V229.5zM280.5 229.5h-51v-51h51V229.5zM382.5 229.5h-51v-51h51V229.5z"/></svg></span><span class="shariff-text">share</span> </a></li><li class="shariff-button mailto shariff-nocustomcolor" style="background-color:#a8a8a8"><a href="mailto:?body=https%3A%2F%2Fwww.buskill.in%2Fluks-self-destruct%2F&subject=LUKS%20Header%20Shredder%20%28BusKill%20Self-Destruct%20Trigger%29" title="Send by email" aria-label="Send by email" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#999; color:#fff"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path fill="#999" d="M32 12.7v14.2q0 1.2-0.8 2t-2 0.9h-26.3q-1.2 0-2-0.9t-0.8-2v-14.2q0.8 0.9 1.8 1.6 6.5 4.4 8.9 6.1 1 0.8 1.6 1.2t1.7 0.9 2 0.4h0.1q0.9 0 2-0.4t1.7-0.9 1.6-1.2q3-2.2 8.9-6.1 1-0.7 1.8-1.6zM32 7.4q0 1.4-0.9 2.7t-2.2 2.2q-6.7 4.7-8.4 5.8-0.2 0.1-0.7 0.5t-1 0.7-0.9 0.6-1.1 0.5-0.9 0.2h-0.1q-0.4 0-0.9-0.2t-1.1-0.5-0.9-0.6-1-0.7-0.7-0.5q-1.6-1.1-4.7-3.2t-3.6-2.6q-1.1-0.7-2.1-2t-1-2.5q0-1.4 0.7-2.3t2.1-0.9h26.3q1.2 0 2 0.8t0.9 2z"/></svg></span><span class="shariff-text">email</span> </a></li><li class="shariff-button bitcoin shariff-nocustomcolor" style="background-color:#191919"><a href="https://www.buskill.in/wp-content/plugins/shariff/services/../bitcoin.php?bitcoinaddress=1DXyJpmu2KQMw2v4QJVzzjZo6f87BBndu6" title="Donate with Bitcoin" aria-label="Donate with Bitcoin" role="button" rel="noopener nofollow" class="shariff-link" style="; background-color:#f7931a; color:#fff" target="_blank"><span class="shariff-icon" style=""><svg width="32px" height="20px" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 23 32"><path fill="#f7931a" d="M20.8 11.4q0.3 3.3-2.3 4.6 2.1 0.5 3.1 1.8t0.8 3.8q-0.1 1.3-0.6 2.2t-1.2 1.6-1.7 1-2.2 0.6-2.6 0.3v4.6h-2.7v-4.5q-1.4 0-2.2 0v4.5h-2.7v-4.6q-0.3 0-1 0t-1 0h-3.6l0.6-3.3h2q0.9 0 1-0.9v-7.2h0.3q-0.1 0-0.3 0v-5.1q-0.2-1.2-1.6-1.2h-2v-2.9l3.8 0q1.1 0 1.7 0v-4.5h2.8v4.4q1.5 0 2.2 0v-4.4h2.8v4.5q1.4 0.1 2.5 0.4t2 0.8 1.5 1.4 0.7 2zM17 21.2q0-0.6-0.3-1.1t-0.7-0.8-1-0.5-1.2-0.3-1.3-0.2-1.2-0.1-1.2 0-0.8 0v6q0.1 0 0.7 0t0.9 0 0.9 0 1-0.1 1-0.2 1-0.2 0.8-0.4 0.7-0.5 0.4-0.7 0.2-0.9zM15.7 12.7q0-0.6-0.2-1t-0.5-0.7-0.9-0.5-1-0.3-1.1-0.1-1 0-1 0-0.7 0v5.5q0.1 0 0.6 0t0.8 0 0.9 0 1-0.1 0.9-0.2 0.9-0.3 0.7-0.5 0.5-0.7 0.2-0.9z"/></svg></span><span class="shariff-text">donate</span> </a></li></ul></div></div> </div> </div> <footer class="entry-footer"><span class="tags-links"><a href="https://www.buskill.in/tag/anti-forensics/" rel="tag">anti-forensics</a><a href="https://www.buskill.in/tag/buskill/" rel="tag">buskill</a><a href="https://www.buskill.in/tag/cryptsetup/" rel="tag">cryptsetup</a><a href="https://www.buskill.in/tag/dead-man-switch/" rel="tag">dead man switch</a><a href="https://www.buskill.in/tag/demo/" rel="tag">demo</a><a href="https://www.buskill.in/tag/dm-crypt/" rel="tag">dm-crypt</a><a href="https://www.buskill.in/tag/forensics/" rel="tag">forensics</a><a href="https://www.buskill.in/tag/hexdump/" rel="tag">hexdump</a><a href="https://www.buskill.in/tag/kali/" rel="tag">kali</a><a href="https://www.buskill.in/tag/kill-cord/" rel="tag">kill cord</a><a href="https://www.buskill.in/tag/linux/" rel="tag">linux</a><a href="https://www.buskill.in/tag/luks/" rel="tag">luks</a><a href="https://www.buskill.in/tag/self-destruct/" rel="tag">self-destruct</a><a href="https://www.buskill.in/tag/trigger/" rel="tag">trigger</a><a href="https://www.buskill.in/tag/ubuntu/" rel="tag">ubuntu</a></span></footer></article> <nav class="navigation post-navigation"> <h2 class="screen-reader-text">Post navigation</h2> <div class="nav-links"> <div class="nav-previous"> <a href="https://www.buskill.in/buskill-onion-service-tor/" rel="prev"> <img width="150" height="150" src="https://www.buskill.in/wp-content/uploads/sites/8/2021/01/xbuskill_onion_featuredImage1-150x150.jpg.pagespeed.ic.UUMuvktqr8.jpg" class="attachment-thumbnail size-thumbnail wp-post-image" alt="Visit this site now on our tor .onion address" decoding="async" loading="lazy"/><div class="nav-innner"><span>Previous Post</span> <div>BusKill Onion Service</div></div></a> </div> <div class="nav-next"> <a href="https://www.buskill.in/qubes-os/" rel="next"><div class="nav-innner"><span>Next Post</span> <div>A Laptop Kill Cord for QubesOS</div></div><img width="150" height="150" src="https://www.buskill.in/wp-content/uploads/sites/8/xqubes-os_featuredImage1-150x150.png.pagespeed.ic.OPaJs1IIj-.png" class="attachment-thumbnail size-thumbnail wp-post-image" alt="QubesOS" decoding="async" loading="lazy"/> </a> </div> </div> </nav> <div class="author-box"> <div class="author-avatar"> <a href="https://www.buskill.in/author/tech/"> <img alt='' src='https://secure.gravatar.com/avatar/6cf31feac952aa2ff12540264f2fac51?s=100&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/6cf31feac952aa2ff12540264f2fac51?s=200&d=mm&r=g 2x' class='avatar avatar-100 photo' height='100' width='100' loading='lazy' decoding='async'/> </a> </div> <div class="author-description"> <h3>Michael Altfield</h3> <span class="author-posts"> <a href="https://www.buskill.in/author/tech/"> View posts by Michael Altfield </a> </span> <div>Hi, I'm Michael Altfield. I write articles about opsec, privacy, and devops <a href="https://michaelaltfield.net/biography/">➡</a> <a href="https://michaelaltfield.net/biography/">About Michael</a></div> </div> </div> <div class="related-posts-section"> <h3 class="related-posts">Related Posts</h3> <ol> <li> <a href="https://www.buskill.in/netherlands-novacustom/" rel="bookmark" title="BusKill available in-store (The Netherlands NovaCustom)"> <img width="720" height="480" src="https://www.buskill.in/wp-content/uploads/sites/8/xnetherlands-novacustom-featuredImage1-720x480.jpg.pagespeed.ic.dSNWtFUshd.jpg" class="attachment-siteorigin-corp-720x480-crop size-siteorigin-corp-720x480-crop wp-post-image" alt="[BusKill] Our Dead Man Switch Magnetic USB Breakaway cables are Now Available in-person in The Netherlands at NovaCustom" decoding="async" loading="lazy"/> <div class="corp-content-wrapper"> <h3 class="related-post-title">BusKill available in-store (The Netherlands NovaCustom)</h3> <p class="related-post-date">November 26, 2024</p> </div> </a> </li> <li> <a href="https://www.buskill.in/bitcoin-black-friday-2024/" rel="bookmark" title="Bitcoin Black Friday (10% discount on BusKill)"> <img width="720" height="480" src="https://www.buskill.in/wp-content/uploads/sites/8/xbuskill_bitcoinBlackFriday2022_featuredImage1-720x480.png.pagespeed.ic.7PN53EAvBt.jpg" class="attachment-siteorigin-corp-720x480-crop size-siteorigin-corp-720x480-crop wp-post-image" alt="BusKill Bitcoin Black Friday Sale - Our Dead Man Switch Magnetic USB Brakaway cables are 10% off all orders paid with cryptocurrency" decoding="async" loading="lazy"/> <div class="corp-content-wrapper"> <h3 class="related-post-title">Bitcoin Black Friday (10% discount on BusKill)</h3> <p class="related-post-date">November 22, 2024</p> </div> </a> </li> <li> <a href="https://www.buskill.in/defcon32/" rel="bookmark" title="BusKill goes to DEF CON 32"> <img width="720" height="480" src="https://www.buskill.in/wp-content/uploads/sites/8/xdefcon32_featuredImage1-720x480.jpg.pagespeed.ic.p4u_rY4RmL.jpg" class="attachment-siteorigin-corp-720x480-crop size-siteorigin-corp-720x480-crop wp-post-image" alt="BusKill goes to DEF CON 32 Engage" decoding="async" loading="lazy"/> <div class="corp-content-wrapper"> <h3 class="related-post-title">BusKill goes to DEF CON 32</h3> <p class="related-post-date">July 16, 2024</p> </div> </a> </li> </ol> </div> <div id="comments" class="comments-area"> <div id="respond" class="comment-respond"> <h3 id="reply-title" class="comment-reply-title">Leave a Reply <small><a rel="nofollow" id="cancel-comment-reply-link" href="/luks-self-destruct/#respond" style="display:none;">Cancel reply</a></small></h3><form action="https://www.buskill.in/wp-comments-post.php" method="post" id="commentform" class="comment-form" novalidate><p class="comment-notes"><span id="email-notes">Your email address will not be published.</span> <span class="required-field-message">Required fields are marked <span class="required">*</span></span></p><p class="comment-form-comment"><label for="comment">Comment <span class="required">*</span></label> <textarea id="comment" name="comment" cols="45" rows="8" maxlength="65525" required></textarea></p><p class="comment-form-author"><label for="author">Name <span class="required">*</span></label> <input id="author" name="author" type="text" value="" size="30" maxlength="245" autocomplete="name" required /></p> <p class="comment-form-email"><label for="email">Email <span class="required">*</span></label> <input id="email" name="email" type="email" value="" size="30" maxlength="100" aria-describedby="email-notes" autocomplete="email" required /></p> <p class="comment-form-url"><label for="url">Website</label> <input id="url" name="url" type="url" value="" size="30" maxlength="200" autocomplete="url"/></p> <p class="comment-form-cookies-consent"><input id="wp-comment-cookies-consent" name="wp-comment-cookies-consent" type="checkbox" value="yes"/> <label for="wp-comment-cookies-consent">Save my name, email, and website in this browser for the next time I comment.</label></p> <p class="form-submit"><input name="submit" type="submit" id="submit" class="submit" value="Post Comment"/> <input type='hidden' name='comment_post_ID' value='4738' id='comment_post_ID'/> <input type='hidden' name='comment_parent' id='comment_parent' value='0'/> </p><input type="hidden" id="killer_value" name="killer_value" value="30bb3825e8f631cc6075c0f87bb4978c"/></form> </div> </div> </main> </div> <aside id="secondary" class="widget-area"> <aside id="recent-posts-2" class="widget widget_recent_entries"> <h2 class="widget-title">Recent Posts</h2> <ul> <li> <a href="https://www.buskill.in/canary-009/">BusKill Canary #9</a> </li> <li> <a href="https://www.buskill.in/netherlands-novacustom/">BusKill available in-store (The Netherlands NovaCustom)</a> </li> <li> <a href="https://www.buskill.in/netherlands-novacustom-fr/">BusKill physiquement disponible en magasin (NovaCustom, Pays-Bas)</a> </li> <li> <a href="https://www.buskill.in/netherlands-novacustom-nl/">BusKill verkrijgbaar in de winkel (NovaCustom, Nederland)</a> </li> <li> <a href="https://www.buskill.in/netherlands-novacustom-de/">Buskill physisch im Geschäft erhältlich (NovaCustom, Niederlande)</a> </li> </ul> </aside><aside id="text-4" class="widget widget_text"><h2 class="widget-title">Featured</h2> <div class="textwidget"><div class="rpbt_shortcode"> <div id='rpbt-related-gallery-1' class='gallery related-gallery related-galleryid-5856 gallery-columns-1 gallery-size-medium'><figure class='gallery-item' role='group' aria-label='BusKill Now Shipping!'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/buskill-now-shipping/'><img loading="lazy" decoding="async" width="300" height="157" src="https://www.buskill.in/wp-content/uploads/sites/8/xbuskill_now_shipping_featuredImage1-300x157.png.pagespeed.ic.L3xdzZVOVQ.jpg" class="attachment-medium size-medium" alt="[BusKill] Our Dead Man Switch Magnetic Breakaway cables are Now Shipping!" aria-describedby="rpbt-related-gallery-1-5856"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-1-5856'> BusKill Now Shipping! </figcaption></figure> </div> </div> <div class="rpbt_shortcode"> <div id='rpbt-related-gallery-2' class='gallery related-gallery related-galleryid-4738 gallery-columns-1 gallery-size-medium'><figure class='gallery-item' role='group' aria-label='LUKS Header Shredder (BusKill Self-Destruct Trigger)'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/luks-self-destruct/'><img loading="lazy" decoding="async" width="300" height="157" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/10/xluksHeaderShredder_featuredImage-300x157.jpg.pagespeed.ic.x-7L1qHTPE.jpg" class="attachment-medium size-medium" alt="LUKS Header Shredder" aria-describedby="rpbt-related-gallery-2-4738"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-2-4738'> LUKS Header Shredder (BusKill Self-Destruct Trigger) </figcaption></figure> </div> </div> <div class="rpbt_shortcode"> <div id='rpbt-related-gallery-3' class='gallery related-gallery related-galleryid-4733 gallery-columns-1 gallery-size-medium'><figure class='gallery-item' role='group' aria-label='A Laptop Kill Cord for QubesOS'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/qubes-os/'><img loading="lazy" decoding="async" width="300" height="199" src="https://www.buskill.in/wp-content/uploads/sites/8/xqubes-os_featuredImage1-300x199.png.pagespeed.ic.uf_04h_dMN.png" class="attachment-medium size-medium" alt="QubesOS" aria-describedby="rpbt-related-gallery-3-4733"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-3-4733'> A Laptop Kill Cord for QubesOS </figcaption></figure> </div> </div> <div class="rpbt_shortcode"> <div id='rpbt-related-gallery-4' class='gallery related-gallery related-galleryid-4741 gallery-columns-1 gallery-size-medium'><figure class='gallery-item' role='group' aria-label='Quicker Emergency Shutdown for TAILS'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/tails/'><img loading="lazy" decoding="async" width="300" height="188" src="https://www.buskill.in/wp-content/uploads/sites/8/xtails_featuredImage1-300x188.png.pagespeed.ic.U2a9KWJFQ2.png" class="attachment-medium size-medium" alt="TAILS: The Amnesic Incognito Live System" aria-describedby="rpbt-related-gallery-4-4741"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-4-4741'> Quicker Emergency Shutdown for TAILS </figcaption></figure> </div> </div> </div> </aside><aside id="tag_cloud-2" class="widget widget_tag_cloud"><h2 class="widget-title">Tags</h2><div class="tagcloud"><a href="https://www.buskill.in/tag/3d-printing/" class="tag-cloud-link tag-link-134 tag-link-position-1" style="font-size: 12px;">3D Printing</a> <a href="https://www.buskill.in/tag/anonymity/" class="tag-cloud-link tag-link-97 tag-link-position-2" style="font-size: 12px;">anonymity</a> <a href="https://www.buskill.in/tag/anti-forensics/" class="tag-cloud-link tag-link-92 tag-link-position-3" style="font-size: 12px;">anti-forensics</a> <a href="https://www.buskill.in/tag/bitcoin/" class="tag-cloud-link tag-link-128 tag-link-position-4" style="font-size: 12px;">bitcoin</a> <a href="https://www.buskill.in/tag/bitcoin-black-friday/" class="tag-cloud-link tag-link-131 tag-link-position-5" style="font-size: 12px;">bitcoin black friday</a> <a href="https://www.buskill.in/tag/buskill/" class="tag-cloud-link tag-link-59 tag-link-position-6" style="font-size: 12px;">buskill</a> <a href="https://www.buskill.in/tag/buy/" class="tag-cloud-link tag-link-113 tag-link-position-7" style="font-size: 12px;">buy</a> <a href="https://www.buskill.in/tag/canary/" class="tag-cloud-link tag-link-96 tag-link-position-8" style="font-size: 12px;">canary</a> <a href="https://www.buskill.in/tag/censorship/" class="tag-cloud-link tag-link-132 tag-link-position-9" style="font-size: 12px;">censorship</a> <a href="https://www.buskill.in/tag/dead-man-switch/" class="tag-cloud-link tag-link-61 tag-link-position-10" style="font-size: 12px;">dead man switch</a> <a href="https://www.buskill.in/tag/debug/" class="tag-cloud-link tag-link-122 tag-link-position-11" style="font-size: 12px;">debug</a> <a href="https://www.buskill.in/tag/demo/" class="tag-cloud-link tag-link-152 tag-link-position-12" style="font-size: 12px;">demo</a> <a href="https://www.buskill.in/tag/encryption/" class="tag-cloud-link tag-link-99 tag-link-position-13" style="font-size: 12px;">encryption</a> <a href="https://www.buskill.in/tag/germany/" class="tag-cloud-link tag-link-145 tag-link-position-14" style="font-size: 12px;">germany</a> <a href="https://www.buskill.in/tag/haaksbergen/" class="tag-cloud-link tag-link-168 tag-link-position-15" style="font-size: 12px;">haaksbergen</a> <a href="https://www.buskill.in/tag/hardware/" class="tag-cloud-link tag-link-55 tag-link-position-16" style="font-size: 12px;">hardware</a> <a href="https://www.buskill.in/tag/heads/" class="tag-cloud-link tag-link-175 tag-link-position-17" style="font-size: 12px;">heads</a> <a href="https://www.buskill.in/tag/intel/" class="tag-cloud-link tag-link-173 tag-link-position-18" style="font-size: 12px;">intel</a> <a href="https://www.buskill.in/tag/intel-management-engine/" class="tag-cloud-link tag-link-174 tag-link-position-19" style="font-size: 12px;">intel management engine</a> <a href="https://www.buskill.in/tag/interdiction/" class="tag-cloud-link tag-link-138 tag-link-position-20" style="font-size: 12px;">interdiction</a> <a href="https://www.buskill.in/tag/kill-cord/" class="tag-cloud-link tag-link-60 tag-link-position-21" style="font-size: 12px;">kill cord</a> <a href="https://www.buskill.in/tag/laptops/" class="tag-cloud-link tag-link-172 tag-link-position-22" style="font-size: 12px;">laptops</a> <a href="https://www.buskill.in/tag/leipzig/" class="tag-cloud-link tag-link-146 tag-link-position-23" style="font-size: 12px;">leipzig</a> <a href="https://www.buskill.in/tag/linux/" class="tag-cloud-link tag-link-68 tag-link-position-24" style="font-size: 12px;">linux</a> <a href="https://www.buskill.in/tag/lock-screen/" class="tag-cloud-link tag-link-124 tag-link-position-25" style="font-size: 12px;">lock-screen</a> <a href="https://www.buskill.in/tag/monero/" class="tag-cloud-link tag-link-129 tag-link-position-26" style="font-size: 12px;">monero</a> <a href="https://www.buskill.in/tag/novacustom/" class="tag-cloud-link tag-link-171 tag-link-position-27" style="font-size: 12px;">novacustom</a> <a href="https://www.buskill.in/tag/overijssel/" class="tag-cloud-link tag-link-169 tag-link-position-28" style="font-size: 12px;">overijssel</a> <a href="https://www.buskill.in/tag/permissionless/" class="tag-cloud-link tag-link-133 tag-link-position-29" style="font-size: 12px;">permissionless</a> <a href="https://www.buskill.in/tag/pogo/" class="tag-cloud-link tag-link-136 tag-link-position-30" style="font-size: 12px;">pogo</a> <a href="https://www.buskill.in/tag/prototype/" class="tag-cloud-link tag-link-57 tag-link-position-31" style="font-size: 12px;">prototype</a> <a href="https://www.buskill.in/tag/proxysto-re/" class="tag-cloud-link tag-link-144 tag-link-position-32" style="font-size: 12px;">proxysto.re</a> <a href="https://www.buskill.in/tag/qubesos/" class="tag-cloud-link tag-link-74 tag-link-position-33" style="font-size: 12px;">qubesos</a> <a href="https://www.buskill.in/tag/reseller/" class="tag-cloud-link tag-link-143 tag-link-position-34" style="font-size: 12px;">reseller</a> <a href="https://www.buskill.in/tag/sale/" class="tag-cloud-link tag-link-130 tag-link-position-35" style="font-size: 12px;">sale</a> <a href="https://www.buskill.in/tag/security/" class="tag-cloud-link tag-link-104 tag-link-position-36" style="font-size: 12px;">security</a> <a href="https://www.buskill.in/tag/self-destruct/" class="tag-cloud-link tag-link-86 tag-link-position-37" style="font-size: 12px;">self-destruct</a> <a href="https://www.buskill.in/tag/soft-shutdown/" class="tag-cloud-link tag-link-125 tag-link-position-38" style="font-size: 12px;">soft-shutdown</a> <a href="https://www.buskill.in/tag/software/" class="tag-cloud-link tag-link-56 tag-link-position-39" style="font-size: 12px;">software</a> <a href="https://www.buskill.in/tag/solder/" class="tag-cloud-link tag-link-137 tag-link-position-40" style="font-size: 12px;">solder</a> <a href="https://www.buskill.in/tag/tails/" class="tag-cloud-link tag-link-72 tag-link-position-41" style="font-size: 12px;">tails</a> <a href="https://www.buskill.in/tag/the-netherlands/" class="tag-cloud-link tag-link-167 tag-link-position-42" style="font-size: 12px;">the netherlands</a> <a href="https://www.buskill.in/tag/trigger/" class="tag-cloud-link tag-link-87 tag-link-position-43" style="font-size: 12px;">trigger</a> <a href="https://www.buskill.in/tag/twente/" class="tag-cloud-link tag-link-170 tag-link-position-44" style="font-size: 12px;">twente</a> <a href="https://www.buskill.in/tag/usb/" class="tag-cloud-link tag-link-135 tag-link-position-45" style="font-size: 12px;">usb</a></div> </aside><aside id="related-posts-by-taxonomy-4" class="widget related_posts_by_taxonomy"> <h2 class="widget-title">Related Posts</h2> <div id='rpbt-related-gallery-5' class='gallery related-gallery related-galleryid-4738 gallery-columns-1 gallery-size-siteorigin-corp-720x480-crop'><figure class='gallery-item' role='group' aria-label='BusKill available in-store (The Netherlands NovaCustom)'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/netherlands-novacustom/'><img width="720" height="480" src="https://www.buskill.in/wp-content/uploads/sites/8/xnetherlands-novacustom-featuredImage1-720x480.jpg.pagespeed.ic.dSNWtFUshd.jpg" class="attachment-siteorigin-corp-720x480-crop size-siteorigin-corp-720x480-crop" alt="[BusKill] Our Dead Man Switch Magnetic USB Breakaway cables are Now Available in-person in The Netherlands at NovaCustom" aria-describedby="rpbt-related-gallery-5-6990" decoding="async" loading="lazy"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-5-6990'> <a href="https://www.buskill.in/netherlands-novacustom/">BusKill available in-store (The Netherlands NovaCustom)</a> </figcaption></figure><figure class='gallery-item' role='group' aria-label='Bitcoin Black Friday (10% discount on BusKill)'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/bitcoin-black-friday-2023/'><img width="720" height="480" src="https://www.buskill.in/wp-content/uploads/sites/8/xbuskill_bitcoinBlackFriday2022_featuredImage1-720x480.png.pagespeed.ic.7PN53EAvBt.jpg" class="attachment-siteorigin-corp-720x480-crop size-siteorigin-corp-720x480-crop" alt="BusKill Bitcoin Black Friday Sale - Our Dead Man Switch Magnetic USB Brakaway cables are 10% off all orders paid with cryptocurrency" aria-describedby="rpbt-related-gallery-5-6643" decoding="async" loading="lazy"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-5-6643'> <a href="https://www.buskill.in/bitcoin-black-friday-2023/">Bitcoin Black Friday (10% discount on BusKill)</a> </figcaption></figure><figure class='gallery-item' role='group' aria-label='Bitcoin Black Friday (10% discount on BusKill)'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/bitcoin-black-friday-2022/'><img width="720" height="480" src="https://www.buskill.in/wp-content/uploads/sites/8/xbuskill_bitcoinBlackFriday2022_featuredImage1-720x480.png.pagespeed.ic.7PN53EAvBt.jpg" class="attachment-siteorigin-corp-720x480-crop size-siteorigin-corp-720x480-crop" alt="BusKill Bitcoin Black Friday Sale - Our Dead Man Switch Magnetic USB Brakaway cables are 10% off all orders paid with cryptocurrency" aria-describedby="rpbt-related-gallery-5-5984" decoding="async" loading="lazy"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-5-5984'> <a href="https://www.buskill.in/bitcoin-black-friday-2022/">Bitcoin Black Friday (10% discount on BusKill)</a> </figcaption></figure><figure class='gallery-item' role='group' aria-label='3D Printable BusKill Proof-of-Concept'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/3d-print-2023-08/'><img width="720" height="480" src="https://www.buskill.in/wp-content/uploads/sites/8/x3d-print-2023-08_featuredImage1-720x480.jpg.pagespeed.ic.7FSC80eBGr.jpg" class="attachment-siteorigin-corp-720x480-crop size-siteorigin-corp-720x480-crop" alt="3D Printable BusKill Proof of Concept (2023.08)" aria-describedby="rpbt-related-gallery-5-6444" decoding="async" loading="lazy"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-5-6444'> <a href="https://www.buskill.in/3d-print-2023-08/">3D Printable BusKill Proof-of-Concept</a> </figcaption></figure><figure class='gallery-item' role='group' aria-label='Bitcoin Black Friday (10% discount on BusKill)'> <div class='gallery-icon landscape'> <a href='https://www.buskill.in/bitcoin-black-friday-2024/'><img width="720" height="480" src="https://www.buskill.in/wp-content/uploads/sites/8/xbuskill_bitcoinBlackFriday2022_featuredImage1-720x480.png.pagespeed.ic.7PN53EAvBt.jpg" class="attachment-siteorigin-corp-720x480-crop size-siteorigin-corp-720x480-crop" alt="BusKill Bitcoin Black Friday Sale - Our Dead Man Switch Magnetic USB Brakaway cables are 10% off all orders paid with cryptocurrency" aria-describedby="rpbt-related-gallery-5-7058" decoding="async" loading="lazy"/></a> </div> <figcaption class='wp-caption-text gallery-caption' id='rpbt-related-gallery-5-7058'> <a href="https://www.buskill.in/bitcoin-black-friday-2024/">Bitcoin Black Friday (10% discount on BusKill)</a> </figcaption></figure> </div> </aside><aside id="search-2" class="widget widget_search"><form method="get" class="search-form" action="https://www.buskill.in/"> <input type="search" name="s" aria-label="Search for" placeholder="Search" value=""/> <button type="submit" aria-label="Search"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="26" height="28" viewBox="0 0 26 28"> <path d="M18 13c0-3.859-3.141-7-7-7s-7 3.141-7 7 3.141 7 7 7 7-3.141 7-7zM26 26c0 1.094-0.906 2-2 2-0.531 0-1.047-0.219-1.406-0.594l-5.359-5.344c-1.828 1.266-4.016 1.937-6.234 1.937-6.078 0-11-4.922-11-11s4.922-11 11-11 11 4.922 11 11c0 2.219-0.672 4.406-1.937 6.234l5.359 5.359c0.359 0.359 0.578 0.875 0.578 1.406z"></path> </svg> </button> </form> </aside></aside> </div> </div> <footer id="colophon" class="site-footer"> <div class="corp-container"> <div class="widgets widgets-2" aria-label="Footer Widgets"> <aside id="text-3" class="widget widget_text"><h2 class="widget-title">Donate</h2> <div class="textwidget"><div style="word-break: break-all;"><strong>BTC</strong><br/> 1DXyJpmu2KQMw2v4QJVzzjZo6f87BBndu6</p> <p><strong>XMR</strong><br/> 4B5ra5N1SN4d7BqDtkxAE5G5kGNz5mA5oCob41RzzoduM1uPAcr7QmNLzXtci5HvtkNXC7SowkxMjUUCXF2hm57MMS4jwkx</div> <p><strong><a href="/donate">Paypal or Credit Card Donations</a></strong></p> </div> </aside><aside id="text-2" class="widget widget_text"><h2 class="widget-title">Pretty Good Privacy</h2> <div class="textwidget"><div style="word-break: break-all;"> <p><a href="/wp-content/uploads/sites/8/2020/02/buskill_signing.20200212.asc"><strong>Signing Key</strong></a><br/> E0AF FF57 DC00 FBE0 5635 8761 4AE2 1E19 36CE 786A<br/> <br style="clear: both;"/><a href="/wp-content/uploads/sites/8/2020/02/buskill_contact.20200212.asc"><strong>Contact Key</strong></a><br/> B5BA 3326 3BF1 0599 2532 82EF 2CBE 53D9 41B3 AB16<br/> <br style="clear: both;"/><a href="https://www.buskill.in/category/Canary/"><strong>Warrant Canary</strong></a></p> <div style="display: flex; text-align: center; align-items: center; justify-content: space-around; flex-wrap: wrap;"> <p><a href="https://creativecommons.org/licenses/by-sa/4.0/"><img loading="lazy" decoding="async" class="alignnone size-full wp-image-4665" src="https://www.buskill.in/wp-content/uploads/sites/8/2020/02/xccbysa_88x31.png.pagespeed.ic.-FgSRMvnKY.png" alt="CC-BY-SA" width="88" height="31"/></a></p> <p><a href="https://buskill.in/#buy"><img decoding="async" class="aligncenter size-full wp-image-5506" style="background: #FFFFFF; padding: 5px; border-radius: 10px;" src="https://www.buskill.in/wp-content/uploads/sites/8/2021/10/76xNxbitcoin_accepted_here.png.pagespeed.ic._FSmz_qQCE.png" alt="Bitcoin Accepted Here" width="76"/></a></p> <p><a href="https://buskill.in/#buy"><img decoding="async" class="aligncenter size-full wp-image-5507" style="background: #FFFFFF; padding: 5px; border-radius: 10px;" src="https://www.buskill.in/wp-content/uploads/sites/8/2021/10/76xNxmonero_accepted_here.png.pagespeed.ic.IE_RoAzA4B.png" alt="Monero Accepted Here" width="76"/></a></p> </div> </div> </div> </aside> </div> </div> <div class="bottom-bar"> <div class="corp-container"> <div class="site-info"> <span>2025 © BusKill</span><span><a class="privacy-policy-link" href="https://www.buskill.in/privacy-policy/" rel="privacy-policy">Privacy Policy</a></span><span>Theme by <a href="https://siteorigin.com/">SiteOrigin</a></span> </div> <div class="footer-menu"> <div class="menu-footer-menu-container"><ul id="menu-footer-menu" class="menu"><li id="menu-item-4650" class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-4650"><a href="https://www.buskill.in/blog/">News</a></li> <li id="menu-item-5963" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-5963"><a href="/#press">Press</a></li> <li id="menu-item-6837" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-6837"><a href="https://docs.buskill.in/">Docs</a></li> <li id="menu-item-4651" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4651"><a href="https://www.buskill.in/contact/">Contact Us</a></li> <li id="menu-item-4652" class="menu-button menu-item menu-item-type-custom menu-item-object-custom menu-item-4652"><a href="/buy">Buy Now</a></li> </ul></div> <div class="widget widget_sow-social-media-buttons"><div class="so-widget-sow-social-media-buttons so-widget-sow-social-media-buttons-atom-db00a9d36054-4738"> <h2 class="widgettitle">Follow Us</h2> <div class="social-media-button-container"> <a class="ow-button-hover sow-social-media-button-facebook-0 sow-social-media-button" title="facebook icon" aria-label="facebook icon" target="_blank" rel="noopener noreferrer" href="https://www.facebook.com/buskillin"> <span> <span class="sow-icon-fontawesome sow-fab" data-sow-icon="" aria-hidden="true"></span> </span> </a> <a class="ow-button-hover sow-social-media-button-x-twitter-0 sow-social-media-button" title="twitter icon" aria-label="twitter icon" target="_blank" rel="noopener noreferrer" href="https://twitter.com/buskillin"> <span> <span class="sow-icon-fontawesome sow-fab" data-sow-icon="" aria-hidden="true"></span> </span> </a> <a class="ow-button-hover sow-social-media-button-github-0 sow-social-media-button" title="github icon" aria-label="github icon" target="_blank" rel="noopener noreferrer" href="https://github.com/BusKill"> <span> <span class="sow-icon-fontawesome sow-fab" data-sow-icon="" aria-hidden="true"></span> </span> </a> <a class="ow-button-hover sow-social-media-button-envelope-0 sow-social-media-button" title="email icon" aria-label="email icon" target="_blank" rel="noopener noreferrer" href="/#newsletter"> <span> <span class="sow-icon-fontawesome sow-fas" data-sow-icon="" aria-hidden="true"></span> </span> </a> <a class="ow-button-hover sow-social-media-button-youtube-0 sow-social-media-button" title="youtube icon" aria-label="youtube icon" target="_blank" rel="noopener noreferrer" href="https://www.youtube.com/channel/UC5Njxb027m2OmrocrH33oew/about"> <span> <span class="sow-icon-fontawesome sow-fab" data-sow-icon="" aria-hidden="true"></span> </span> </a> <a class="ow-button-hover sow-social-media-button-reddit-0 sow-social-media-button" title="reddit icon" aria-label="reddit icon" target="_blank" rel="noopener noreferrer" href="https://www.reddit.com/r/BusKill"> <span> <span class="sow-icon-fontawesome sow-fab" data-sow-icon="" aria-hidden="true"></span> </span> </a> </div> </div></div> </div> </div> </div> </footer> </div> <div id="scroll-to-top"> <span class="screen-reader-text">Scroll to top</span> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 24 24" style="enable-background:new 0 0 24 24;" xml:space="preserve"> <path class="st0" d="M12,2c0.3,0,0.5,0.1,0.7,0.3l7,7C19.9,9.5,20,9.7,20,10c0,0.3-0.1,0.5-0.3,0.7S19.3,11,19,11 c-0.3,0-0.5-0.1-0.7-0.3L13,5.4V21c0,0.3-0.1,0.5-0.3,0.7S12.3,22,12,22s-0.5-0.1-0.7-0.3S11,21.3,11,21V5.4l-5.3,5.3 C5.5,10.9,5.3,11,5,11c-0.3,0-0.5-0.1-0.7-0.3C4.1,10.5,4,10.3,4,10c0-0.3,0.1-0.5,0.3-0.7l7-7C11.5,2.1,11.7,2,12,2z"/> </svg> </div> <style type="text/css">.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .social-media-button-container{zoom:1;text-align:left}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .social-media-button-container:before{content:'';display:block}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .social-media-button-container:after{content:'';display:table;clear:both}@media (max-width:780px){.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .social-media-button-container{text-align:left}}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-facebook-0{border:1px solid;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);text-shadow:0 1px 0 rgba(0,0,0,.05);border-color:#273b65 #25375e #203053 #25375e;background:#3a5795;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#2c4270),color-stop(1,#3a5795));background:-ms-linear-gradient(bottom,#2c4270,#3a5795);background:-moz-linear-gradient(center bottom,#2c4270 0%,#3a5795 100%);background:-o-linear-gradient(#3a5795,#2c4270);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#3a5795', endColorstr='#2c4270', GradientType=0);color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-facebook-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-facebook-0.ow-button-hover:hover{background:#3d5b9c;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#2f4678),color-stop(1,#3d5b9c));background:-ms-linear-gradient(bottom,#2f4678,#3d5b9c);background:-moz-linear-gradient(center bottom,#2f4678 0%,#3d5b9c 100%);background:-o-linear-gradient(#3d5b9c,#2f4678);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#3d5b9c', endColorstr='#2f4678', GradientType=0);border-top:1px solid #2a3f6d;border-right:1px solid #273b65;border-bottom:1px solid #23355a;border-left:1px solid #273b65}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-facebook-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-facebook-0.ow-button-hover:hover{color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-x-twitter-0{border:1px solid;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);text-shadow:0 1px 0 rgba(0,0,0,.05);border-color:#3ca0eb #339bea #2594e8 #339bea;background:#78bdf1;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#4aa6ec),color-stop(1,#78bdf1));background:-ms-linear-gradient(bottom,#4aa6ec,#78bdf1);background:-moz-linear-gradient(center bottom,#4aa6ec 0%,#78bdf1 100%);background:-o-linear-gradient(#78bdf1,#4aa6ec);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#78bdf1', endColorstr='#4aa6ec', GradientType=0);color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-x-twitter-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-x-twitter-0.ow-button-hover:hover{background:#81c2f2;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#53abed),color-stop(1,#81c2f2));background:-ms-linear-gradient(bottom,#53abed,#81c2f2);background:-moz-linear-gradient(center bottom,#53abed 0%,#81c2f2 100%);background:-o-linear-gradient(#81c2f2,#53abed);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#81c2f2', endColorstr='#53abed', GradientType=0);border-top:1px solid #45a4ec;border-right:1px solid #3ca0eb;border-bottom:1px solid #2e99e9;border-left:1px solid #3ca0eb}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-x-twitter-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-x-twitter-0.ow-button-hover:hover{color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-github-0{border:1px solid;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);text-shadow:0 1px 0 rgba(0,0,0,.05);border-color:#050505 #000 #000 #000;background:#202021;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#070707),color-stop(1,#202021));background:-ms-linear-gradient(bottom,#070707,#202021);background:-moz-linear-gradient(center bottom,#070707 0%,#202021 100%);background:-o-linear-gradient(#202021,#070707);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#202021', endColorstr='#070707', GradientType=0);color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-github-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-github-0.ow-button-hover:hover{background:#252526;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#0c0c0c),color-stop(1,#252526));background:-ms-linear-gradient(bottom,#0c0c0c,#252526);background:-moz-linear-gradient(center bottom,#0c0c0c 0%,#252526 100%);background:-o-linear-gradient(#252526,#0c0c0c);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#252526', endColorstr='#0c0c0c', GradientType=0);border-top:1px solid #0a0a0a;border-right:1px solid #050505;border-bottom:1px solid #000;border-left:1px solid #050505}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-github-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-github-0.ow-button-hover:hover{color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-envelope-0{border:1px solid;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);text-shadow:0 1px 0 rgba(0,0,0,.05);border-color:#64a5d9 #5ca0d7 #4f99d4 #5ca0d7;background:#99c4e6;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#70acdc),color-stop(1,#99c4e6));background:-ms-linear-gradient(bottom,#70acdc,#99c4e6);background:-moz-linear-gradient(center bottom,#70acdc 0%,#99c4e6 100%);background:-o-linear-gradient(#99c4e6,#70acdc);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#99c4e6', endColorstr='#70acdc', GradientType=0);color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-envelope-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-envelope-0.ow-button-hover:hover{background:#a1c9e8;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#78b1de),color-stop(1,#a1c9e8));background:-ms-linear-gradient(bottom,#78b1de,#a1c9e8);background:-moz-linear-gradient(center bottom,#78b1de 0%,#a1c9e8 100%);background:-o-linear-gradient(#a1c9e8,#78b1de);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#a1c9e8', endColorstr='#78b1de', GradientType=0);border-top:1px solid #6caadb;border-right:1px solid #64a5d9;border-bottom:1px solid #579ed6;border-left:1px solid #64a5d9}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-envelope-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-envelope-0.ow-button-hover:hover{color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-youtube-0{border:1px solid;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);text-shadow:0 1px 0 rgba(0,0,0,.05);border-color:#97261c #8f241b #822118 #8f241b;background:#cf3427;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#a4291f),color-stop(1,#cf3427));background:-ms-linear-gradient(bottom,#a4291f,#cf3427);background:-moz-linear-gradient(center bottom,#a4291f 0%,#cf3427 100%);background:-o-linear-gradient(#cf3427,#a4291f);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#cf3427', endColorstr='#a4291f', GradientType=0);color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-youtube-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-youtube-0.ow-button-hover:hover{background:#d73729;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#ad2b21),color-stop(1,#d73729));background:-ms-linear-gradient(bottom,#ad2b21,#d73729);background:-moz-linear-gradient(center bottom,#ad2b21 0%,#d73729 100%);background:-o-linear-gradient(#d73729,#ad2b21);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#d73729', endColorstr='#ad2b21', GradientType=0);border-top:1px solid #a0281e;border-right:1px solid #97261c;border-bottom:1px solid #8a231a;border-left:1px solid #97261c}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-youtube-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-youtube-0.ow-button-hover:hover{color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-reddit-0{border:1px solid;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);box-shadow:inset 0 1px 0 rgba(255,255,255,.2) , 0 1px 2px rgba(0,0,0,.065);text-shadow:0 1px 0 rgba(0,0,0,.05);border-color:#97261c #8f241b #822118 #8f241b;background:#cf3427;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#a4291f),color-stop(1,#cf3427));background:-ms-linear-gradient(bottom,#a4291f,#cf3427);background:-moz-linear-gradient(center bottom,#a4291f 0%,#cf3427 100%);background:-o-linear-gradient(#cf3427,#a4291f);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#cf3427', endColorstr='#a4291f', GradientType=0);color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-reddit-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-reddit-0.ow-button-hover:hover{background:#d73729;background:-webkit-gradient(linear,left bottom,left top,color-stop(0,#ad2b21),color-stop(1,#d73729));background:-ms-linear-gradient(bottom,#ad2b21,#d73729);background:-moz-linear-gradient(center bottom,#ad2b21 0%,#d73729 100%);background:-o-linear-gradient(#d73729,#ad2b21);filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#d73729', endColorstr='#ad2b21', GradientType=0);border-top:1px solid #a0281e;border-right:1px solid #97261c;border-bottom:1px solid #8a231a;border-left:1px solid #97261c}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-reddit-0.ow-button-hover:focus,.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button-reddit-0.ow-button-hover:hover{color:#fff!important}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button{display:inline-block;font-size:1.66em;line-height:1em;margin:.1em .1em .1em 0;padding:.5em 0;width:2em;text-align:center;vertical-align:middle;-webkit-border-radius:.25em;-moz-border-radius:.25em;border-radius:.25em}.so-widget-sow-social-media-buttons-atom-db00a9d36054-4738 .sow-social-media-button .sow-icon-fontawesome{display:inline-block;height:1em}</style> <script type='text/javascript'>(function(){var c=document.body.className;c=c.replace(/woocommerce-no-js/,'woocommerce-js');document.body.className=c;})();</script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js?ver=3.0.9b" id="syntaxhighlighter-core-js"></script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushBash.js,qver=3.0.9b.pagespeed.jm.J116OdASQh.js" id="syntaxhighlighter-brush-bash-js"></script> <script type='text/javascript'>(function(){var corecss=document.createElement('link');var themecss=document.createElement('link');var corecssurl="https://www.buskill.in/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b";if(corecss.setAttribute){corecss.setAttribute("rel","stylesheet");corecss.setAttribute("type","text/css");corecss.setAttribute("href",corecssurl);}else{corecss.rel="stylesheet";corecss.href=corecssurl;}document.head.appendChild(corecss);var themecssurl="https://www.buskill.in/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?ver=3.0.9b";if(themecss.setAttribute){themecss.setAttribute("rel","stylesheet");themecss.setAttribute("type","text/css");themecss.setAttribute("href",themecssurl);}else{themecss.rel="stylesheet";themecss.href=themecssurl;}document.head.appendChild(themecss);})();SyntaxHighlighter.config.strings.expandSource='+ expand source';SyntaxHighlighter.config.strings.help='?';SyntaxHighlighter.config.strings.alert='SyntaxHighlighter\n\n';SyntaxHighlighter.config.strings.noBrush='Can\'t find brush for: ';SyntaxHighlighter.config.strings.brushNotHtmlScript='Brush wasn\'t configured for html-script option: ';SyntaxHighlighter.defaults['pad-line-numbers']=false;SyntaxHighlighter.defaults['tab-size']=2;SyntaxHighlighter.defaults['toolbar']=false;SyntaxHighlighter.all();if(typeof(jQuery)!=='undefined'){jQuery(function($){$(document.body).on('post-load',function(){SyntaxHighlighter.highlight();});});}</script> <link rel='stylesheet' id='wc-blocks-style-css' href='https://www.buskill.in/wp-content/plugins/A.woocommerce,,_assets,,_client,,_blocks,,_wc-blocks.css,,qver==wc-9.3.3+shariff,,_css,,_shariff.min.css,,qver==4.6.14+so-widgets-bundle,,_icons,,_fontawesome,,_style.css,,qver==6.6.2,Mcc.lWBDw-jMv6.css.pagespeed.cf.EOBkwIrhTB.css' type='text/css' media='all'/> <script type="text/javascript" id="siteorigin-corp-script-js-extra">//<![CDATA[ var siteoriginCorp={"collapse":"768","logoScale":"0.755","stickyOffset":"0"}; //]]></script> <script src="https://www.buskill.in/wp-content/themes,_siteorigin-corp-buskill,_js,_jquery.theme.min.js,qver==0.0.1+plugins,_so-widgets-bundle,_js,_lib,_jquery.fitvids.min.js,qver==1.1+themes,_siteorigin-corp,_js,_skip-link-focus-fix.min.js,qver==1.20.7.pagespeed.jc.LNC4WmT18m.js"></script><script>eval(mod_pagespeed_iEIQ2Sya3x);</script> <script>eval(mod_pagespeed_H5E8T2Gm8y);</script> <script>eval(mod_pagespeed_4l7HSo1z1X);</script> <script type="text/javascript" src="https://www.buskill.in/wp-includes/js/comment-reply.min.js,qver=6.6.2.pagespeed.jm.ZjGOfUn0Vj.js" id="comment-reply-js" async="async" data-wp-strategy="async"></script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/woocommerce/assets/js/sourcebuster/sourcebuster.min.js?ver=9.3.3" id="sourcebuster-js-js"></script> <script type="text/javascript" id="wc-order-attribution-js-extra">//<![CDATA[ var wc_order_attribution={"params":{"lifetime":1.0e-5,"session":30,"base64":false,"ajaxurl":"https:\/\/www.buskill.in\/wp-admin\/admin-ajax.php","prefix":"wc_order_attribution_","allowTracking":true},"fields":{"source_type":"current.typ","referrer":"current_add.rf","utm_campaign":"current.cmp","utm_source":"current.src","utm_medium":"current.mdm","utm_content":"current.cnt","utm_id":"current.id","utm_term":"current.trm","utm_source_platform":"current.plt","utm_creative_format":"current.fmt","utm_marketing_tactic":"current.tct","session_entry":"current_add.ep","session_start_time":"current_add.fd","session_pages":"session.pgs","session_count":"udata.vst","user_agent":"udata.uag"}}; //]]></script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/woocommerce/assets/js/frontend/order-attribution.min.js,qver=9.3.3.pagespeed.ce.nPcLfW8syQ.js" id="wc-order-attribution-js"></script> <script type="text/javascript" id="wc-cart-fragments-js-extra">//<![CDATA[ var wc_cart_fragments_params={"ajax_url":"\/wp-admin\/admin-ajax.php","wc_ajax_url":"\/?wc-ajax=%%endpoint%%","cart_hash_key":"wc_cart_hash_74df2f3f8877605987715d126990e2b1","fragment_name":"wc_fragments_74df2f3f8877605987715d126990e2b1","request_timeout":"5000"}; //]]></script> <script type="text/javascript" src="https://www.buskill.in/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js,qver=9.3.3.pagespeed.ce.rlKGfbACsv.js" id="wc-cart-fragments-js" defer="defer" data-wp-strategy="defer"></script> <script type="text/javascript" id="kill_it_dead-js-extra">//<![CDATA[ var spam_destroyer={"key":"spam-destroyer-8cf2c39c05277de2d4ffc5e58793f772","lifetime":"3600"}; //]]></script> <script type="text/javascript" id="kill_it_dead-js">//<![CDATA[ function sdCreateCookie(name){var unix=Math.round(+new Date()/1000);var expire=new Date();expire.setTime(expire.getTime()+(spam_destroyer.lifetime*1000));var expires="; expires="+expire.toUTCString();document.cookie=name+"="+unix+expires+"; path=/";}function sdReadCookie(name){var nameEQ=name+"=";var ca=document.cookie.split(';');for(var i=0;i<ca.length;i++){var c=ca[i];while(c.charAt(0)==' ')c=c.substring(1,c.length);if(c.indexOf(nameEQ)==0)return c.substring(nameEQ.length,c.length);}return null;}function sdCheckCookies(){var x=sdReadCookie(spam_destroyer.key) if(x){}else{sdCreateCookie(spam_destroyer.key);}}sdCheckCookies();try{document.getElementById('killer_value').value=spam_destroyer.key;}catch(e){} //]]></script> </body> </html>