Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

101–110 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#101

Post by peterwwillis »

gowld wrote: post #90
peterwwillis wrote: post #31

Earlier quoted context omitted.

Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need protection from advanced thieves you'll need to go through some extra hoops anyway. You could petition OS manufacturers to focus more on physical security, but there's limits to what you can do without piles of abstractions (ala smart phone security)

A human cannot vet an electronic device. We can only interface to it from another electronic device. The same argument applies to the Internet -- we don't say that it's the human's responsibility to vet every website or email message before we let our computer connect to it. We expect our computer to do that. That's why it was wrong for Outlook to automatically execute every program sent to you via email.

Your computer isn't vetting things it gets from the internet at all, with the exception of TLS certs and anti-virus scanning. Virtually all other operations done with remote content are unvetted; it's play & pray. You clicking a button is the only vetting process.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#102

Post by bsder »

taneq wrote: post #63
bsder wrote: post #40

Earlier quoted context omitted.

Because Windows, the most popular operating system on the planet, didn't have VCOM drivers by default until Windows 10. This is why everybody tries to piggyback on being a USB HID device.

It did for a few different devices, they could have mimicked one of those. Source: Have plugged several brands of USB-to-COM adapter in to Win 7 / 8.1 and they've "just worked".

Somebody, somewhere had to install a driver. And, because you could never count on it, you can't design to it.

Now, since most things use a Prolific chip, you only have to install the driver for one device and you pick up a ton of them.

But it has to be installed by somebody, and that means all of the silliness that goes along with Windows driver installation.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#103

Post by NikkiA »

verst wrote: post #87
depressed wrote: post #64

Earlier quoted context omitted.

On the "determine if anything suspicious is happening" front, you can configure Wireshark to capture USB packets and show you what is going over the wire.

Oh nice! I've used Wireshark for TCP / UDP captures before but that's about it. Maybe I can use a raspberry pi as burner device and check it out.

A pi zero would do the job and only risk about $5 to find out what's on the stick.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#105

Post by shittyadmin »

lawl wrote: post #53
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions? For linux you can actually require USB devices to be authorized first by changing a few kernel settings. A friend of mine wrote a few shellscripts a few years ago to do exactly that: https://git.quitesimple.org/usbfilter/tree/ As you can see it's something that's very simple to do, there's just no good "normal user" UI fo…

Definitely a good start but in a targeted attack scenario that's pretty trivial to bypass, if someone brags about having the latest Das Keyboard or something that's all it'd take... we need cryptographic authentication in the USB specification or at least a randomized serial that'd be unique per device so an attacker would need physical access to clone your keyboard.

I believe modern Thunderbolt already has this sort of cryptographic device authentication, which means not only physical access but at least a bit of reverse engineering skill, a much higher barrier than knowing their keyboard model.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#106

Post by ComputerGuru »

taneq wrote: post #62
conistonwater wrote: post #57

Earlier quoted context omitted.

That's kind of ingenious, but is sending temperature data over USB really such a hard problem in the first place? I'm not really familiar with the USB protocol.

USB doesn't work without a driver and sometimes you don't want to (or can't) install a driver. This sounds like the kind of hack that a clever (but arguably unwise) engineer would shove in to help them remotely troubleshoot a device. "Sensor not detected? OK, open up Notepad and hit Caps Lock three times quickly. Did some text appear? The sensor is fine, the problem is with your computer."

USB can and does work without custom drivers. It's the raison d'etre for HID.

But that requires custom software to interface with it and parse the data or make payload requests and developers are that lazy.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#107

Post by admax88q »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Problem is some of the vulnerabilities can be in the USB controller firmware itself.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#108

Post by SolarNet »

_rs wrote: post #60
rblatz wrote: post #5

Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system. “We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.” That's…

Are there any open-source or commercial systems that do anything close to this? Does there exist such a forensically sound OS that should be used? The best I've found for disk imaging is using Windows Enterprise (or similar, stripped down) with SafeBlock, but that seems less than ideal. I'd love to find a *nix alternative.

An out of the box Linux installation with a few changes should be enough. Though you should probably use a hardened distribution. The above poster basically listed the final steps. Go to the kernel and build a white list of valid USB devices (the machine's keyboard and mouse) to prevent it from talking to a "keyboard" you plug in. Turn off auto-mounting features, record traffic so you can double check. And keep the machine physically airgaped.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#109

Post by joering2 »

ceejayoz wrote: post #98
Taniwha wrote: post #55

The thing that no one seems to point out is that just about any normal person carrying around a windows USB stick is likely to have malware on it. Just possessing a bad USB stick doesn't seem to be particularly incriminating by itself.

True, but there's a lot more going on here than "had a USB stick". > She was caught by the Secret Service with four cellphones, a laptop, cash, an external hard drive, a signals detector to spot hidden cameras, and a thumb drive.

That's exactly how I travel to tech-related summits around the world, and I have nothing to do with espionage I assure you.

I have 3 cellphones - one private (family calls, face time etc), one CDMA phone and one separate GSM for the most of EU countries. And external SSD drive with all my important backups and projects that would take forever to download off of DropBox. And yes - recently even cheap signal detector, as I don't want to be watched in my hotel room, even only for "security reasons" as to whether I will demolish the room or not. (call me paranoid but so was I before Snowden files and I was proven right)

I usually carry about $3,000 USD total in different currency - usually 20% AUD, 20% CAD, 30% USD and rest EUR/GBP. Trust me so many times paying with cash comes to be much cheaper, and at some occasions the only way to go!

Yes, thumb drive too; usually empty so that if I am at the meeting and someone wants to send me some heavy files, I can give them my thumb and viola!

If all this makes me a spy then I definitely need to change my profession :|

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#110

Post by flukus »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system.

Universal plug'n'play is USB's reason for existence, if it can't do that then maybe we should step away from USB itself. Back when keyboards were plugged into PS/2 ports I didn't have to worry a floppy disk would emulate one (ignoring autorun). I'm sure it's possible to have a malicious PS/2 device, but having it plug into the keyboard port would at least indicate what it's going to do.

Post reply on HN