Security isn't an app you launch. It's part of the boot.
BTDOSec is the security built into BTDOS: six layers that check each other from the moment you plug the dongle in, checks you can run whenever you like, and protection that's simply always on.
The six layers
Each one is checked by the one before it. Scroll down: the shield builds up as each layer is in place.
6 of 6 layersEmergency shutdown
The dongle's chip
The dongle has its own processor between the PC and the memory card, and its firmware decides which parts of the card may be written at all. The key that checks your PIN is burned into the chip's one-time eFuses: it can be used, never read out or changed. It also counts every start, so you learn when someone else used it.
Stops a PC, or malware on it, quietly changing the system on the stick.
Boot verification
Every file of the system is listed in a manifest signed with Ed25519. Before anything starts, BTDOS checks the signature and every file against it. The drivers are checked block by block as they're read, and an update is never accepted if it's older than what you run.
Stops a changed or swapped system. One wrong file and BTDOS refuses to start, and says which one.
Write-protected system
The boot and system parts of the card stay locked by the dongle. An update only goes through while you hold its button for six seconds, and it locks again by itself.
Stops anything changing the system without your hand on the dongle.
RAM-only runtime
BTDOS copies itself into memory and runs from there. The PC's drives stay untouched and the browser keeps nothing between sessions. Firefox runs as its own restricted user, walled off from your Vault, the dongle and the firewall.
Stops traces on the PC, and a hacked website reaching your Vault or the dongle.
Encrypted Vault
Files, passwords, notes and Wi-Fi keys live in a Vault on the dongle, encrypted with AES-256-GCM under a key made from your password with scrypt. It opens into memory only, and anything open in it is wiped from memory when it locks.
Stops someone who has the dongle from reading what you saved.
Emergency shutdown
Hold the button and pull the dongle out, or press Ctrl+Alt+Backspace: every program stops, memory is wiped and the PC powers off. The screen lock asks the dongle for your PIN, and too many wrong guesses end the session instead of giving it away.
Stops someone getting into a session you left running.
Checks you can run
On top of the check at every start, BTDOSec can look deeper whenever you want: in Settings, BTDOSec, or from the terminal. Results come up as a notification.
Quick scan about 20 seconds
A rootkit hunt in the spirit of rkhunter and AIDE. It compares the running system with the fingerprints it took at boot, and the kernel's own views with each other.
- Programs changed or added since boot
- Processes hidden from the process list
- Kernel modules that hide, or don't come from the verified driver pack
- Code injected into programs (ld.so.preload, LD_PRELOAD)
- Extra root accounts, sniffing network cards, files hiding in /dev, known rootkit files
Full check about 3 minutes
Everything in the quick scan, plus every file on the dongle hashed and compared with the signed manifest: the system, the boot files, the packages, and BTDOS Control on the Windows side.
File scan seconds
For what you bring in: Downloads, Pictures and USB sticks, or any file or folder from the Files app (right-click, Scan with BTDOSec).
- Programs and scripts, with their fingerprint
- Programs dressed up as documents (invoice.pdf.exe) or using a right-to-left name trick
- Office files with macros, PDFs that run code, Windows shortcuts
- Zip files with programs inside, and the EICAR test virus
Want a full virus database too? Install the optional ClamAV package: its signatures are kept on the dongle and the file scan uses them automatically.
ok System verified against its signature at boot ok Running programs: unchanged since boot ok No hidden processes ok No hidden kernel modules ok All kernel modules come from the verified pack ok Kernel not tainted ok No code injection ok Only root has root rights ok No network card is capturing other traffic ok None of the known rootkit files are present warn Windows program in Downloads: setup.exe (sha256 9f2c...41ab) ok 18 checks, 1 warning
Under the hood
For the technically curious: what actually happens, from power-on to the desktop, and how each part is built.
- PC firmwarereads the boot partition, which the dongle keeps locked
- GRUBloads the kernel and the small start-up system; menu editing is password-locked
- Start-up checkverifies the Ed25519 signature on the manifest, then hashes the system
- Into RAMthe checked system is copied into memory and runs from there
- Driversmounted through dm-verity: every block is checked as it's read
- Desktopabout twenty seconds after power-on; Firefox loads, checked, in the background
The dongle's firmware
The dongle's own chip sits between the PC and the memory card and presents the card as a USB drive. Every write passes through the firmware, which refuses writes to the boot and system partitions. Which areas those are, it learns from the card's own partition table (a read-only flag), remembers in its own flash, and won't accept a changed layout without a six-second hold of the button.
Holding the button for six seconds unlocks writing for an update. A click, unplugging, or fifteen minutes without writes locks it again. The amber light blinks while it's unlocked.
The screen-lock PIN is never stored anywhere readable. A one-time HMAC key is burned into the chip's eFuses, and only a check value of your PIN is kept next to it. When you unlock, BTDOS sends the PIN together with a fresh random number; the answer has to carry that number and expires after ten seconds, so an old "ok" can't be replayed. Five wrong PINs end the session, and wrong guesses make the dongle wait longer and longer.
Signatures and updates
Every build writes a manifest: the SHA-256 hash, size and path of every file, signed with an Ed25519 key that never leaves the build machine. The start-up system checks the signature with Monocypher, a small, audited crypto library, before it trusts a single file.
The manifest carries a serial number. An update is only installed if it's signed and newer than what you run, so an older build with known holes can never be pushed back in. Downloads go over HTTPS with the certificate checked, and the package list is signed the same way.
The Vault's encryption
The Vault is one encrypted file on the dongle. Your password is stretched with scrypt, which is made to be slow and memory-hungry for anyone guessing, and the result encrypts the Vault with AES-256-GCM, which also detects any change to the file. Every save uses a new salt and nonce.
When it's open, its contents live in a RAM filesystem only the system can read. Locking it wipes that, and the apps that showed passwords or notes forget them at the same moment.
Isolation
Firefox, the program most exposed to the internet, runs as its own user with no way back to root (no_new_privs). It can read and write Downloads and read Pictures, nothing more: not the Vault, not the dongle, not the firewall or Tor's rules. Its virtual screen runs as that same user.
The firewall drops every incoming connection unless you open a port on purpose. In "Tor for everything" mode, anything that can't go through Tor is blocked, IPv6 and the local network included.
Forgetting, properly
The kernel runs with init_on_free, so memory is zeroed as soon as it's released, not only at shutdown. On power-off, or on the emergency wipe, BTDOS stops every program, unmounts the Vault, drops logs, keys and network state, and wipes what's left before the PC turns off.
A copied password leaves the clipboard and its history after thirty seconds. Every network card gets a random address at every start.
Hardening
Kernel addresses and the kernel log are hidden from programs (kptr_restrict, dmesg_restrict), unprivileged BPF is off, and symlink and hardlink tricks in shared folders are blocked. The system has no setuid programs at all, so there's nothing to climb on to get root.
Settings and files that live on the dongle's data partition, which Windows can write to, are treated as untrusted: Wi-Fi settings go through an allow-list, VPN names and addresses are checked, and no file name is ever handed to a shell.
Always on
The things that protect you without you doing anything.
Start counter
The dongle counts every start. If it was used without your PIN since you last had it, BTDOS tells you.
Signed downloads
Updates and packages are only installed when they're signed with the BTDOS key, and downloads check the server's certificate.
Tor, even where it's blocked
For the browser or for everything, with bridges for networks that try to stop it.
A clipboard that forgets
A copied password leaves the clipboard, and its history, after a few seconds.
No hidden metadata
Photos and documents can be stripped of location, camera and author details before you share them.
Random identity
Every network card gets a new random address at every start, so networks can't recognise the PC.
A firewall that says no
Nothing from the network may connect in, unless you open it on purpose.
Private sharing
Send to phone shares one file, on your own network, for five minutes, with a link nobody can guess.
What it doesn't do
Knowing the limits is part of being safe.
- BTDOS trusts the PC it runs on. A PC with a hardware keylogger or tampered firmware can see what you do.
- Someone who has the dongle long enough can reflash its chip with other firmware, and then the chain above no longer holds. Keep the dongle with you.
- On its own, the file scan looks for programs and known tricks, not for every virus there is. For that, add the optional ClamAV package and its virus database.
- BTDOSec hasn't been independently reviewed yet. Until it has, treat it as promising, not proven.