No one, not even the Secret Service, should randomly plug in a strange USB stick • Hacker News Board

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#11

Post by skywhopper » Mon, Apr 08, 2019, 10:38 PM UTC

it immediately began to install files, a “very out-of-the-ordinary” event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any further corruption of his computer

This makes it sound like plugging USB sticks guests are carrying into a computer is standard procedure for the Secret Service. That might make sense if they have some sandboxed computer designed for this purpose, as suggested by other commenters. But then the rest of the quote makes it sound like the agents were unprepared for files to be copied and they panicked and aborted the "analysis" to prevent "corruption". Which makes it sound like, no, they just plug it into their own computers...

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#12

Post by jakeinspace » Mon, Apr 08, 2019, 10:39 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

One small example: KVM switches would become incredibly cumbersome to use. However, I agree, there should be a much higher security standard for USB devices on the OS-level.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#13

Post by Havoc » Mon, Apr 08, 2019, 10:40 PM UTC

Meanwhile even the shittiest hollywood plotline has "we'll infect their systems with this virus - infiltrate and plug it into their servers" narrative.

I know secretive service agent =/= computer expert but jesus...both my little sister and 60 year old mother know better.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#14

Post by pilsetnieks » Mon, Apr 08, 2019, 10:40 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Because very many people (and more importantly, businesses) have obscure buggy printers from the 90s or the equivalent thereof.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#15

Post by bdamm » Mon, Apr 08, 2019, 10:41 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data.

I'd rather this device presented itself as a drive containing various virtual files that contain temperature data in them, but the cat's out of the bag, so to speak.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#16

Post by exelius » Mon, Apr 08, 2019, 10:42 PM UTC

steven777400 wrote: post #3

I don't know much about this case but depending on the level of concern, even just plugging the device into a safe, isolated machine and performing an image may be insufficient. You could imagine a USB device that presented as a harmless file store unless certain conditions were detected, in which case the device could re-present as a keyboard (providing pre-programmed keystrokes) or potentially a bluetooth or wirele…

> I think the question of how to safely analyze suspect USB devices, at the level of potential nation-state actors, needs a lot more consideration and probably some custom tooling.

I would be absolutely shocked if the US’ three letter agencies did not have some form of custom tooling to detect this — especially considering the sophisticated multi-vector I/O exploitation they demonstrated a decade ago with Stuxnet and the Equation Group.

Regardless of your views on his policy, Trump has demonstrated zero respect for opsec — even in a national security context — so I would also not be surprised if those three letter agencies have decided the White House is untrustworthy with its cyber warfare capabilities.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#17

Post by q3k » Mon, Apr 08, 2019, 10:43 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

>It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions?

Because up until 10 years ago, developing your own USB device was generally expensive and malicious devices ended up being out of scope in threat modelling. In addition, some models these days still define 'physical access == game over'...

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#18

Post by enraged_camel » Mon, Apr 08, 2019, 10:43 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Because the overwhelming majority of computer users in the world are not sophisticated, and want things to "just work" once those things are plugged in. I don't think it's an unreasonable expectation/desire, despite the risks.

Keep in mind that autoplay is not unique to USB drives either. CD-ROM drives have had that feature forever.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#19

Post by bdamm » Mon, Apr 08, 2019, 10:44 PM UTC

skywhopper wrote: post #11

it immediately began to install files, a “very out-of-the-ordinary” event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any further corruption of his computer This makes it sound like plugging USB sticks guests are carrying into a computer is standard procedure for the Secret Service. That might make sense if they have some sandboxed computer…

The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still, I'd expect more from the organization, and I bet that the specific agents involved are getting disciplined and trained.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#20

Post by jimmy1 » Mon, Apr 08, 2019, 10:46 PM UTC

pilsetnieks wrote: post #14

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Because very many people (and more importantly, businesses) have obscure buggy printers from the 90s or the equivalent thereof.

And because the 99% use case is: "I plug it in and I want it to just work"

This type of protection parent is referencing is "endpoint protection" and there are many industry standard solutions. Why should an OS be more limiting? If you have physical access to a machine that stores things you shouldn't have access to, it's already compromised in my opinion. Why the eff are people overlooking physical security in 2019 is the better question.