81–90 of 232 posts
Earlier quoted context omitted.
That's a false statement. They work with NIST to develop the standards that are the basis of the infosed industry.
For the most part, NIST really has no relevance in infosec. With a few exceptions, they're always way behind, and only focus on a few narrow domains.
In terms of the "narrow scope" assertion: http://csrc.nist.gov/publications/PubsSPs.html
Earlier quoted context omitted.
> You could quite easily hide a USB mass storage device inside a mouse AFAIK one could mitigate something like this by really restrictive udev rules only allowing certain usb drivers on certain usb ports (like no usb msc on the port dedicated for keyboard only).
You can mitigate the exploit against standard mass storage drivers, yes, but there are other ways. It appears in this case the host was compromised (so able to override the drivers). If a userland program can get at the raw HID interface, that can also be used for exfiltration to a tailored device.
xset led named 'Scroll Lock'
Interesting regarding USB devices. When US DoD systems were infected with a virus someone brought from home on a USB stick, I remember hearing there were going around filling USB ports with epoxy. There was some method behind the madness I guess. There is also a market for routers and other devices which are produced as much as possible in US (are they rolling their own capacitors I am wondering...). I saw some of th…
I wouldn't call RHEL 6 ancient. Thankfully this may be going away at some point in the future, leaving it up to agencies to certify products or stacks on their own merits, or to instead have them be evaluated for specific purposes if sold as solutions: https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/GPOS...
And 7 despite being out for 3 years? is still not certified.
> It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected Bribes always help.
Paying for certification is what's required. Governments require various certifications to sell to them, and that certification costs money in consultancies. RHEL paid for the testing, they get a certification and access to the customer. It looks like this is probably referring to EAL [1][2]. In a market with a large number of vendors interacting with a large number of relatively unknowledgeable buyers, an oversight…
Earlier quoted context omitted.
If your machine has a USB port, it's no longer properly isolated. Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports. You could quite easily hide a USB mass storage device inside a mouse, or with a bit mo…
If you just leave away the USB mass storage kernel module when compiling the kernel, the mass storage device won't work anymore while the mouse still works. I wonder if this is a solution to this problem or not since it seems quite naive.
Earlier quoted context omitted.
You can mitigate the exploit against standard mass storage drivers, yes, but there are other ways. It appears in this case the host was compromised (so able to override the drivers). If a userland program can get at the raw HID interface, that can also be used for exfiltration to a tailored device.
xset led named 'Scroll Lock' Slow, but works for PS/2 keyboards too.
Some at the NSA is having a bad day reading this.
The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?
If I wanted to own a machine and not be detected, that's where I'd live. It's also complex and closed source so you are basically guaranteed to have exploitable bugs that won't be fixed. It has access to network and system busses at a layer below the OS so ex-filtrating can be done at a layer below what the OS can see.
> It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected Bribes always help.
Earlier quoted context omitted.
xset led named 'Scroll Lock' Slow, but works for PS/2 keyboards too.
Depends on having a camera pointed that the compromised keyboard, and cameras are the first things banned when setting up a secure environment.