111–120 of 231 posts
The thing that no one seems to point out is that just about any normal person carrying around a windows USB stick is likely to have malware on it. Just possessing a bad USB stick doesn't seem to be particularly incriminating by itself.
True, but there's a lot more going on here than "had a USB stick". > She was caught by the Secret Service with four cellphones, a laptop, cash, an external hard drive, a signals detector to spot hidden cameras, and a thumb drive.
Earlier quoted context omitted.
Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…
The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.
It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…
Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need protection from advanced thieves you'll need to go through some extra hoops anyway. You could petition OS manufacturers to focus more on physical security, but there's limits to what you can do without piles of abstractions (ala smart phone security)
Okay, please explain a little more. I'll give you a concrete example of a device to work with.
Last week I accidentally left my usb flash drive at a coffee shop with some important files on it. When I went back, the coffee shop had it in the lost and found. It looks the same on the outside, but it's a mass-produced model.
How do a vet this hardware before plugging it into my computer? I do need to access the files on it, but also attackers may have had access to it for several hours.
Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system. “We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.” That's…
I found that statement surprising. For industrial or nation state spionage I would expect people to target linux in 2019
Earlier quoted context omitted.
The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.
Before chip embedded credit/debit cards were prevalent, most magnetic strip reader (MSR) peripherals would often operate as a USB keyboard. It allows them to work with web app based POS systems without requiring things like ActiveX.
Earlier quoted context omitted.
If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.
Hasn't the security by obscurity myth been debunked, and furthermore hasn't government proven itself utterly incompetent at designing products?
You mean like SELinux? Or SE Android? Or the STIGs?
It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…
You can lockdown USB access on linux with usbguard[0]. IIRC windows 10 enterprise also has some USB whitelist feature somewhere. [0] https://usbguard.github.io/
Earlier quoted context omitted.
Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need protection from advanced thieves you'll need to go through some extra hoops anyway. You could petition OS manufacturers to focus more on physical security, but there's limits to what you can do without piles of abstractions (ala smart phone security)
> it's your responsibility to vet what you plug into it Okay, please explain a little more. I'll give you a concrete example of a device to work with. Last week I accidentally left my usb flash drive at a coffee shop with some important files on it. When I went back, the coffee shop had it in the lost and found. It looks the same on the outside, but it's a mass-produced model. How do a vet this hardware before pluggi…
Or just go to an "Internet Cafe" and do it there.
Earlier quoted context omitted.
The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.
I was delighted about this when a client wanted a barcode scanner integrated with a web app. I envisioned major difficulties but instead it only took 5 minutes to implement.