How To Build A "Burner Device" For DEF CON In One Easy Step

TL;DR: Don't build a burner device. Probably this is not the risk you are looking for.

Introduction

Every year before DEF CON people starts to give advice to attendees to bring "burner devices" to DEF CON. Some people also start to create long lists on how to build burner devices, especially laptops. But the deeper we look into the topic, the more confusing it gets. Why are we doing this? Why are we recommending this? Are we focusing on the right things?

What is a "burner device" used for?

For starters, the whole "burner device" concept is totally misunderstood, even within the ITSEC community. A "burner device" is used for non-attribution. You know, for example, you are a spy and you don't want the country where you live to know that you are communicating with someone else. I believe this is not the situation for most attendees at DEF CON. More info about the meaning of "burner" https://twitter.com/Viss/status/877400669669306369

Burner phone means it has a throwaway SIM card with a throwaway phone, used for one specific operation only. You don't use the "burner device" to log in to your e-mail account or to VPN to your work or home.

But let's forget this word misuse issue for a moment, and focus on the real problem.

The bad advice

The Internet is full of articles focusing on the wrong things, especially when it comes to "burner devices". Like how to build a burner laptop, without explaining why you need it or how to use it.

The problem with this approach is that people end up "burning" (lame wordplay, sorry) significant resources for building a secure "burner device". But people are not educated about how they should use these devices.

The threats

I believe the followings are some real threats which are higher when you travel:

1. The laptop getting lost or stolen.

2. The laptop getting inspected/copied at the border.

These two risks have nothing to do with DEF CON, this is true for every travel.

Some other risks which are usually mentioned when it comes to "burner devices" and DEF CON:

3. Device getting owned via physical access while in a hotel room.

4. Network traffic Man-in-the-middle attacked. Your password displayed on a Wall of Sheep. Or having fun with Shellshock with DHCP. Information leak of NTLM hashes or similar.

5. Pwning the device via some nasty things like WiFi/TCP/Bluetooth/LTE/3G/GSM stack. These are unicorn attacks.

6. Pwning your device by pwning a service on your device. Like leaving your upload.php file in the root folder you use at CTFs and Nginx is set to autostart. The author of this article cannot comment on this incident whether it happened in real life or is just an imaginary example. 

How to mitigate these risks? 

Laptop getting stolen/lost/inspected at the border?

1. Bring a cheap, empty device with you. Or set up a fake OS/fake account to log in if you really need your day-to-day laptop. This dummy account should not decrypt the real files in the real account.

Device getting owned while in a hotel room with physical access

1. Don't bring any device with you.

2. If you bring any, make it tamper-resistant. How to do that depends on your enemy, but you can start by using nail glitter and Full Disk Encryption. Tools like Do Not Disturb help. It also helps if your OS supports suspending DMA devices before the user logs in.

3. If you can't make the device tamper-resistant, use a device that has a good defense against physical attackers, like iOS.

4. Probably you are not that important anyway that anyone will spend time and resources on you. If they do, probably you will only make your life miserable with all the hardening, but still, get pwned.

Network traffic Man-in-the-middle attacked

1. Don't bring any device with you.

2. Use services that are protected against MiTM. Like TLS.

3. Update your OS to the latest and greatest versions. Not everyone at DEF CON has a 0dayz worth of 100K USD, and even the ones who have won't waste it on you. 

4. Use fail-safe VPN. Unfortunately, not many people talk about this or have proper solutions for the most popular operating systems.

5. For specific attacks like Responder, disable LLMNR, NBT-NS, WPAD, and IPv6 and use a non-work account on the machine. If you don't have the privileges to do so on your machine, you probably should not bring this device with you. Or ask your local IT to disable these services and set up a new account for you.

Pwning the device via some nasty thing like WiFi/TCP/Bluetooth/LTE/3G/GSM stack

1. Don't bring any device with you.

2. If you bring any, do not use this device to log in to work, personal email, social media, etc.

3. Don't worry, these things don't happen very often. 

Pwning your device by pwning a service on your device

Just set up a firewall profile where all services are hidden from the outside. You rarely need any service accessible on your device at a hacker conference.

Conclusion

If you are still so afraid to go there, just don't go there. Watch the talks at home. But how is the hotel WiFi at a random place different from a hacker conference? Turns out, it is not much different, so you better spend time and resources on hardening your daily work devices for 365 days, instead of building a "burner device".

You probably need a "burner device" if you are a spy for a foreign government. Or you are the head of a criminal organization. Otherwise, you don't need a burner device. Maybe you need to bring a cheap replacement device.

More articles

1. Kik Hack Tools
2. Pentest Tools Tcp Port Scanner
3. Hack Tools Mac
4. Hacker Tools Github
5. How To Make Hacking Tools
6. Hacking Tools For Windows Free Download
7. Pentest Tools Nmap
8. Hacker Hardware Tools
9. Hackrf Tools
10. Hacker Tools Github
11. Physical Pentest Tools
12. Hacking Apps
13. Hacking Tools Software
14. Tools Used For Hacking
15. Hack Tools 2019
16. Tools 4 Hack
17. Hacker Tools Apk Download
18. New Hack Tools
19. Pentest Automation Tools
20. Hacking Tools For Games
21. Hacking Tools And Software
22. Hacking Tools For Mac
23. Pentest Tools Url Fuzzer
24. Hack Tools For Mac
25. Hacking Tools Name
26. Hacking Tools Software
27. Pentest Tools Online
28. Computer Hacker
29. Ethical Hacker Tools
30. Pentest Tools Website
31. Pentest Tools Framework
32. World No 1 Hacker Software
33. Nsa Hack Tools
34. Pentest Tools Online
35. Hackrf Tools
36. How To Make Hacking Tools
37. Hacker Tools
38. Bluetooth Hacking Tools Kali
39. Hack Tools Download
40. Pentest Tools Linux
41. Hackrf Tools
42. Hack Tool Apk
43. Termux Hacking Tools 2019
44. Hacker Tools Mac
45. Hack Apps
46. Pentest Tools Github
47. Physical Pentest Tools
48. Pentest Tools Website Vulnerability
49. Pentest Tools For Ubuntu
50. Hacking Apps
51. Hacker Tools Github
52. Hacking Tools 2019
53. Pentest Box Tools Download
54. Hacking Tools Pc
55. Hacking Tools Software
56. Hacking Tools For Pc
57. Hacker Tools 2020
58. Pentest Tools Windows
59. Nsa Hack Tools Download
60. Nsa Hacker Tools
61. Hack Tools Online
62. Hacker Tools Github
63. Hack Tools For Mac
64. Pentest Tools Download
65. Hack And Tools
66. Hacking Tools Pc
67. Physical Pentest Tools
68. Hack Tools For Ubuntu
69. Physical Pentest Tools
70. Hacking Tools Github
71. Pentest Tools Github
72. Hack Tools For Games
73. Install Pentest Tools Ubuntu
74. Pentest Tools Download
75. Hacker Security Tools
76. Hack Tool Apk No Root
77. Nsa Hack Tools Download
78. Pentest Tools Website
79. Hacking Tools For Beginners
80. Hacker Tools Mac
81. Hacker Tools Github
82. Usb Pentest Tools
83. Pentest Tools Github
84. Hacker Tools Github
85. Hack Tools For Windows
86. How To Make Hacking Tools
87. Tools For Hacker
88. Hacker Tools Apk Download
89. Hak5 Tools
90. Nsa Hack Tools Download
91. Hak5 Tools
92. Hack Tool Apk No Root
93. Hack Tools
94. Wifi Hacker Tools For Windows
95. Hack Apps
96. Hacking Tools For Mac
97. Hacker Tools Software
98. Hacking Tools Windows 10
99. Easy Hack Tools
100. World No 1 Hacker Software
101. Pentest Reporting Tools
102. Hak5 Tools
103. Pentest Tools Review
104. Pentest Tools Android
105. Pentest Tools Website Vulnerability
106. Usb Pentest Tools
107. Hacker Tools Software
108. Nsa Hack Tools
109. Hack Tools
110. Hack Tools For Mac
111. Hacker Security Tools
112. Pentest Tools Apk
113. Hacking Tools For Pc
114. Game Hacking
115. Pentest Tools Website
116. Hacking Tools And Software
117. Hack Tools Mac
118. Hacking Tools Software
119. Tools Used For Hacking
120. Hack Tools For Games
121. Hacking Tools 2019
122. Hacking Tools Hardware
123. Pentest Tools
124. Nsa Hacker Tools
125. New Hack Tools
126. What Is Hacking Tools
127. Pentest Tools Github
128. Hacker Tools Linux
129. Hacking Tools Windows
130. Hacker Tools
131. Hacker Tools For Mac
132. Pentest Tools Open Source
133. Hack Tools Pc
134. Pentest Reporting Tools
135. Hack Website Online Tool
136. Hacking Tools Download
137. Pentest Tools For Android
138. Hacker Tools Mac
139. Github Hacking Tools
140. Hack Tool Apk No Root
141. Hacker Tools Apk Download
142. Hacking Tools Usb
143. Hacker Tools
144. New Hack Tools
145. How To Install Pentest Tools In Ubuntu
146. Hacking Tools
147. Hack Tool Apk No Root
148. Blackhat Hacker Tools
149. Hack Tools
150. Nsa Hack Tools
151. Ethical Hacker Tools
152. Usb Pentest Tools
153. Hack Tools For Mac
154. What Are Hacking Tools
155. Growth Hacker Tools
156. Growth Hacker Tools
157. Wifi Hacker Tools For Windows
158. Pentest Recon Tools
159. Github Hacking Tools
160. Hack Tools For Games
161. Hack Tools Pc
162. Pentest Tools For Windows
163. Pentest Tools For Ubuntu
164. Hacker Tools Apk Download
165. Hacker Techniques Tools And Incident Handling
166. Hack Tools Online
167. Hack Tools 2019
168. Pentest Tools Open Source
169. What Are Hacking Tools