71–80 of 231 posts
(Of course, I'm assuming we're not dealing with a zero-day in the USB stack or filesystem drivers. But that probably is something that the Secret Service should be on top of, as well.)
I don't know much about this case but depending on the level of concern, even just plugging the device into a safe, isolated machine and performing an image may be insufficient. You could imagine a USB device that presented as a harmless file store unless certain conditions were detected, in which case the device could re-present as a keyboard (providing pre-programmed keystrokes) or potentially a bluetooth or wirele…
It could contain a microphone and a transmitter.
A more evil device, for assassination, could contain explosives or nerve gas. Plugging in the device is fatal.
Earlier quoted context omitted.
One small example: KVM switches would become incredibly cumbersome to use. However, I agree, there should be a much higher security standard for USB devices on the OS-level.
There are some implementation details that the KVM maker would have to get right, but if they don't screw it up, it all works as expected. Good KVMs already look at the keyboards they have connected, present separate virtual keyboards to connected computers, and route keystrokes explicitly based on state. You just need them to count the keyboards connected to them, and present a separate virtual keyboard for each dow…
Now get off my lawn.
Earlier quoted context omitted.
The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.
Before chip embedded credit/debit cards were prevalent, most magnetic strip reader (MSR) peripherals would often operate as a USB keyboard. It allows them to work with web app based POS systems without requiring things like ActiveX.
Earlier quoted context omitted.
The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.
Emulate a MTP device (often used by cameras) and mount with a fuse driver. Since the content on the remote device can change the driver shouldn't be caching it.
Earlier quoted context omitted.
The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still, I'd expect more from the organization, and I bet that the specific agents involved are getting disciplined and trained.
Well, the head of USSS was fired today. Unclear if it's related.
Shouldn't preventing this be as easy as turning off autorun? In fact, I thought Windows had that off by default for USB devices. (Of course, I'm assuming we're not dealing with a zero-day in the USB stack or filesystem drivers. But that probably is something that the Secret Service should be on top of, as well.)
In essence, modern OS's give "autorun" privilege to keyboards and mice. That's the HID in this discussion -- Human Interface Device.