Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

121–130 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#121

Post by Godel_unicode »

jimrandomh wrote: post #41
pilsetnieks wrote: post #14

Earlier quoted context omitted.

Because very many people (and more importantly, businesses) have obscure buggy printers from the 90s or the equivalent thereof.

The key thing to realize is that malicious USB devices get to choose which device they identify themself as to the operating system, but have much less control over what they physically look like to the user. If you plug in an old printer, you know you just plugged in an old printer; you can load the old-printer device driver and it probably won't exploit it. But if you plug in a USB stick you found in the parking lo…

You are putting way, way too much faith in the average user. See, for instance, TLS exceptions. Also, realize that all the adversary needs to do is some trivial social engineering. A label on the thumb drive with a picture of the prompt and a mouse over "ok" would probably do it.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#122

Post by jimrandomh »

Reelin wrote: post #100
lawl wrote: post #53

Earlier quoted context omitted.

> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions? For linux you can actually require USB devices to be authorized first by changing a few kernel settings. A friend of mine wrote a few shellscripts a few years ago to do exactly that: https://git.quitesimple.org/usbfilter/tree/ As you can see it's something that's very simple to do, there's just no good "normal user" UI fo…

Better late than never? https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.... https://usbguard.github.io

That's definitely progress, but there's more work needed to make it usable enough to be on by default.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#123

Post by pryce »

gowld wrote: post #94
meowface wrote: post #24

Earlier quoted context omitted.

I can totally buy some low-level Secret Service agent with little tech knowledge plugging it into a machine without thinking twice.

Or a high-level agent. There are many dimensions where level is independent of tech savvy. I'm sure >50% of Fortune 500 CEOs could be tricked in the same way -- at least among the ones who use a computer.

The only prominent former Secret Service agent I'm aware of is Dan Bongino. After viewing his output over the last couple of years, I have developed a fairly low opinion of whether a Secret Service agent chosen at random is likely to display any real insightfulness. I'm sure they're quite well trained for physical combat though.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#124

Post by aaron695 »

This is the most ridiculous pile of rubbish I've ever read.

Do we serious think every time the Secret Service comes across a person they should spend hundreds of thousands of $ forensically analysing all their electronics?

This was a random person who was in a resort. Nothing more.

You check them out, open their phone, check their usb, check their laptop and move on, or investigate further if they seem suspicious.

The total lack of computer literacy here is amazing.

Garbage like this is straight out of a hollywood movie "threatened his own computing system and possibly the rest of the Secret Service network."

The Secret Service are human beings their kids will use their laptops, do we understand this as IT professionals? Or we living in gaga land of Hollywood?

It's up to their experienced network IT staff to contain their network at differing levels and a laptop in the field should be considered compromised.

Should they also have locked this lady down in a bio security suit in case she was carrying biological weapons? Is any other field as stupidly impractical as computer security 'experts'?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#125

Post by 01100011 »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an software defined radio which could execute arbitrary bluetooth and WiFi attacks while allowing remote control via RF.

Am I the only one old enough to remember 'disk bombs' from the 90s where you filled 3.5" floppies with paste made from strike anywhere match heads so when the disk spun up it melted? You could do similar things with a USB stick. You could have a high voltage converter which fries your PC the second you plug it in.

Basically, it is always a bad idea to plug in unknown peripherals to your computers. The OS isn't going to save you in all cases.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#126

Post by netwanderer3 »

Many voting machines being used still have USB ports wide open. It's absolutely horrifying!

I also don't like the new design of Macbook in which they merged the USB port and charging port into one. This really opens up huge security risks in my opinion.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#127

Post by pryce »

verst wrote: post #52

I have a mysterious USB stick I received as a thank you from a delegation of the Chinese department of Customs (中华人民共和国海关总署) after presenting to them in Palo Alto. The USB is branded with the Chinese Customs logo and their slogan. I haven't dared plugging this in. First and foremost I'm afraid it isn't standards compliant and will somehow fry my motherboard, secondly I don't have a burner device and the necessary kno…

Given what happens to USB sticks in my household (needed fairly often), you may still be at risk of a family member opening it and using it should they need one in a pinch.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#128

Post by anonoholic »

I was surprised from the get-go that no-one seem to be talking about the legality of an ad-hoc search of a USB thumb-drive.

The stupidity of it (from an infosec standpoint) should be a given, yet this aspect appears to be the focus of the debate.

Am I missing something?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#129

Post by i_feel_great »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

In BSDs and Linux, you can recompile the kernel without USB support. But then you will have to go back to using a PS/2 keyboard and mouse.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#130

Post by meowface »

gowld wrote: post #94
meowface wrote: post #24

Earlier quoted context omitted.

I can totally buy some low-level Secret Service agent with little tech knowledge plugging it into a machine without thinking twice.

Or a high-level agent. There are many dimensions where level is independent of tech savvy. I'm sure >50% of Fortune 500 CEOs could be tricked in the same way -- at least among the ones who use a computer.

Absolutely. I was just thinking, perhaps naively, that a high-level Secret Service agent would be a bit more cautious and would think "I better report this thing to my superiors and not touch it at all, just in case", even if they know nothing about technology. You want cautious and paranoid people in a job like that.
Post reply on HN