Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

51–60 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#51

Post by jimrandomh »

loser777 wrote: post #28
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

This is likely not enough to secure a system against a sufficiently skilled adversary. An OS has limited control over many of the side-channels available to the USB stick once it is inserted into the system (e.g., fluctuations in the voltage rails that give away what the processor is doing). If you are thinking in terms of "if it identifies itself as...," then there is a good chance that something lower in the stack…

Yes, there will likely still be ways for a malicious USB device to use electrical side-channels to attack a connected computer. But devices like that will be much harder to develop. And more importantly: compromised devices which weren't originally designed to do that, won't be able to rewire themselves into side-channel-exploiters. So if my USB storage device has a firmware vulnerability, and a malicious computer reprograms it, it won't be able to use electrical side-channels to attack my other computers because it doesn't have a suitable DAC and ADC.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#52

Post by verst »

I have a mysterious USB stick I received as a thank you from a delegation of the Chinese department of Customs (中华人民共和国海关总署) after presenting to them in Palo Alto. The USB is branded with the Chinese Customs logo and their slogan.

I haven't dared plugging this in. First and foremost I'm afraid it isn't standards compliant and will somehow fry my motherboard, secondly I don't have a burner device and the necessary knowledge to determine if anything suspicious is happening.

So for now my USB stick and its decorative case in Chinese art style are purely for display.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#53

Post by lawl »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions?

For linux you can actually require USB devices to be authorized first by changing a few kernel settings.

A friend of mine wrote a few shellscripts a few years ago to do exactly that:

https://git.quitesimple.org/usbfilter/tree/

As you can see it's something that's very simple to do, there's just no good "normal user" UI for it.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#54

Post by untog »

lvs wrote: post #49
bdamm wrote: post #19

Earlier quoted context omitted.

The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still, I'd expect more from the organization, and I bet that the specific agents involved are getting disciplined and trained.

Well, the head of USSS was fired today. Unclear if it's related.

He was also fired after the Secret Service criticised security at Mar a Lago, so we've got a few candidates to choose from in working out the real reason.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#55

Post by Taniwha »

The thing that no one seems to point out is that just about any normal person carrying around a windows USB stick is likely to have malware on it. Just possessing a bad USB stick doesn't seem to be particularly incriminating by itself.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#56

Post by untog »

vanattab wrote: post #35
exelius wrote: post #16

Earlier quoted context omitted.

> I think the question of how to safely analyze suspect USB devices, at the level of potential nation-state actors, needs a lot more consideration and probably some custom tooling. I would be absolutely shocked if the US’ three letter agencies did not have some form of custom tooling to detect this — especially considering the sophisticated multi-vector I/O exploitation they demonstrated a decade ago with Stuxnet and…

Look, I hate Trump as much as the next guy(or gal) but do we really have to make EVERYTHING about trump.?

In this case we kind of do. The USB stick was recovered from a woman who was visiting Mar a Lago. Trump conducts government business there a lot, in a break with pretty much all advice. It's an incredibly insecure location.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#57

Post by conistonwater »

bdamm wrote: post #15
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

That's kind of ingenious, but is sending temperature data over USB really such a hard problem in the first place? I'm not really familiar with the USB protocol.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#58

Post by daigoba66 »

netsharc wrote: post #27
bdamm wrote: post #15

Earlier quoted context omitted.

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

Before chip embedded credit/debit cards were prevalent, most magnetic strip reader (MSR) peripherals would often operate as a USB keyboard. It allows them to work with web app based POS systems without requiring things like ActiveX.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#59

Post by markaz »

jimrandomh wrote: post #30
xtreme wrote: post #22

Earlier quoted context omitted.

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password. Wireless presenters often identify themselves as keyboards so that they can "press" the arrow keys to move forward or backward. How are you going to type your password using such a device?

Yes, there are corner cases (another commenter mentioned a temperature sensor, and I this is also common among barcode scanners). These corner cases are not hard to work out; just prompt the user and require them to confirm that the device is, in fact, allowed to act like a keyboard. (Which would mean you can still have malware-download-command-typers pretending to be barcode-scanners pretending to be keyboards, but…

I would guess that 99% of users would click ok for "Allow typing with this keyboard?" when they plug in a USB storage device.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#60

Post by _rs »

rblatz wrote: post #5

Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system. “We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.” That's…

Are there any open-source or commercial systems that do anything close to this? Does there exist such a forensically sound OS that should be used?

The best I've found for disk imaging is using Windows Enterprise (or similar, stripped down) with SafeBlock, but that seems less than ideal. I'd love to find a *nix alternative.

Post reply on HN