shouldn't the OS pause the running of programs when you've locked your computer, and when you log in say something like "hey you've plugged a new device in while you were locked out, are you sure you want to resume all you programs"
PoisonTap – Exploits locked computers over USB
51–57 of 57 posts
Re: PoisonTap – Exploits locked computers over USB
#52I remember the "good ol' days" when you could reasonably build a monolithic Linux kernel with support for loadable modules disabled. Just compile in whatever you needed for your hardware and leave out the other 90% that you didn't need. It was a decent (but not very popular) defense against rootkits and attackers being able to dynamically load kernel modules and would also prevent something like this (unless you had…
What's stopping you from doing it now?
I've been using CONFIG_MODULES=n for years without issue. It can be annoying when you need to use some obscure driver, filesystem or protocol on a one off basis and have to do an emergency recompile just for that, but that's rare (for me at least), and otherwise it's perfectly usable.
Re: PoisonTap – Exploits locked computers over USB
#53The takeaway for me is that you can program a Raspberry Pi Zero to be a USB device (not just host). I wonder if it can do both at the same time... I sometimes think about building a "USB Condom". There already exist devices that only pass through the power lines, if you want to charge a phone from a dubious plug. However, I would go a step further and try to support data. For example, I would emulate a USB pen drive…
You wish to build your own USB condom because you want to be absolutely, 100% sure it's built without any kind of backdoor and you don't trust anyone else to do this for you?
Because otherwise you can just get one at e.g. http://int3.cc/products/usbcondoms
I have had one for years (a no-name one, not the one I linked)
Re: PoisonTap – Exploits locked computers over USB
#54It's long past time that USB security is taken seriously. By default anything stuck into a USB port should be sandboxed and various integrity checks need to be performed before access is allowed.
> By default anything stuck into a USB port should be sandboxed Yes, suppose you have a mac mini and you plug in USB keyboard, oops it's sandboxed and does not work.
I think the idea is that if a second "keyboard" is plugged in while the machine is locked/asleep, it shouldn't work. Even for the scenario where you dump $BEVERAGE into your keyboard, forcing a hard reboot to be able to plug in another keyboard (and log back in) doesn't seem unreasonable.
Re: PoisonTap – Exploits locked computers over USB
#55The takeaway for me is that you can program a Raspberry Pi Zero to be a USB device (not just host). I wonder if it can do both at the same time... I sometimes think about building a "USB Condom". There already exist devices that only pass through the power lines, if you want to charge a phone from a dubious plug. However, I would go a step further and try to support data. For example, I would emulate a USB pen drive…
You wish to build your own USB condom because you want to be absolutely, 100% sure it's built without any kind of backdoor and you don't trust anyone else to do this for you? Because otherwise you can just get one at e.g. http://int3.cc/products/usbcondoms I have had one for years (a no-name one, not the one I linked)
No, the one you linked to is just charge-only.
I wish to build - or I wish someone would build - a USB condom that passes through USB stick drives, by reading files on one side, and emulating a filesystem on the other.
It's not because I want to be 100% there is no backdoor. Rather I want a minimum of safety when I have to access a USB stick given to me by a stranger.
(Speaking of building your own, simple power-only USB condoms - like you linked to - are actually pretty easy to make. They have been used to teach (SMD) soldering at CCC events, hackerspaces and the like.)
Re: PoisonTap – Exploits locked computers over USB
#56The takeaway for me is that you can program a Raspberry Pi Zero to be a USB device (not just host). I wonder if it can do both at the same time... I sometimes think about building a "USB Condom". There already exist devices that only pass through the power lines, if you want to charge a phone from a dubious plug. However, I would go a step further and try to support data. For example, I would emulate a USB pen drive…
Hm, this sounds like a software-based solution right? But if you have software only letting certain data pass, couldn't the same software just be run by the main device instead of an intermediate one?
Just what wongarsu said.
I don't know from the top of my head about USB, but for FireWire there was a hack that allowed a malicious device to access all memory (read-write). Basically, a new device is placed on the DMA bus (for speed reasons) with no authentication and can do whatever it wants. There is a proof of concept that unlocks OS X, Windows, and a popular Linux desktop.
There was a USB bug where you could infect some USB controllers with mal-firmware that would spread like a worm! I believe the NSA was actively using this, but I might be mixing things up.
With a condom, a malicious device would have to take over two pieces of hardware, not just one. This is one advantage of a hardware solution.
The other advantage is, if there is an exploit in the USB filter software, the malware lands in my condom (hihi). It would likely have to be adapted to work on it and to move to my PC (the condom is ARM, has no network besides USB, can have a read-only file system, ...).
Re: PoisonTap – Exploits locked computers over USB
#57On OS X when I plug in a new USB based Ethernet device, the first thing it does is pop up a dialog asking me if I want to enable/configure the device... is the device already configured at that time?
Does it ask for a password to enable it? If not the device and also emulate a keyboard to press enter to confirm the dialog. Any idea where is the list of approved devices is. I'd like to clear my list and then plugin some devices and see if it asks.
I run as a non-administrator account, so this may be different if the user has administrator privileges.
But here is what happens:
1. I plug in the new device
2. Dialog box pops up letting me know a new network interface was detected (and to open network preferences to configure the device). The device does show up as en6, it is disabled and there is no network activity.
3. I can click Cancel or open Network Preferences
4. Click to open Network Preferences
5. I have to click the lock, and authenticate as an administrative user
6. I have to click the +
7. I have to select the new network interface by name from the drop-down
8. I have to click OK
9. I have to click Apply
At that point the network interface is brought "up", and it does a DHCP request, and I can use it.
So there are 8 steps to take AFTER plugging in the device before it can start siphoning off any and all of my data. It's not as plug and go as it is made out to be.
----
After adding a device, you can remove it from the list of devices in Network Preferences, and that resets that dialog box letting you know there is a new device.