BusKill
BusKill is an open-source hardware and software project developed as a laptop kill cord, serving as a dead man's switch that triggers user-configurable security actions—such as locking the screen, shutting down the system, or wiping encrypted data—when a connected USB cable with a magnetic breakaway is physically disconnected from the user.[1] The device consists of a custom USB cable featuring strong N52 neodymium magnets for the breakaway mechanism, paired with a companion application that detects the disconnection and executes the predefined trigger.[1] Created by Alt Shift, a company based in Tallinn, Estonia, BusKill was launched via a successful crowdfunding campaign on Crowd Supply, raising over $18,000 and becoming available for purchase in late 2021.[1] It supports major operating systems including Linux, Windows 10, and macOS, with advanced features on Linux such as shredding LUKS encryption headers for data self-destruction.[1] Designed primarily for high-risk users like journalists, cryptocurrency traders, and travelers, the project emphasizes simplicity by avoiding wireless connections like Bluetooth, relying instead on a direct USB link for reliable detection.[2] All code and documentation are released under open licenses—GPLv3 for software and CC-BY-SA for content—fostering community contributions via GitHub.[2] Since its debut, BusKill has garnered media attention for enhancing physical security in an era of rising device thefts, with ongoing updates expanding trigger options like system shutdowns.[3]History
Origins and Invention
BusKill was invented by Michael Altfield in 2017 as a physical security device to mitigate the risks of laptop theft, particularly for devices handling sensitive data in high-risk environments.[4] The concept emerged from Altfield's personal experiences in activism and open-source communities, where maintaining data confidentiality during physical interactions—such as attending conferences or working in public spaces—was a pressing concern.[4] This motivation addressed scenarios where a user might authenticate to secure services like VPNs or encrypted drives, only to face theft if momentarily distracted, potentially compromising confidential information.[5] The first prototype, developed that same year, relied on basic USB disconnection detection to trigger protective actions on the laptop, such as locking the screen or initiating a shutdown, without any initial commercial intent.[4] Constructed using off-the-shelf components like a USB drive attached to a retractable lanyard with a magnetic breakaway connector, the device simulated a USB removal event when physically separated from the user, leveraging simple system rules to detect and respond to the disconnection.[5] This early iteration focused on proof-of-concept functionality rather than polished hardware, emphasizing accessibility for users in open-source ecosystems. The project embraced open-source principles starting from its public release in 2020 through dual licensing: the hardware designs under the Creative Commons Attribution-ShareAlike (CC BY-SA) license to encourage community modifications and sharing, and the accompanying software under the GNU General Public License version 3 (GPLv3) to ensure free redistribution and collaborative development.[4] This licensing approach aligned with Altfield's background in open-source advocacy, fostering transparency and preventing proprietary lock-in while laying the groundwork for future expansions.[4]Development Milestones
The term "BusKill" was coined in January 2020 by software engineer Michael Altfield, who published a detailed guide describing the concept of a USB-based dead man's switch for laptops, accompanied by the initial release of a Linux application using udev rules to detect cable disconnection and trigger a screen lock.[5] A Windows port followed in early 2020, adapting the detection mechanism to use Windows Management Instrumentation (WMI) event monitoring for USB removal events. In May 2020, Steven Johnson contributed the first macOS version, implementing cable disconnection detection via IOKit and system notifications to enable cross-operating system compatibility.[6] The project advanced with the release of cross-platform application version 0.1.0 in August 2020, a Kivy-based rewrite that unified the graphical user interface (GUI) and command-line interface (CLI) across Linux, Windows, and macOS, while hardware prototyping efforts paralleled these software developments to test real-world USB event triggering.[7] Version 0.6.0 arrived in October 2022, introducing a "soft-shutdown" trigger option that allows users to configure graceful system shutdowns instead of immediate locks upon cable severance, alongside various bug fixes for improved stability.[8] On June 17, 2023, version 0.7.0 was released, featuring GUI enhancements such as a dedicated settings screen, support for soft-shutdown in the graphical interface, and multiple bug fixes including resolutions for lockscreen triggers on specific distributions like Linux Mint Cinnamon.[6] Throughout 2024, the project saw updates focused on dependency optimizations to reduce bundle sizes, image enhancements for better visual consistency, and integration into the Ubuntu Jammy Jellyfish repository as an official package, broadening accessibility for Debian-based users.[9] The BusKill team announced participation in DEF CON 32 on July 16, 2024, with a presentation on open hardware design for the BusKill cord held on August 10, 2024, during the conference (August 8–11).[10] In 2025, the project was awarded a $1,031 microgrant from FUTO in October to fund enhancements like volunteer-driven improvements to documentation and hardware accessibility.[11] In September 2025, the team released unboxing and demonstration videos showcasing the BusKill Kit.[12][13] A planned version 0.8.0, aimed at further polishing the application with minor UI refinements and expanded trigger configurations, was announced in January 2025.[9] The team maintains transparency through ongoing warrant canary publications, with the latest, number 10, issued in June 2025, cryptographically signed to affirm no undisclosed legal pressures or system compromises.[14]Hardware
Design and Components
The BusKill hardware is designed as a physical tethering device resembling a modified USB cable, intended to secure a laptop to the user via a carabiner clip attached to clothing or a belt loop. The core assembly consists of a standard USB extension cable interrupted by a magnetic breakaway coupler, with one end connecting to a USB flash drive that plugs into the laptop's USB port. This setup allows the device to function as a dead man's switch: when the user moves beyond the cable's length, the magnetic connection separates, interrupting the USB link.[5][15] Key components include a low-profile USB flash drive (typically USB-A, such as the SanDisk Ultra Fit, for reliable detection), a 1-meter USB extension cable (USB-A male-to-female), and a magnetic breakaway adapter. The breakaway coupler employs neodymium magnets (often N42 or N52 cube magnets) to hold two halves together, with spring-loaded pogo pins ensuring electrical continuity for USB data and power lines (D+, D-, VCC, GND) until separation. In open hardware variants, these elements are housed in 3D-printable enclosures designed using tools like OpenSCAD or FreeCAD, enabling custom fabrication.[5][16][17] The disconnection mechanism relies on the physical force overcoming the magnets' attraction (typically 1-2 kg pull force in prototypes), which separates the pogo pins and simulates a USB device removal event detectable by the host operating system. No additional active electronics are required in the basic design, as the flash drive remains passive until triggered, preserving standard USB 2.0 compatibility across laptops with USB-A or USB-C ports (via adapters for the latter). USB-C variants substitute compatible cables and drives while maintaining the breakaway principle.[18][17][1] The device draws minimal power, with the idle USB flash drive consuming under 100 mA from the host port, ensuring negligible impact on battery life during normal use. It operates with standard USB ports on Linux, Windows, and macOS systems without requiring specialized hardware drivers. Open-source schematics and CAD files for the magnetic breakaway and enclosures have been available on GitHub since 2020, facilitating DIY construction and community modifications.[5][16][17]Variants and Accessories
The commercial BusKill Kit, launched via crowdfunding in late 2021 and with shipping beginning in October 2022 through the official BusKill website and resellers like Crowd Supply and Mouser Electronics, provides a pre-assembled solution consisting of a magnetic-breakaway USB Type-A cable, a carabiner clip for tethering, and a USB flash drive preloaded with the BusKill software installer and documentation.[19][4][1] For users preferring a DIY approach, the standalone BusKill Cable—also introduced in 2022—offers a USB Type-A extension with an integrated magnetic breakaway mechanism, allowing integration with personal USB storage devices and tethers without the full kit.[20] A 3D-printable variant has been in development since early 2023, featuring printable enclosures for the magnetic breakaway components and pogo pin assemblies to enable custom USB kill cords; proof-of-concept designs, including OpenSCAD files and STL models, were released on GitHub by August 2023, with demonstrations of functionality shown in May 2024. As of 2025, ongoing hardware development, including open hardware designs, is supported by a FUTO microgrant awarded in February 2025.[21][22][11] Connector adaptations support USB-C devices through compatible components in the bill of materials, such as USB-C extension cables and breakaways, or hybrid setups using USB-A cables paired with USB-C to USB-A hubs for non-standard ports.[23] Accessories include the included carabiner for physical tethering, with replacement options available via general hardware suppliers, and the magnetic breakaway itself serving as a core coupler; custom magnetic releases can be 3D-printed using the released prototypes.[19][21] For advanced setups, BusKill integrates with external USB hubs to extend connectivity and is compatible with single-board computers like Raspberry Pi, where the device can be connected via USB for trigger testing in embedded environments.[23]Software
Architecture and Features
The BusKill software is implemented as a Python-based application that provides both command-line interface (CLI) and graphical user interface (GUI) options, with the GUI built using the PyQt framework for cross-platform compatibility. This architecture enables users to interact with the system through terminal commands for scripting and automation or via an intuitive graphical interface for manual configuration. The core logic revolves around continuous monitoring of USB device connections, leveraging platform-specific APIs to detect events related to the BusKill hardware cable.[24] At its heart, the software operates in arm and disarm modes, allowing users to activate or deactivate the kill cord functionality as needed. When armed, it supports customizable triggers that respond to cable disconnection, such as locking the screen, initiating a shutdown, or wiping encryption headers (e.g., for LUKS on Linux systems). These triggers are configurable to suit different security needs, emphasizing rapid response to physical separation of the device from the user. The detection mechanism polls for the unique BusKill device ID at regular intervals and initiates the selected trigger upon disconnection, with a user-defined delay ranging from 0 to 30 seconds to prevent accidental activations.[24][25] For USB event monitoring, the application employs udev rules on Linux to handle device insertion and removal notifications, IOKit on macOS for kernel-level USB interactions, and WMI (Windows Management Instrumentation) on Windows to query and respond to hardware changes. This modular approach ensures reliable detection across operating systems without relying on a single method. Security is enhanced through password protection for application settings, preventing unauthorized modifications, and seamless integration with full-disk encryption tools like LUKS to enable destructive actions such as header erasure in high-risk scenarios, with planned support for similar actions on other platforms like FileVault in future updates.[24] Event logging is a key component, capturing details of arming/disarming actions, trigger activations, and disconnections in local files without any network transmission to maintain privacy and avoid external dependencies. Logs are stored in a structured format for review, aiding in troubleshooting and auditing without compromising system performance. This logging mechanism underscores the software's focus on offline operation and user control.[24]Platform Compatibility
BusKill's software application is designed for cross-platform use, primarily supporting desktop operating systems to enable its USB-based dead man's switch functionality on laptops and similar devices.[24][1][26] Linux provides full support for BusKill since its initial release in early 2020, leveraging system services for reliable USB device monitoring and response triggering. The application integrates with systemd for service management and udisks for handling USB events, ensuring seamless operation on distributions like Ubuntu. An official Ubuntu package became available starting with Ubuntu 24.04 LTS in 2024, simplifying installation via the package manager.[27][24][9] On macOS, support has been available since 2020, utilizing launchd to monitor USB connections and execute configured actions upon disconnection. The application runs on both Intel-based and Apple Silicon Macs, with compatibility on the latter achieved through Rosetta 2 for x86 emulation where native ARM builds are not yet fully implemented.[24][1] Windows compatibility was established early in 2020, with the BusKill app using the Windows Event Log to detect USB device changes and initiate triggers. Installation and operation typically require administrator privileges to access necessary system-level USB monitoring and execution capabilities.[27][24] While BusKill excels on major desktop platforms, it lacks native support for mobile operating systems such as Android or iOS, limiting its use to tethered laptop scenarios. Users may encounter challenges in virtual machine environments or with USB passthrough configurations, where host-guest USB handling can interfere with reliable detection and response.[1][26] Cross-platform enhancements include version 0.7.0 released in July 2023, which introduced unified build processes to streamline development and deployment across Linux, macOS, and Windows. Future updates, such as version 0.8.0 planned for 2025, aim to enhance Windows stability and introduce broader ARM architecture support.[28]Usage
Installation and Setup
The installation and setup of BusKill involves both hardware attachment and software deployment to enable the device's kill cord functionality. The process is designed to be straightforward, supporting Windows, macOS, and Linux operating systems, with the hardware consisting of a USB cable featuring a magnetic breakaway connector and a carabiner clip.[29]Hardware Setup
To begin, assemble the BusKill cable if not pre-assembled by connecting the carabiner to the USB drive and then plugging the USB drive into the cable's USB-A connector. Attach the carabiner end of the cable to a secure point on the user, such as a belt loop, to ensure it tethers the laptop to the body. Next, insert the magnetic breakaway end of the cable into an available USB port on the laptop; the device appears as a standard USB storage drive and requires no additional drivers for basic recognition. To test the disconnection, gently pull the magnetic breakaway apart while the software is armed (detailed below), which should trigger the configured action, such as screen locking, confirming proper physical setup.[30][31]Software Download and Installation
The BusKill app is a portable, self-contained application distributed via GitHub releases or an included USB drive with the hardware purchase. For downloads, visit the official GitHub repository at https://github.com/BusKill/buskill-app, navigate to the latest release, and select the archive matching your OS and architecture (e.g., buskill-windows-x86_64.zip for Windows). Download the accompanying SHA256SUM and SHA256SUM.asc files to verify integrity: compute the SHA256 checksum of the archive and compare it against the provided sums, then use GnuPG to check the PGP signature with the commandgpg --verify SHA256SUM.asc SHA256SUM after importing the BusKill public key. This verification ensures the files have not been tampered with. If using the included USB drive, the app files are pre-loaded and similarly verifiable.[32][24]
Installation varies by platform but requires no traditional setup wizard or system-wide installer:
- Windows: Extract the ZIP archive to a folder (e.g., Desktop), then double-click buskill.exe to launch; antivirus software may prompt for allowance, which should be granted for USB monitoring.
- macOS: Extract the tarball or DMG file, drag the app to the Applications folder if desired, and launch it; due to lack of Apple notarization, approve execution in System Settings > Privacy & Security by clicking "Open Anyway" after the initial block warning.
- Linux: Extract the tarball, make the AppImage executable with
chmod +x buskill*.AppImage, then double-click or run./buskill*.AppImage; grant USB access permissions via udev rules if needed for event detection (e.g., add a rule in /etc/udev/rules.d/ to monitor the specific BusKill vendor/product ID for non-root access).[33][30][33]
Initial Configuration and Testing
Upon first launch, the app opens in a disarmed state, displaying a simple GUI with an "Arm" button; no pairing wizard or admin password is required, as the device is detected automatically via USB insertion. Click "Arm" to enable monitoring, selecting a basic trigger like screen lock from the default options. The app pairs the device implicitly by recognizing the USB connection—no manual pairing steps are needed. To complete setup, test by disconnecting the cable while armed, verifying the trigger activates (e.g., screen locks immediately). For security, ensure the laptop's USB ports function normally by checking Device Manager (Windows) or System Information (macOS/Linux) for recognition.[25][30][31]Troubleshooting Basics
Common issues include USB port non-recognition, often resolved by trying a different port or restarting the computer; on Linux, verify udev rules are correctly set using the VID:PID of your specific BusKill USB device (obtainable vialsusb on Linux while connected) to avoid permission errors during USB event polling—for DIY variants using Adafruit Neo Trinkey, the VID:PID is 239a:80f0.[19][34] If the app fails to launch, confirm execution permissions and checksum verification; for macOS blocks, follow the security approval prompt. Driver needs are minimal, as BusKill emulates a standard HID or mass storage device, but update USB controllers via OS updates if detection fails. Consult the official documentation for OS-specific logs if disconnection events do not register.[33][35][36]
Configuration and Triggers
BusKill's configuration allows users to customize the response to a trigger event, which occurs immediately upon detection of the USB cable's disconnection via the magnetic breakaway mechanism.[36] The primary trigger options include non-destructive actions such as screen locking or soft shutdown, as well as more aggressive measures like hibernation or initiating an encryption wipe through custom scripts.[37] For instance, shredding the LUKS header can render full disk encryption inaccessible, effectively wiping access to data without physical destruction.[38] The configuration interface is accessible through the BusKill graphical user interface (GUI), where users navigate to the app menu under Settings > Trigger to select the desired action.[37] While delay timers and action priorities are not natively configurable in the standard GUI, users can implement exclusions by specifying the BusKill device's unique identifier (e.g., via udev rules on Linux) to ignore other USB devices and prevent false positives.[38] The GUI also supports arming and disarming the device with simple button clicks, ensuring quick toggling for security scenarios.[25] For advanced setups, BusKill integrates with user-defined scripts to execute custom commands upon triggering, such as unmounting encrypted volumes or running a self-destruct sequence.[36] An example is thebuskill-selfdestruct.sh script, which shreds the LUKS header and initiates shutdown in approximately 5 seconds when invoked by a udev rule on USB removal. In Qubes OS environments, users can configure keyboard shortcuts, such as Ctrl+Shift+D, to temporarily disarm the trigger for 30 seconds, swapping to a safer action like screen locking during brief interruptions.[39]
A testing mode enables simulation of triggers without full execution to verify configurations safely. On Windows, this involves creating a 10 MB virtual hard drive (VHD) that mimics USB hotplug events—attaching initializes it, and ejecting simulates disconnection to test the trigger response.[40] On macOS, the --run-trigger command-line argument directly invokes the configured action for verification.[40] Linux testing relies on manual Docker-based environments across distributions.[40]
Best practices emphasize caution with destructive actions: users should maintain regular backups of critical data before enabling features like LUKS header shredding, as these are irreversible and carry risks of data loss.[36] Additionally, secure the physical setup with a sturdy table and avoid laptop movement after arming to minimize unintended triggers, starting with non-destructive options like screen locking for initial verification.[36]