Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

41–50 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#41

Post by jimrandomh »

pilsetnieks wrote: post #14
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Because very many people (and more importantly, businesses) have obscure buggy printers from the 90s or the equivalent thereof.

The key thing to realize is that malicious USB devices get to choose which device they identify themself as to the operating system, but have much less control over what they physically look like to the user.

If you plug in an old printer, you know you just plugged in an old printer; you can load the old-printer device driver and it probably won't exploit it. But if you plug in a USB stick you found in the parking lot, and it asks you whether you just plugged in an old printer, then the game is up; you know it's a tricky device, pretending to be something it's not in order to target a security vulnerability.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#42

Post by samstave »

travisglines wrote: post #25
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

I wish I could upvote this comment twice. At this point in 2019 intelligence gathering and government/corporate security vulnerabilities are much more in the digital realm than physical. Wifi enabled cameras/microphones, cell phones, servers, consumer computers, usb devices, iot devices are all used to that end. We need to hold the flame to OS vendors to handle basic security precautions. It's not like the US governm…

If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#43

Post by delinka »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

great, now I've typed my password into what turned out to be a malicious device ...

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#45

Post by elagost »

Similar concerns should be made for Thunderbolt devices, which have direct PCIe access - much more low-level and dangerous than USB could be. The only system I've seen implement this is Gnome3 - it has a section in its system preferences for configuring Thunderbolt devices[0] and the Bolt daemon.[1]

[0] https://wiki.gnome.org/Design/Whiteboards/ThunderboltAccess

[1] https://www.phoronix.com/scan.php?page=news_item&px=Bolt-Pro...

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#46

Post by [deleted] »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

[deleted]

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#47

Post by evan_ »

the8472 wrote: post #33
netsharc wrote: post #27

Earlier quoted context omitted.

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

Emulate a MTP device (often used by cameras) and mount with a fuse driver. Since the content on the remote device can change the driver shouldn't be caching it.

at that point you might as well just use the real drivers.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#48

Post by jimrandomh »

delinka wrote: post #43
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

great, now I've typed my password into what turned out to be a malicious device ...

You misunderstand. Malicious USB devices often present themselves to computers as keyboards, which type malicious commands. But they don't look like keyboards, or have keys on them; they usually look like USB storage devices.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#49

Post by lvs »

bdamm wrote: post #19
skywhopper wrote: post #11

it immediately began to install files, a “very out-of-the-ordinary” event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any further corruption of his computer This makes it sound like plugging USB sticks guests are carrying into a computer is standard procedure for the Secret Service. That might make sense if they have some sandboxed computer…

The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still, I'd expect more from the organization, and I bet that the specific agents involved are getting disciplined and trained.

Well, the head of USSS was fired today. Unclear if it's related.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#50

Post by na85 »

samstave wrote: post #42
travisglines wrote: post #25

Earlier quoted context omitted.

I wish I could upvote this comment twice. At this point in 2019 intelligence gathering and government/corporate security vulnerabilities are much more in the digital realm than physical. Wifi enabled cameras/microphones, cell phones, servers, consumer computers, usb devices, iot devices are all used to that end. We need to hold the flame to OS vendors to handle basic security precautions. It's not like the US governm…

If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.

Hasn't the security by obscurity myth been debunked, and furthermore hasn't government proven itself utterly incompetent at designing products?
Post reply on HN