Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PoisonTap – Exploits locked computers over USB

github.com

Post reply on HN
Print view View original

21–30 of 57 posts

Re: PoisonTap – Exploits locked computers over USB

#21

Post by micaksica »

You have a few mitigations that aren't listed here, but it's really moot because physical access is still game over.

First, the GRSecurity patchset contains a kernel-level USB whitelist, so you can whitelist only known USB devices. A targeted attacker could attempt to spoof an existing/whitelisted USB device, but it does significantly harden the USB attack surface:

1. https://wiki.gentoo.org/wiki/Allow_only_known_usb_devices

Clearly this only helps Linux people. For those using Linux/BSD/macOS, There's also usbkill, a Python-based antiforensic tool that just kills the computer if a device is inserted/removed that isn't on its whitelist: https://github.com/hephaest0s/usbkill

While this won't stop Samy's box from starting to do its thing, it will at least shut the computer off and mitigate some of the potential damage. usbkill is in the Homebrew repositories for macOS as well. If you have fully encrypted disks and strong passphrases, this is still going to ruin somebody's day trying to use this device.

Re: PoisonTap – Exploits locked computers over USB

#22

Post by brazzledazzle »

I don't have a Pi to test with but I imagine keeping the associated kernel module(s) (assuming I have the right ones) unloaded would mitigate this entirely:

kextunload /System/Library/Extensions/AppleUSBEthernet.kext

and maybe this one. I don't know if this would impact using your phone as a usb hotspot but it might so keep that in mind:

kextunload /System/Library/Extensions/AppleUSBNetworking.kext

and this one but I'm pretty sure it is in fact required for usb tethering so keep that in mind if you use that:

kextunload /System/Library/Extensions/AppleUSBEthernetHost.kext

I don't remember if they reload on reboot or not but if needed you can reload them with kextload.

Edit: This is for OS X/macOS by the way. And I wish I had a Pi to test with because this is very cool. We owe people that release stuff like this a big thanks because they took it from an idea to implementation and then the big step of creating a usable, shareable project which goes a long way toward increasing awareness.

Re: PoisonTap – Exploits locked computers over USB

#23

Post by conradev »

micaksica wrote: post #21

You have a few mitigations that aren't listed here, but it's really moot because physical access is still game over. First, the GRSecurity patchset contains a kernel-level USB whitelist, so you can whitelist only known USB devices. A targeted attacker could attempt to spoof an existing/whitelisted USB device, but it does significantly harden the USB attack surface: 1. https://wiki.gentoo.org/wiki/Allow_only_known_usb…

For completeness, if you happen to use Qubes, you can configure a VM specifically for talking to USB devices that would prevent this from affecting the rest of the system.

Re: PoisonTap – Exploits locked computers over USB

#24

Post by stebalien »

micaksica wrote: post #21

You have a few mitigations that aren't listed here, but it's really moot because physical access is still game over. First, the GRSecurity patchset contains a kernel-level USB whitelist, so you can whitelist only known USB devices. A targeted attacker could attempt to spoof an existing/whitelisted USB device, but it does significantly harden the USB attack surface: 1. https://wiki.gentoo.org/wiki/Allow_only_known_usb…

> First, the GRSecurity patchset contains a kernel-level USB whitelist, so you can whitelist only known USB devices. A targeted attacker could attempt to spoof an existing/whitelisted USB device, but it does significantly harden the USB attack surface:

Actually, the GRSecurity patchset includes a toggle to disable all new usb devices after boot. The whitelist mechanism you're referring to relies only on udev (no kernel patching needed). You can even whitelist by driver to, e.g., allow all usb storage devices by default.

Re: PoisonTap – Exploits locked computers over USB

#25

Post by niftich »

JshWright wrote: post #8
canada_dry wrote: post #3

It's long past time that USB security is taken seriously. By default anything stuck into a USB port should be sandboxed and various integrity checks need to be performed before access is allowed.

> It's long past time that USB security is taken seriously. You mean, before we started using USB for charging...? It wouldn't be hard at all to make a convincing looking power adapter with something like PoisonTap baked in.

You can protect both devices from each other with a USB condom [1] which only connects the power pins. This should be the solution for trying to charge from untrusted slots, or for when an untrusted device wants to charge from you.

[1] http://syncstop.com/#faq-original

Re: PoisonTap – Exploits locked computers over USB

#28

Post by greggman »

X-Istence wrote: post #27

On OS X when I plug in a new USB based Ethernet device, the first thing it does is pop up a dialog asking me if I want to enable/configure the device... is the device already configured at that time?

Does it ask for a password to enable it? If not the device and also emulate a keyboard to press enter to confirm the dialog.

Any idea where is the list of approved devices is. I'd like to clear my list and then plugin some devices and see if it asks.

Re: PoisonTap – Exploits locked computers over USB

#29

Post by greggman »

niftich wrote: post #25
JshWright wrote: post #8

Earlier quoted context omitted.

> It's long past time that USB security is taken seriously. You mean, before we started using USB for charging...? It wouldn't be hard at all to make a convincing looking power adapter with something like PoisonTap baked in.

You can protect both devices from each other with a USB condom [1] which only connects the power pins. This should be the solution for trying to charge from untrusted slots, or for when an untrusted device wants to charge from you. [1] http://syncstop.com/#faq-original

Know of any USB condoms that can filter for device types? Given BAD USB type of exploits there really no easy way for me to know that when I stuck my USB stick in the printer at the library it wasn't reprogrammed to be a keyboard or something else and when I then go plug it into my computer it now powns my computer

Re: PoisonTap – Exploits locked computers over USB

#30

Post by captainmuon »

The takeaway for me is that you can program a Raspberry Pi Zero to be a USB device (not just host). I wonder if it can do both at the same time...

I sometimes think about building a "USB Condom". There already exist devices that only pass through the power lines, if you want to charge a phone from a dubious plug. However, I would go a step further and try to support data. For example, I would emulate a USB pen drive (with a FAT32 file system), and then mirror the contents of an attached drive. If the attached drive is malicious, it cannot easily attack the host.

Post reply on HN