How To Build A "Burner Device" For DEF CON In One Easy Step

TL;DR: Don't build a burner device. Probably this is not the risk you are looking for.

Introduction

Every year before DEF CON people starts to give advice to attendees to bring "burner devices" to DEF CON. Some people also start to create long lists on how to build burner devices, especially laptops. But the deeper we look into the topic, the more confusing it gets. Why are we doing this? Why are we recommending this? Are we focusing on the right things?

What is a "burner device" used for?

For starters, the whole "burner device" concept is totally misunderstood, even within the ITSEC community. A "burner device" is used for non-attribution. You know, for example, you are a spy and you don't want the country where you live to know that you are communicating with someone else. I believe this is not the situation for most attendees at DEF CON. More info about the meaning of "burner" https://twitter.com/Viss/status/877400669669306369

Burner phone means it has a throwaway SIM card with a throwaway phone, used for one specific operation only. You don't use the "burner device" to log in to your e-mail account or to VPN to your work or home.

But let's forget this word misuse issue for a moment, and focus on the real problem.

The bad advice

The Internet is full of articles focusing on the wrong things, especially when it comes to "burner devices". Like how to build a burner laptop, without explaining why you need it or how to use it.

The problem with this approach is that people end up "burning" (lame wordplay, sorry) significant resources for building a secure "burner device". But people are not educated about how they should use these devices.

The threats

I believe the followings are some real threats which are higher when you travel:

1. The laptop getting lost or stolen.

2. The laptop getting inspected/copied at the border.

These two risks have nothing to do with DEF CON, this is true for every travel.

Some other risks which are usually mentioned when it comes to "burner devices" and DEF CON:

3. Device getting owned via physical access while in a hotel room.

4. Network traffic Man-in-the-middle attacked. Your password displayed on a Wall of Sheep. Or having fun with Shellshock with DHCP. Information leak of NTLM hashes or similar.

5. Pwning the device via some nasty things like WiFi/TCP/Bluetooth/LTE/3G/GSM stack. These are unicorn attacks.

6. Pwning your device by pwning a service on your device. Like leaving your upload.php file in the root folder you use at CTFs and Nginx is set to autostart. The author of this article cannot comment on this incident whether it happened in real life or is just an imaginary example. 

How to mitigate these risks? 

Laptop getting stolen/lost/inspected at the border?

1. Bring a cheap, empty device with you. Or set up a fake OS/fake account to log in if you really need your day-to-day laptop. This dummy account should not decrypt the real files in the real account.

Device getting owned while in a hotel room with physical access

1. Don't bring any device with you.

2. If you bring any, make it tamper-resistant. How to do that depends on your enemy, but you can start by using nail glitter and Full Disk Encryption. Tools like Do Not Disturb help. It also helps if your OS supports suspending DMA devices before the user logs in.

3. If you can't make the device tamper-resistant, use a device that has a good defense against physical attackers, like iOS.

4. Probably you are not that important anyway that anyone will spend time and resources on you. If they do, probably you will only make your life miserable with all the hardening, but still, get pwned.

Network traffic Man-in-the-middle attacked

1. Don't bring any device with you.

2. Use services that are protected against MiTM. Like TLS.

3. Update your OS to the latest and greatest versions. Not everyone at DEF CON has a 0dayz worth of 100K USD, and even the ones who have won't waste it on you. 

4. Use fail-safe VPN. Unfortunately, not many people talk about this or have proper solutions for the most popular operating systems.

5. For specific attacks like Responder, disable LLMNR, NBT-NS, WPAD, and IPv6 and use a non-work account on the machine. If you don't have the privileges to do so on your machine, you probably should not bring this device with you. Or ask your local IT to disable these services and set up a new account for you.

Pwning the device via some nasty thing like WiFi/TCP/Bluetooth/LTE/3G/GSM stack

1. Don't bring any device with you.

2. If you bring any, do not use this device to log in to work, personal email, social media, etc.

3. Don't worry, these things don't happen very often. 

Pwning your device by pwning a service on your device

Just set up a firewall profile where all services are hidden from the outside. You rarely need any service accessible on your device at a hacker conference.

Conclusion

If you are still so afraid to go there, just don't go there. Watch the talks at home. But how is the hotel WiFi at a random place different from a hacker conference? Turns out, it is not much different, so you better spend time and resources on hardening your daily work devices for 365 days, instead of building a "burner device".

You probably need a "burner device" if you are a spy for a foreign government. Or you are the head of a criminal organization. Otherwise, you don't need a burner device. Maybe you need to bring a cheap replacement device.

More information

1. Game Hacking
2. Pentest Tools Windows
3. Physical Pentest Tools
4. Hacking Tools Kit
5. Pentest Tools Download
6. Hacker Tools Software
7. Pentest Tools
8. Hacking Tools Download
9. Hacking Tools 2019
10. Hacks And Tools
11. Pentest Tools Android
12. What Is Hacking Tools
13. Hacking Tools Hardware
14. Install Pentest Tools Ubuntu
15. Hacker Search Tools
16. Hack Tools Online
17. Hacking Tools Kit
18. Github Hacking Tools
19. What Is Hacking Tools
20. Kik Hack Tools
21. Pentest Recon Tools
22. Hack Tools Pc
23. Physical Pentest Tools
24. Hacking Tools Usb
25. Hack Tool Apk
26. Hacking Tools And Software
27. Best Hacking Tools 2019
28. Easy Hack Tools
29. Hacker Search Tools
30. Ethical Hacker Tools
31. Best Pentesting Tools 2018
32. Hacking Tools For Windows
33. Pentest Tools For Windows
34. Best Hacking Tools 2020
35. Hacker Tools 2020
36. Hacking Tools Online
37. Hacker
38. Pentest Tools Apk
39. Pentest Tools List
40. Pentest Recon Tools
41. Hacking Tools And Software
42. Game Hacking
43. Hacking Tools Usb
44. Hacking Tools For Kali Linux
45. Nsa Hacker Tools
46. Nsa Hack Tools
47. Pentest Tools Website
48. Nsa Hack Tools Download
49. Pentest Tools Website Vulnerability
50. Install Pentest Tools Ubuntu
51. Physical Pentest Tools
52. Hacker Tools Linux
53. Pentest Tools Linux
54. Hacking Tools For Games
55. Pentest Tools Kali Linux
56. Hacker Search Tools
57. Hack Tools 2019
58. World No 1 Hacker Software
59. Hack Tools For Pc
60. Hacks And Tools
61. Pentest Tools Download
62. Pentest Tools Framework
63. Hacker Tools Apk Download
64. Hackers Toolbox
65. Pentest Tools Free
66. What Is Hacking Tools
67. Hack Tools
68. Nsa Hack Tools Download
69. New Hacker Tools
70. Hacking Tools For Windows
71. Hackers Toolbox
72. Hacker Tools Windows
73. Hacker Hardware Tools
74. Pentest Box Tools Download
75. Pentest Tools Nmap
76. Best Pentesting Tools 2018
77. Pentest Tools Website Vulnerability
78. Pentest Tools Subdomain
79. World No 1 Hacker Software
80. Pentest Tools Windows
81. Pentest Tools Review
82. Pentest Tools Review
83. Pentest Tools Download
84. New Hacker Tools
85. Hack And Tools
86. Hacker Hardware Tools
87. Hack Tools
88. Pentest Tools Subdomain
89. How To Install Pentest Tools In Ubuntu
90. Hacker Tools
91. Hacker Tools Apk
92. Hacking Tools For Beginners
93. Hack Tools 2019
94. Hacker Tools Apk Download
95. Hacking Tools Pc
96. Usb Pentest Tools
97. Pentest Recon Tools
98. Hacking Tools Windows
99. New Hack Tools
100. Nsa Hacker Tools
101. Nsa Hack Tools Download
102. Bluetooth Hacking Tools Kali
103. Hacking Tools Pc
104. Tools Used For Hacking
105. Hacking Tools Windows 10
106. Hacker Tools 2020
107. How To Hack
108. Hacker Tools 2020
109. Hacker Tools Free Download
110. Hacks And Tools
111. Github Hacking Tools
112. Hackers Toolbox
113. Beginner Hacker Tools
114. Hacker Tools 2020
115. Pentest Tools Port Scanner
116. Hack App
117. Pentest Tools Website
118. Hacking Tools For Windows
119. Hacker Tools Linux
120. Hack Tools Mac
121. Hacks And Tools
122. How To Hack
123. Pentest Tools For Android
124. Hacker Tool Kit
125. What Are Hacking Tools
126. Pentest Tools Open Source
127. Beginner Hacker Tools
128. Hack Tool Apk No Root
129. Tools For Hacker
130. Tools Used For Hacking
131. Pentest Tools For Mac
132. Pentest Reporting Tools
133. Tools Used For Hacking
134. New Hacker Tools
135. Easy Hack Tools
136. Hacker
137. Pentest Tools For Mac
138. Pentest Tools Free
139. Hacker Tools For Pc
140. Computer Hacker