cellphones? cellphone tethering?
IBM bans USB, SD cards, flash drives and portable devices from every office
101–110 of 202 posts
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#102Earlier quoted context omitted.
> you could bypass this if you had admin rights but it would leave a trail A move I've seen being put in place at several locations, is removing local admin rights from all users. Those with advanced needs, like developers, gets a VM which is limited to a specific VLAN, with no access to the production environments. The principle is sound, implementation is ... difficult, to say the least.
And if you're willing to run a lot of screencaps or re-type the stuff you see on another computer you can still get the data out. Before modems were common in the hands of unwashed masses my friend and I would transfer files on the phone by spelling out blocks in hex. Slow but with a checksum every 16 bytes it was good enough to get some work done. If the data is high value enough it would probably be worth it.
Airgapped exfil is a whole research field. Priority one is making accidental leaks or infections all but impossible. Priority two is making large scale intentional leaks as slow and difficult as possible. As long as there are human eyes on the data, some level of leaking is possible.
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#103Preventing exfiltration? Nobody tell them about my library [1], they'll need to ban line out ports and headphones :)
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#104Earlier quoted context omitted.
How do you connect a keyboard or mouse?
An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence. The keyboard and mouse were connected to a dock. On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail. The idea behind these like most other security controls is to prevent accident…
> On the OS level only HID devices were allowed via USB
Of course that's enough to run malware. Just inject Win+R, cmd, enter,
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#105This is already standard practice for several industries. For example, you’d be hard pressed to find a pharma company nowadays that allows the use of any removable media. The likely “replacement” is that IBM employees will have to use some sort of corporate VPN to work remotely.
Last meeting I was in with an IBM rep, he wanted to download some slides that were not part of his stock presentation, to address some specific questions we had. By the time he got connected to his VPN about 10 minutes had elapsed, and the download was going to take another 90 minutes. He ended up saying he'd email them later.
Corportate VPNs are great, but if they don't perform people are going to work around them.
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#106Preventing exfiltration? Nobody tell them about my library [1], they'll need to ban line out ports and headphones :) 1: https://quiet.github.io/quiet-js
Awesome! A GMSK modem in js? Good on you. Submit for show HN?
Have you tried other modulations?
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#107Preventing exfiltration? Nobody tell them about my library [1], they'll need to ban line out ports and headphones :) 1: https://quiet.github.io/quiet-js
Awesome! A GMSK modem in js? Good on you. Submit for show HN? Have you tried other modulations?
Thanks!
It made the rounds on show HN a couple years ago. Also my dirty secret is that it isn't really JS, it's C via emscripten https://github.com/quiet/quiet
Currently supports everything Liquid DSP supports which is GMSK, PSK, QAM, OFDM and a lot more. Working on adding DSSS soon
edit: Here's a sort of lab/playground https://quiet.github.io/quiet-profile-lab
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#108Earlier quoted context omitted.
>Now apparently you can't even use common tools to get the job done. If I had a big meeting I wouldn't take a chance on the network to keep my presentation. Then you are an active threat to your networks security. You sound like you have an incentive and willingness to put in effort and take personal risks to circumvent the security protocol at your workplace. Looking at employees without bad intents, this is as bad…
First, using USB drives was never against security policy at my work - so your personal attacks are unjustified. But secondly my powerpoint presentation isn't exactly top secret classified material. If we were talking about handling the private signing keys I would agree with you. Different types of data have different levels of security needed. Over classifying trivial data just makes it harder to get things done.
I am sorry if it came across as a personal attack, I didnt want to imply that you are personally negligent or unqualified to make that call. For all I know it is your job to make those policies at your place off work. The problem is a User with this attitude whos job isnt to make that call.
Strictly speaking, If a user in a workplace where this behavior is against the security policy acts like this or expresses this opinion, namely, that they wont be stopped by a security policy to hold their presentation, they are a user group that arent just a possible attack vector but a possible attacker them self.
If your company forbids the usage of USB ports, they do that for a reason, whether individual users think that is reasonable or not. This isnt just about possibly leaking data, but introducing stuff in an environment that is supposed to be closed. Differently put, as a bad faithed person, I will gladly borrow you my USB Stick to transfer your important files so you dont get in trouble for having technical hickups. I also will take you up on the "thank you" snacks and will also watch silently when you get in trouble for intentionally breaking security policies and infecting the network.
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#109Earlier quoted context omitted.
I met with a medical specialist at a huge hospital in New York - I had a usb drive with about 50G imaging data (pet, ct, mri) and they refused to access it. Fortunately I was also hosting it on my own server in various formats - nope, they can’t access the external network. I ended up burning the whole set to a spindle of dvds, which they could then import .. and shred.
Many companies do not allow the physical removal of “hard drives” and must be shredded before they can exit a door, which is why the “keep your drive” warranty policy is quite popular with many companies.
In the hospital I work at old CDs/DVDs/HDDs (readable or not) go through the slit at the top of a locked metal bin that gets taken away by some company at some point in time.
Re: IBM bans USB, SD cards, flash drives and portable devices from every office
#110Earlier quoted context omitted.
How can they prevent migration of talented people, given China's infinite war chest ?
> How can they prevent migration of talented people, given China's infinite war chest ? The Renminbi is very difficult to convert.
I've never had a problem converting modest amounts of CNY USD at any bank in China or in the USA. Are you referring to capital export controls (~100k CNY/year)?