Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

61–70 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#61

Post by SerLava »

vanattab wrote: post #35
exelius wrote: post #16

Earlier quoted context omitted.

> I think the question of how to safely analyze suspect USB devices, at the level of potential nation-state actors, needs a lot more consideration and probably some custom tooling. I would be absolutely shocked if the US’ three letter agencies did not have some form of custom tooling to detect this — especially considering the sophisticated multi-vector I/O exploitation they demonstrated a decade ago with Stuxnet and…

Look, I hate Trump as much as the next guy(or gal) but do we really have to make EVERYTHING about trump.?

Kind of. Are you unaware of how much shit we're in?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#62

Post by taneq »

conistonwater wrote: post #57
bdamm wrote: post #15

Earlier quoted context omitted.

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

That's kind of ingenious, but is sending temperature data over USB really such a hard problem in the first place? I'm not really familiar with the USB protocol.

USB doesn't work without a driver and sometimes you don't want to (or can't) install a driver. This sounds like the kind of hack that a clever (but arguably unwise) engineer would shove in to help them remotely troubleshoot a device.

"Sensor not detected? OK, open up Notepad and hit Caps Lock three times quickly. Did some text appear? The sensor is fine, the problem is with your computer."

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#63

Post by taneq »

bsder wrote: post #40
jpindar wrote: post #21

Earlier quoted context omitted.

Eeewww. Why not just make it a virtual com port, which most computers already have drivers for?

Because Windows, the most popular operating system on the planet, didn't have VCOM drivers by default until Windows 10. This is why everybody tries to piggyback on being a USB HID device.

It did for a few different devices, they could have mimicked one of those.

Source: Have plugged several brands of USB-to-COM adapter in to Win 7 / 8.1 and they've "just worked".

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#64

Post by depressed »

verst wrote: post #52

I have a mysterious USB stick I received as a thank you from a delegation of the Chinese department of Customs (中华人民共和国海关总署) after presenting to them in Palo Alto. The USB is branded with the Chinese Customs logo and their slogan. I haven't dared plugging this in. First and foremost I'm afraid it isn't standards compliant and will somehow fry my motherboard, secondly I don't have a burner device and the necessary kno…

On the "determine if anything suspicious is happening" front, you can configure Wireshark to capture USB packets and show you what is going over the wire.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#65

Post by nkozyra »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Why is the secret service using Windows, osx or Linux to do USB analysis in the first place?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#66

Post by samstave »

na85 wrote: post #50
samstave wrote: post #42

Earlier quoted context omitted.

If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.

Hasn't the security by obscurity myth been debunked, and furthermore hasn't government proven itself utterly incompetent at designing products?

Thats not really what I meant.

I am just saying that they should have a pre usb meter that prevents the usb stick from being attached to a device directly such that they can screen it off ...

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#68

Post by swamp40 »

untog wrote: post #54
lvs wrote: post #49

Earlier quoted context omitted.

Well, the head of USSS was fired today. Unclear if it's related.

He was also fired after the Secret Service criticised security at Mar a Lago, so we've got a few candidates to choose from in working out the real reason.

The Secret Service reports to DHS. Mr. Alles was an ally of Ms. Nielsen, who just resigned/got the boot. Stephen Miller reportedly got the go-ahead to clean house at DHS, so all the leadership that isn't in line will get cleared out.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#69

Post by YjSe2GMQ »

netsharc wrote: post #27
bdamm wrote: post #15

Earlier quoted context omitted.

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

Barcode-as-a-keyboard was one of the vectors that researchers at last CCC used to hack ATMs. End result: show two barcodes, cash gets out.

https://media.ccc.de/v/35c3-9761-truly_cardless_jackpotting_...

USB is trash for security.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#70

Post by himlion »

netsharc wrote: post #27
bdamm wrote: post #15

Earlier quoted context omitted.

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

I was delighted about this when a client wanted a barcode scanner integrated with a web app. I envisioned major difficulties but instead it only took 5 minutes to implement.
Post reply on HN