The article assumes (or at least implies) the secret service member was plugging it into his own personal laptop or something. Why? It may very well be a computer specifically setup to screen devices, including USB drives. It may be a sandboxed and sanitized environment. Or not, but we just don't know, and this article seems a little sensationalist in casting a negative light in the secret service absent details.
No one, not even the Secret Service, should randomly plug in a strange USB stick
91–100 of 231 posts
Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#92Ha haa haaaa .. you can not be serious :] ‘Secret Service agent. Samuel Ivanovich, who interviewed Zhang Mar-a-Lago, testified at the hearing. He stated that when another agent put Zhang's thumb-drive into his computer, it immediately began to install files, a "very out-of-the-ordinary" event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any…
That's the new go-to for asking embarassing questions.
"How do I fix my computer after I plug in a malware USB device? I meant, I didn't do that, I'm asking for a f-- another agent."
Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#93Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#94I doubt they would release their “real” operational procedures to the press. Surely they attached the USB to some sort of sandboxed environment? On the other hand why would they be carrying around such equipment?
I can totally buy some low-level Secret Service agent with little tech knowledge plugging it into a machine without thinking twice.
Or a high-level agent. There are many dimensions where level is independent of tech savvy. I'm sure >50% of Fortune 500 CEOs could be tricked in the same way -- at least among the ones who use a computer.
Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#95The article assumes (or at least implies) the secret service member was plugging it into his own personal laptop or something. Why? It may very well be a computer specifically setup to screen devices, including USB drives. It may be a sandboxed and sanitized environment. Or not, but we just don't know, and this article seems a little sensationalist in casting a negative light in the secret service absent details.
If it were set up for this purpose, they wouldn’t have ripped it out in a panic.
Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#96Earlier quoted context omitted.
That's kind of ingenious, but is sending temperature data over USB really such a hard problem in the first place? I'm not really familiar with the USB protocol.
USB doesn't work without a driver and sometimes you don't want to (or can't) install a driver. This sounds like the kind of hack that a clever (but arguably unwise) engineer would shove in to help them remotely troubleshoot a device. "Sensor not detected? OK, open up Notepad and hit Caps Lock three times quickly. Did some text appear? The sensor is fine, the problem is with your computer."
It's not that hard to pick some standard class, like CDC and have a userspace app that uses it just like a serial device. You can get info on which serial device to use via sysfs on Linux.
The rest is just making up a serial protocol.
No need for a special driver.
Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#97Earlier quoted context omitted.
On the "determine if anything suspicious is happening" front, you can configure Wireshark to capture USB packets and show you what is going over the wire.
Oh nice! I've used Wireshark for TCP / UDP captures before but that's about it. Maybe I can use a raspberry pi as burner device and check it out.
That sounds really interesting. You should post later if you go through with your plan!
Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#98The thing that no one seems to point out is that just about any normal person carrying around a windows USB stick is likely to have malware on it. Just possessing a bad USB stick doesn't seem to be particularly incriminating by itself.
True, but there's a lot more going on here than "had a USB stick".
> She was caught by the Secret Service with four cellphones, a laptop, cash, an external hard drive, a signals detector to spot hidden cameras, and a thumb drive.
Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#99It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…
I wish I could upvote this comment twice. At this point in 2019 intelligence gathering and government/corporate security vulnerabilities are much more in the digital realm than physical. Wifi enabled cameras/microphones, cell phones, servers, consumer computers, usb devices, iot devices are all used to that end. We need to hold the flame to OS vendors to handle basic security precautions. It's not like the US governm…
It’s largely shortcomings of “modern” OS designs and hardware. Things like kernel-space drivers and dma for peripherals make it very hard to have any reasonable level of protection.
Re: No one, not even the Secret Service, should randomly plug in a strange USB stick
#100It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…
> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions? For linux you can actually require USB devices to be authorized first by changing a few kernel settings. A friend of mine wrote a few shellscripts a few years ago to do exactly that: https://git.quitesimple.org/usbfilter/tree/ As you can see it's something that's very simple to do, there's just no good "normal user" UI fo…
Better late than never?
https://www.phoronix.com/scan.php?page=news_item&px=Linux-5....