No one, not even the Secret Service, should randomly plug in a strange USB stick • Hacker News Board

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#21

Post by jpindar » Mon, Apr 08, 2019, 10:47 PM UTC

bdamm wrote: post #15

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

Eeewww. Why not just make it a virtual com port, which most computers already have drivers for?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#22

Post by xtreme » Mon, Apr 08, 2019, 10:47 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password.

Wireless presenters often identify themselves as keyboards so that they can "press" the arrow keys to move forward or backward. How are you going to type your password using such a device?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#23

Post by the8472 » Mon, Apr 08, 2019, 10:48 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

You can lockdown USB access on linux with usbguard[0]. IIRC windows 10 enterprise also has some USB whitelist feature somewhere.

[0] https://usbguard.github.io/

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#24

Post by meowface » Mon, Apr 08, 2019, 10:49 PM UTC

beamatronic wrote: post #2

I doubt they would release their “real” operational procedures to the press. Surely they attached the USB to some sort of sandboxed environment? On the other hand why would they be carrying around such equipment?

I can totally buy some low-level Secret Service agent with little tech knowledge plugging it into a machine without thinking twice.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#25

Post by travisglines » Mon, Apr 08, 2019, 10:49 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

I wish I could upvote this comment twice.

At this point in 2019 intelligence gathering and government/corporate security vulnerabilities are much more in the digital realm than physical. Wifi enabled cameras/microphones, cell phones, servers, consumer computers, usb devices, iot devices are all used to that end.

We need to hold the flame to OS vendors to handle basic security precautions. It's not like the US government doesn't have contract negotiations with them large enough to force the issue.

It's also unacceptable to have security around the most protected person on the planet be ignorant to common attack vectors and procedures.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#26

Post by the8472 » Mon, Apr 08, 2019, 10:49 PM UTC

xtreme wrote: post #22

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password. Wireless presenters often identify themselves as keyboards so that they can "press" the arrow keys to move forward or backward. How are you going to type your password using such a device?

You would only need the password-auth to bootstrap your primary keyboard. If you already have a keyboard you can just accept the prompt.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#27

Post by netsharc » Mon, Apr 08, 2019, 10:50 PM UTC

bdamm wrote: post #15

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers.

I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#28

Post by loser777 » Mon, Apr 08, 2019, 10:51 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

This is likely not enough to secure a system against a sufficiently skilled adversary. An OS has limited control over many of the side-channels available to the USB stick once it is inserted into the system (e.g., fluctuations in the voltage rails that give away what the processor is doing).

If you are thinking in terms of "if it identifies itself as...," then there is a good chance that something lower in the stack may be compromised.

This gets even more troublesome once we consider that people sometimes forget that seemingly "dumb" dongles such as display adapters can be very similar to USB sticks from an implementation and vulnerability point of view (e.g., "Thunderclap").

I think the overhead of hardening systems for each of these scenarios would be immense.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#29

Post by sjg007 » Mon, Apr 08, 2019, 10:52 PM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Backwards compatibility.. /s

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#30

Post by jimrandomh » Mon, Apr 08, 2019, 10:53 PM UTC

xtreme wrote: post #22

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password. Wireless presenters often identify themselves as keyboards so that they can "press" the arrow keys to move forward or backward. How are you going to type your password using such a device?

Yes, there are corner cases (another commenter mentioned a temperature sensor, and I this is also common among barcode scanners). These corner cases are not hard to work out; just prompt the user and require them to confirm that the device is, in fact, allowed to act like a keyboard.

(Which would mean you can still have malware-download-command-typers pretending to be barcode-scanners pretending to be keyboards, but you can't have malware-download-command-typers pretending to be storage devices pretending to be keyboards, because the "Allow typing with this keyboard?" dialog will give it away.)