No one, not even the Secret Service, should randomly plug in a strange USB stick • Hacker News Board

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#151

Post by hopler » Tue, Apr 09, 2019, 2:34 AM UTC

jolmg wrote: post #38

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Yubikeys can pretend to be keyboards to type your password. It's a simple way to get maximum compatibility for a hardware key. I imagine there's other legitimate use-cases for non-keyboards to act like keyboards. Still, requiring one to type a password in a newly connected keyboard is a pretty good idea as long as it's a configuration option. I imagine you'd also like something similar for the mouse. Maybe having to…

You only need to authenticate a device once, when you first acquire it, or after it is tainted due to loss of physical control. This is how Bluetooth works today.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#152

Post by taneq » Tue, Apr 09, 2019, 2:39 AM UTC

robertAngst wrote: post #81

taneq wrote: post #62

Earlier quoted context omitted.

USB doesn't work without a driver and sometimes you don't want to (or can't) install a driver. This sounds like the kind of hack that a clever (but arguably unwise) engineer would shove in to help them remotely troubleshoot a device. "Sensor not detected? OK, open up Notepad and hit Caps Lock three times quickly. Did some text appear? The sensor is fine, the problem is with your computer."

why is this unwise?

Because it could lead to all manner of weirdness that the user doesn't expect. Imagine someone trying to type some data into a spreadsheet and every time they hit the capslock key a strange text string appears in the cell, maybe leading to data corruption. Or even worse, it happens in some program where the typed characters are interpreted as hotkeys and instantly perform some unknown combination of actions which the user may or may not even know occurred.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#153

Post by llacb47 » Tue, Apr 09, 2019, 2:41 AM UTC

bdamm wrote: post #19

skywhopper wrote: post #11

it immediately began to install files, a “very out-of-the-ordinary” event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any further corruption of his computer This makes it sound like plugging USB sticks guests are carrying into a computer is standard procedure for the Secret Service. That might make sense if they have some sandboxed computer…

The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still, I'd expect more from the organization, and I bet that the specific agents involved are getting disciplined and trained.

Well, they are supposed to.

"The Secret Service agent who questioned Ms. Zhang after her arrest, Samuel Ivanovich, said during testimony... [h]is four-and-a-half hour interrogation of Ms. Zhang was recorded by video... but it lacked sound because he didn’t realize that the agency’s office in Palm Beach didn’t have that capability." [0]

[0] https://www.nytimes.com/2019/04/08/us/chinese-woman-mar-a-la... ¶12

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#154

Post by cortesoft » Tue, Apr 09, 2019, 2:43 AM UTC

megous wrote: post #96

taneq wrote: post #62

Earlier quoted context omitted.

USB doesn't work without a driver and sometimes you don't want to (or can't) install a driver. This sounds like the kind of hack that a clever (but arguably unwise) engineer would shove in to help them remotely troubleshoot a device. "Sensor not detected? OK, open up Notepad and hit Caps Lock three times quickly. Did some text appear? The sensor is fine, the problem is with your computer."

It's not that hard to pick some standard class, like CDC and have a userspace app that uses it just like a serial device. You can get info on which serial device to use via sysfs on Linux. The rest is just making up a serial protocol. No need for a special driver.

Would this work for every operating system without requiring the user to do anything?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#155

Post by Reelin » Tue, Apr 09, 2019, 2:45 AM UTC

shittyadmin wrote: post #105

lawl wrote: post #53

Earlier quoted context omitted.

> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions? For linux you can actually require USB devices to be authorized first by changing a few kernel settings. A friend of mine wrote a few shellscripts a few years ago to do exactly that: https://git.quitesimple.org/usbfilter/tree/ As you can see it's something that's very simple to do, there's just no good "normal user" UI fo…

Definitely a good start but in a targeted attack scenario that's pretty trivial to bypass, if someone brags about having the latest Das Keyboard or something that's all it'd take... we need cryptographic authentication in the USB specification or at least a randomized serial that'd be unique per device so an attacker would need physical access to clone your keyboard. I believe modern Thunderbolt already has this sort…

It's particularly frustrating because of how trivial the solution appears to be. Trust on first use is more than sufficient in this case, so asymmetric cryptography with a randomized key would be fine. I realize mass produced electronics can be very cost sensitive and that a PKI chip might add a whole $0.70 to your product (https://www.digikey.com/en/product-highlight/a/atmel/atsha20...), but still. I paid ~$50 for my keyboard! I would not have begrudged the manufacturer an extra dollar or two in order to ensure my system's security.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#156

Post by gregmac » Tue, Apr 09, 2019, 2:47 AM UTC

01100011 wrote: post #125

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…

I suspect you're arguing from the point of view of a determined attacker against a specific target, in which case, I agree -- there's an infinite number of different attacks you can try, with the caveat that any failed attempt is possibly going to tip your target off and make them up their opsec game, becoming a much more difficult target.

I took the OP to be talking more about general case. Random people plugging into a public recharge station, using (shady) Amazon/Ebay USB drives, plugging in a "found" USB stick, etc. The OS can at least help thwart simple attacks here.

In the worst case, the device contains a GSM modem which is powered by USB but otherwise only appears to the host as a USB drive -- and if you can get the target to write useful data to it, I guess you have something? That's an awfully expensive attack that I would assume has relatively low chance of yielding something useful. (Unless maybe you market it as a "secure cryptocurrency wallet", and hope you can sell enough to people that then put on enough cryptocurrency to make up for the significant manufacturing expensive which you're able to steal before anyone notices there's a modem in it and sounds the alarm..)

> You could do similar things with a USB stick. You could have a high voltage converter which fries your PC the second you plug it in.

This has not only been done, it is a commercial product: https://usbkill.com/

While being obnoxious and causing one (random?) person some money (presumably they will destroy or throw out this USB drive aftward), it doesn't really get you anything. There's many other cheaper ways to destroy someone's computer, as there are many other things you can destroy to cause a person expense and/or inconvenience.

> Basically, it is always a bad idea to plug in unknown peripherals to your computers. The OS isn't going to save you in all cases.

100% agree, but that doesn't mean it shouldn't try at all.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#157

Post by auslander » Tue, Apr 09, 2019, 2:48 AM UTC

01100011 wrote: post #125

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…

> USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written

I won't copy my data on unknown device. Mics and cameras trigger prompts in MacOS. The keyboard device on the other hand, can be used for 5 seconds walk by attack, running install scripts (Bad USB) attack.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#158

Post by oh_sigh » Tue, Apr 09, 2019, 2:51 AM UTC

identity0 wrote: post #140

oh_sigh wrote: post #137

Earlier quoted context omitted.

Seat belts and airbags don't save you in all cases, but we use them.

That's different. Car crashes are unpreventable, unexpected events that we can prepare for. Plugging random USB stick into your computer is preventable, and adding these safety features may cause people to think it is safe to plug in random USB sticks into their computer.

Most car crashes are extremely preventable. Do some people not drive more dangerously because they believe themselves to be safe because of things like seat belts?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#159

Post by Reelin » Tue, Apr 09, 2019, 2:59 AM UTC

hopler wrote: post #141

Reelin wrote: post #135

Earlier quoted context omitted.

As far as I understand it, this already is on by default for ChromeOS. The kernel patches make it possible to utilize internal USB devices during the boot process without disabling protection - ie there's no vulnerability window prior to user space being up and running. I believe the major missing piece for desktop Linux at this point is that many input devices (including my own) are USB based. Without a way for the…

The only reason your laptop is trusted is because you trust the person who gave you the laptop. The same threat model applies to the first keyboard you get for your desktop. Neither laptop/desktop nor keyboard is inherently more trustworthy.

I'm not worried about the keyboard I purchased or my hardware vendor. Well I am, but far less so than the prospect of a foreign USB device being plugged in and managing to execute malicious code. Think someone quickly inserting a device as they walk by, secretly swapping out one of my peripherals while I'm not around, or similar. Authorization on first use is more than sufficient to mitigate this type of attack, and if you add end-to-end encryption you can also prevent USB keyloggers.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#160

Post by Terr_ » Tue, Apr 09, 2019, 3:03 AM UTC

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password

Probably easier/safer to display a random number on-screen and then ask the user to retype it into the device. I figure numbers are less likely to run into problems when the keyboard isn't US-standard QWERTY.

For more paranoia/portability, show the user a repeating rhythm-game and wait for them to hit any keys they want as long as it is close enough to the correct pattern. ("Shave and a haircut... two bits!")

You could also use audio output for the user to hear, but then the attacker could embed a tiny microphone in the USB stick...