Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

31–40 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#31

Post by peterwwillis »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need protection from advanced thieves you'll need to go through some extra hoops anyway.

You could petition OS manufacturers to focus more on physical security, but there's limits to what you can do without piles of abstractions (ala smart phone security)

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#32

Post by kweks »

AlphaWeaver wrote: post #10
rblatz wrote: post #5

Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system. “We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.” That's…

For people unfamiliar with this strategy, check out a commercialized version, the USB Rubber Ducky. https://shop.hak5.org/products/usb-rubber-ducky-deluxe

Or the USBNinja that crams that functionality into a cable identical to major vendors, and is triggerable up to 100m away via Bluetooth.... https://lab401.com/products/usbninja

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#33

Post by the8472 »

netsharc wrote: post #27
bdamm wrote: post #15

Earlier quoted context omitted.

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

Emulate a MTP device (often used by cameras) and mount with a fuse driver. Since the content on the remote device can change the driver shouldn't be caching it.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#34

Post by robocat »

loser777 wrote: post #28
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

This is likely not enough to secure a system against a sufficiently skilled adversary. An OS has limited control over many of the side-channels available to the USB stick once it is inserted into the system (e.g., fluctuations in the voltage rails that give away what the processor is doing). If you are thinking in terms of "if it identifies itself as...," then there is a good chance that something lower in the stack…

> This is likely not enough to secure a system against a sufficiently skilled adversary.

That statement is not helpful, because it remains true for any security measure.

The GP suggestions can make everyone's computers more secure now, at what would seem to be a low cost...

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#35

Post by vanattab »

exelius wrote: post #16
steven777400 wrote: post #3

I don't know much about this case but depending on the level of concern, even just plugging the device into a safe, isolated machine and performing an image may be insufficient. You could imagine a USB device that presented as a harmless file store unless certain conditions were detected, in which case the device could re-present as a keyboard (providing pre-programmed keystrokes) or potentially a bluetooth or wirele…

> I think the question of how to safely analyze suspect USB devices, at the level of potential nation-state actors, needs a lot more consideration and probably some custom tooling. I would be absolutely shocked if the US’ three letter agencies did not have some form of custom tooling to detect this — especially considering the sophisticated multi-vector I/O exploitation they demonstrated a decade ago with Stuxnet and…

Look, I hate Trump as much as the next guy(or gal) but do we really have to make EVERYTHING about trump.?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#36

Post by waffleguy »

beamatronic wrote: post #2

I doubt they would release their “real” operational procedures to the press. Surely they attached the USB to some sort of sandboxed environment? On the other hand why would they be carrying around such equipment?

Umm... you can use a raspberry pi as a sandbox. My nephew carries around such equipment. Why wouldn’t the secret service?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#37

Post by jimrandomh »

jakeinspace wrote: post #12
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

One small example: KVM switches would become incredibly cumbersome to use. However, I agree, there should be a much higher security standard for USB devices on the OS-level.

There are some implementation details that the KVM maker would have to get right, but if they don't screw it up, it all works as expected.

Good KVMs already look at the keyboards they have connected, present separate virtual keyboards to connected computers, and route keystrokes explicitly based on state. You just need them to count the keyboards connected to them, and present a separate virtual keyboard for each downstream connected keyboard, so that the connected computers can tell which keystrokes came from which keyboard.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#38

Post by jolmg »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Yubikeys can pretend to be keyboards to type your password. It's a simple way to get maximum compatibility for a hardware key. I imagine there's other legitimate use-cases for non-keyboards to act like keyboards.

Still, requiring one to type a password in a newly connected keyboard is a pretty good idea as long as it's a configuration option. I imagine you'd also like something similar for the mouse. Maybe having to type a password on a virtual keyboard. It's annoying to have to do something like that every time a computer is woken up. You're talking about typing a password 3 times. Once to log the keyboard in, then to log the mouse in, then to select a user and log the user in.

Your other suggestions are vague, so I'm not sure what you mean by "basic". I mean, if one knows a driver is buggy, those bugs would be taken care of (from the developer's point of view; the administrator might not update the software, but what can the developer do?).

And what does it mean to "harden" a filesystem driver when a device identifies itself as a storage device? A filesystem driver should be "hard", period. All the time. That's something done when the driver is being written, not until it identifies a device.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#40

Post by bsder »

jpindar wrote: post #21
bdamm wrote: post #15

Earlier quoted context omitted.

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

Eeewww. Why not just make it a virtual com port, which most computers already have drivers for?

Because Windows, the most popular operating system on the planet, didn't have VCOM drivers by default until Windows 10.

This is why everybody tries to piggyback on being a USB HID device.

Post reply on HN