why stupid things like the usb-killer do exist?

[Nominal Animal]

like Xterminals made in the 90s.

Many of them ran only the X server on the terminal, and the applications themselves on bigger iron (i.e, as "thin clients").  The difference to what I am suggesting is that the machine runs everything locally, from a ramdisk.  But otherwise, yes: nothing new.  It's just that having big-mem embedded machines would make that so much better.  The CPUs are easily powerful enough already.

[ejeffrey]

They have a legitimate use which is basically destroying your kit and the TPM in and crypto keys irrecoverably and permanently. No amount of fancy shit down the lab can fix the damage it does. Think journalists, spies, activists, data exfiltration protection, hardware sanitisation etc.

Not in the slightest.  A device like this _might_ take out a TPM -- or any other particular chip in a system, but is certainly not guaranteed.  What chips are likely to be destroyed is going to heavily depend on the layout and design.  If you want to destroy a TPM, use a widlarizer.

Really all this is good for is testing if USB devices can withstand high voltage capacitive discharge.  But there are better and more reproducible ways to do that.  It is also a demonstration of a simple high voltage boost converter -- which doesn't have to be hooked up to a USB circuit to demonstrate its effectiveness.

[apis]

why? because the firewire tecnology directly exposes the ram via DMA. so, if someone put a FW-device on the chain, it can potentially write/read the ram, or just write junk to crash the system.

Yeah, I knew a paranoid guy who put hot melt glue in all his firewire ports.

[bd139]

He's not paranoid really.

When I worked in the defence sector the PCs were locked in cages with a hole big enough for a finger to turn them on and that was it.  At a large financial I was working for a few months back they epoxied all the holes solid. At the same time idiots wedged security doors open with plant pots so they didn't have to swipe in after they went for a slash.

On TPM disposal, I concede. I wouldn't do it that way either

[coppercone2]

is that heaven? tech support takes 4 hours to open the computer with a angle grinder when the mouse gets loose? welded shut I hope??
\
sounds a bit depressing, like your working out of a subway station designed to be vandal proof from the occasional evil hobo.. not a office

[bd139]

No just caged and locked with a padlock. Occasionally they actually lost the key for the specific box so had to get some bolt cutters out. 

Heaven was an incumbent rubbish IT team which I was part of. Didn’t take long to get to the top and out of the door to a better place to work.

[CJay]

I've worked in 'interesting' places before now, USB security is a done deal if you know what you're doing and invest the right money, it's possible to lock down a machine as soon as you plug in a different keyboard or any other non whitelisted device.

Makes it fun when 'Dave' plugs his phone in to charge.

Physical security is always worth having too, if for nothing else than to make it obvious that people shouldn't be messing about with the machines.

Concur on the 'wedged' doors, I've seen all sorts of methods and justifications for bypassing security, all of which would have caused havoc if they'd been spotted by someone in security

[ebastler]

moral of the story: close all the physical ports with mini-padlocks ( dunno if they actually exist, but if they exist, then they are the best invention ever, and I want twelve of them!)

Physical locks are indeed available, at least for USB ports:
https://www.kensington.com/p/products/security/usb-port-locks/usb-port-blocker/

[coppercone2]

that looks like it would get picked easily

[bd139]

Hammer and slot screwdriver.