How To Build A "Burner Device" For DEF CON In One Easy Step

TL;DR: Don't build a burner device. Probably this is not the risk you are looking for.

Introduction

Every year before DEF CON people starts to give advice to attendees to bring "burner devices" to DEF CON. Some people also start to create long lists on how to build burner devices, especially laptops. But the deeper we look into the topic, the more confusing it gets. Why are we doing this? Why are we recommending this? Are we focusing on the right things?

What is a "burner device" used for?

For starters, the whole "burner device" concept is totally misunderstood, even within the ITSEC community. A "burner device" is used for non-attribution. You know, for example, you are a spy and you don't want the country where you live to know that you are communicating with someone else. I believe this is not the situation for most attendees at DEF CON. More info about the meaning of "burner" https://twitter.com/Viss/status/877400669669306369

Burner phone means it has a throwaway SIM card with a throwaway phone, used for one specific operation only. You don't use the "burner device" to log in to your e-mail account or to VPN to your work or home.

But let's forget this word misuse issue for a moment, and focus on the real problem.

The bad advice

The Internet is full of articles focusing on the wrong things, especially when it comes to "burner devices". Like how to build a burner laptop, without explaining why you need it or how to use it.

The problem with this approach is that people end up "burning" (lame wordplay, sorry) significant resources for building a secure "burner device". But people are not educated about how they should use these devices.

The threats

I believe the followings are some real threats which are higher when you travel:

1. The laptop getting lost or stolen.

2. The laptop getting inspected/copied at the border.

These two risks have nothing to do with DEF CON, this is true for every travel.

Some other risks which are usually mentioned when it comes to "burner devices" and DEF CON:

3. Device getting owned via physical access while in a hotel room.

4. Network traffic Man-in-the-middle attacked. Your password displayed on a Wall of Sheep. Or having fun with Shellshock with DHCP. Information leak of NTLM hashes or similar.

5. Pwning the device via some nasty things like WiFi/TCP/Bluetooth/LTE/3G/GSM stack. These are unicorn attacks.

6. Pwning your device by pwning a service on your device. Like leaving your upload.php file in the root folder you use at CTFs and Nginx is set to autostart. The author of this article cannot comment on this incident whether it happened in real life or is just an imaginary example. 

How to mitigate these risks? 

Laptop getting stolen/lost/inspected at the border?

1. Bring a cheap, empty device with you. Or set up a fake OS/fake account to log in if you really need your day-to-day laptop. This dummy account should not decrypt the real files in the real account.

Device getting owned while in a hotel room with physical access

1. Don't bring any device with you.

2. If you bring any, make it tamper-resistant. How to do that depends on your enemy, but you can start by using nail glitter and Full Disk Encryption. Tools like Do Not Disturb help. It also helps if your OS supports suspending DMA devices before the user logs in.

3. If you can't make the device tamper-resistant, use a device that has a good defense against physical attackers, like iOS.

4. Probably you are not that important anyway that anyone will spend time and resources on you. If they do, probably you will only make your life miserable with all the hardening, but still, get pwned.

Network traffic Man-in-the-middle attacked

1. Don't bring any device with you.

2. Use services that are protected against MiTM. Like TLS.

3. Update your OS to the latest and greatest versions. Not everyone at DEF CON has a 0dayz worth of 100K USD, and even the ones who have won't waste it on you. 

4. Use fail-safe VPN. Unfortunately, not many people talk about this or have proper solutions for the most popular operating systems.

5. For specific attacks like Responder, disable LLMNR, NBT-NS, WPAD, and IPv6 and use a non-work account on the machine. If you don't have the privileges to do so on your machine, you probably should not bring this device with you. Or ask your local IT to disable these services and set up a new account for you.

Pwning the device via some nasty thing like WiFi/TCP/Bluetooth/LTE/3G/GSM stack

1. Don't bring any device with you.

2. If you bring any, do not use this device to log in to work, personal email, social media, etc.

3. Don't worry, these things don't happen very often. 

Pwning your device by pwning a service on your device

Just set up a firewall profile where all services are hidden from the outside. You rarely need any service accessible on your device at a hacker conference.

Conclusion

If you are still so afraid to go there, just don't go there. Watch the talks at home. But how is the hotel WiFi at a random place different from a hacker conference? Turns out, it is not much different, so you better spend time and resources on hardening your daily work devices for 365 days, instead of building a "burner device".

You probably need a "burner device" if you are a spy for a foreign government. Or you are the head of a criminal organization. Otherwise, you don't need a burner device. Maybe you need to bring a cheap replacement device.

Related articles

1. What Is Hacking Tools
2. Hack Apps
3. Hacker Tools Hardware
4. Hacking Tools For Kali Linux
5. Hacker Techniques Tools And Incident Handling
6. Hack Tool Apk No Root
7. Pentest Tools Framework
8. New Hack Tools
9. Hacking Tools Online
10. Hacking Tools For Windows
11. Hacking Tools For Games
12. Pentest Tools Find Subdomains
13. Pentest Tools Url Fuzzer
14. Hacker Tools For Mac
15. Black Hat Hacker Tools
16. Pentest Tools Url Fuzzer
17. Game Hacking
18. Hacker Hardware Tools
19. Kik Hack Tools
20. Hacking Tools And Software
21. Pentest Tools Url Fuzzer
22. Hacker Tools For Pc
23. Hacker Tool Kit
24. Hacker Tools 2020
25. Hacker Tools Software
26. Hacking Tools For Windows 7
27. Hackrf Tools
28. Hacker Tools Apk Download
29. Top Pentest Tools
30. Computer Hacker
31. Pentest Tools Kali Linux
32. How To Make Hacking Tools
33. Hacker Tools Online
34. Beginner Hacker Tools
35. Black Hat Hacker Tools
36. Growth Hacker Tools
37. Hackrf Tools
38. Pentest Tools Review
39. Hacking Apps
40. Hacking Tools For Beginners
41. Computer Hacker
42. Hack And Tools
43. Hacking Tools Online
44. Hack Rom Tools
45. Hacker Tools Github
46. Hacking Apps
47. Hackers Toolbox
48. Pentest Tools Review
49. Pentest Tools Apk
50. Hacker Tool Kit
51. Nsa Hack Tools
52. Pentest Box Tools Download
53. Beginner Hacker Tools
54. Hacker Tool Kit
55. What Are Hacking Tools
56. Hack Rom Tools
57. Best Hacking Tools 2020
58. Hacking Tools Software
59. Physical Pentest Tools
60. What Are Hacking Tools
61. Android Hack Tools Github
62. Hacker Tools Apk
63. Hackers Toolbox
64. Hack Tools For Ubuntu
65. Hacker Tools List
66. Hacking Tools Windows 10
67. Computer Hacker
68. New Hacker Tools
69. Hacker Techniques Tools And Incident Handling
70. Hacker Tools List
71. Wifi Hacker Tools For Windows
72. Hack Tool Apk No Root
73. Tools Used For Hacking
74. Hacking Tools 2020
75. Best Hacking Tools 2020
76. Kik Hack Tools
77. Hack Tool Apk No Root
78. Pentest Tools Apk
79. Hacker Tools List
80. Hacking Tools 2019
81. Hacker Tools Online
82. Hacker Tools
83. Hacker Tools For Mac
84. Pentest Tools
85. Pentest Tools For Windows
86. Hacking Tools Windows
87. Pentest Tools Android
88. Tools 4 Hack
89. Pentest Automation Tools
90. Hack Rom Tools
91. Wifi Hacker Tools For Windows
92. Hacking Tools
93. What Are Hacking Tools
94. Hacker Tools For Pc
95. Hacking Tools Free Download
96. Hack Tools 2019
97. Pentest Tools Kali Linux
98. Hacker Tools For Mac
99. Hacker Tools Hardware
100. Pentest Tools Review
101. Pentest Tools Website
102. Nsa Hack Tools Download
103. Hacking Tools Usb
104. Growth Hacker Tools
105. How To Hack
106. Pentest Tools Kali Linux
107. Hacking App
108. New Hacker Tools
109. Hacker Tools Software
110. Pentest Tools Review
111. Hack Tools
112. Kik Hack Tools
113. Growth Hacker Tools
114. Pentest Tools Alternative
115. Hack Tools For Pc
116. Beginner Hacker Tools
117. Pentest Tools Linux
118. Hacking Tools Software
119. Hacking Tools Kit
120. Hack Tools Github
121. Hacker Tools Linux
122. Hacking Tools Windows 10
123. Hacking Tools For Mac
124. Hacking Tools 2020
125. Physical Pentest Tools
126. Pentest Tools Online
127. Hack Tools For Mac
128. Github Hacking Tools
129. Hacker Tools Free Download
130. Hacks And Tools
131. Hacking Tools Software
132. Hack Tools For Mac
133. Pentest Automation Tools
134. Hacking Tools Mac