Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

171–180 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#171

Post by grimgrin »

xkcd-sucks wrote: post #162
01100011 wrote: post #125

Earlier quoted context omitted.

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…

>Am I the only one old enough to remember 'disk bombs' from the 90s where you filled 3.5" floppies with paste made from strike anywhere match heads so when the disk spun up it melted? Damn dude that really worked? I remember reading about it in the anarchist cookbook but didn't go through with the effort after getting thoroughly punked re: smoking banana peels and trying out pressure points on older kids

Just so everyone knows what you smoked:

> 1. Obtain 15 lb. of ripe yellow bananas. 2. Peel the bananas and eat the fruit. Save the skins. 3. With a sharp knife, scrape off the insides of the skins and save the scraped material. 4. Put all scraped material in a large pot and add water. Boil for three to four hours until it has attained a solid paste consistency. 5. Spread this paste on cookie sheets and dry it in an oven for about 20-30 minutes. This will result in a fine black powder (bananadine). Usually one will feel the effects of bananadine after smoking three or four cigarettes.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#172

Post by voltagex_ »

geofft wrote: post #77
the8472 wrote: post #33

Earlier quoted context omitted.

Emulate a MTP device (often used by cameras) and mount with a fuse driver. Since the content on the remote device can change the driver shouldn't be caching it.

Or emulate a network, generate a DHCP response for your favorite /31 and don't send a router, and point a public domain name at the other address in that /31.

Can you elaborate? I understand the concept of RNDIS or CDC devices, but if you've sent an IP address only without a router, how is any traffic going to make it back to the other IP in that subnet? I figure it will go back over the default route, but how are you in control of the traffic itself?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#173

Post by lamontcg »

rblatz wrote: post #5

Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system. “We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.” That's…

My null hypothesis on reading this article is that the Secret Service did exactly what Mr "NSA Hacker" Williams suggested onto an isolated linux laptop -- and in fact this was sophisticated enough malware to start attacking it when it wasn't even mounted. So the agent shut it down and sent it all off to a better equipped lab.

Which is actually pretty sane procedure.

I think techcrunch here is trying to sell us on the idea that we're all smarter than the stupid secret service in order to get clicks through manufactured outrage.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#176

Post by [deleted] »

voltagex_ wrote: post #172
geofft wrote: post #77

Earlier quoted context omitted.

Or emulate a network, generate a DHCP response for your favorite /31 and don't send a router, and point a public domain name at the other address in that /31.

Can you elaborate? I understand the concept of RNDIS or CDC devices, but if you've sent an IP address only without a router, how is any traffic going to make it back to the other IP in that subnet? I figure it will go back over the default route, but how are you in control of the traffic itself?

[deleted]

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#177

Post by tyingq »

Gaelan wrote: post #143
YjSe2GMQ wrote: post #69

Earlier quoted context omitted.

Barcode-as-a-keyboard was one of the vectors that researchers at last CCC used to hack ATMs. End result: show two barcodes, cash gets out. https://media.ccc.de/v/35c3-9761-truly_cardless_jackpotting_... USB is trash for security.

Don’t think that’s a vector per se. The ATM accepts untrusted USB keyboard input (THAT is the bug)—the barcode reader is just a product that happens to make it easy to type in the right series of characters. You could have done the same thing with a normal keyboard (or an Arduino, if you wanted the convenience)

I wouldn't be terribly surprised if you could create a barcode that caused a barcode reader to send +r and run some arbitrary command. So perhaps it wasn't a vector for an ATM, but maybe some other barcode reader where workers scan in arbitrary things they are handed...TSA maybe?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#178

Post by [deleted] »

taneq wrote: post #63
bsder wrote: post #40

Earlier quoted context omitted.

Because Windows, the most popular operating system on the planet, didn't have VCOM drivers by default until Windows 10. This is why everybody tries to piggyback on being a USB HID device.

It did for a few different devices, they could have mimicked one of those. Source: Have plugged several brands of USB-to-COM adapter in to Win 7 / 8.1 and they've "just worked".

[deleted]

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#179

Post by YjSe2GMQ »

tyingq wrote: post #177
Gaelan wrote: post #143

Earlier quoted context omitted.

Don’t think that’s a vector per se. The ATM accepts untrusted USB keyboard input (THAT is the bug)—the barcode reader is just a product that happens to make it easy to type in the right series of characters. You could have done the same thing with a normal keyboard (or an Arduino, if you wanted the convenience)

I wouldn't be terribly surprised if you could create a barcode that caused a barcode reader to send +r and run some arbitrary command. So perhaps it wasn't a vector for an ATM, but maybe some other barcode reader where workers scan in arbitrary things they are handed...TSA maybe?

As far as I remember that's roughly how that exploit against an ATM worked:

https://xlab.tencent.com/badbarcode/

Also, perhaps folks working in data centers can and confirm/deny, but from what I know it's usually strictly forbidden to bring any USB devices into a data center area.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#180

Post by giancarlostoro »

01100011 wrote: post #125
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…

Would plugging it in through a USB hub on an old laptop running Linux not be sufficient?

Edit there is usbguard too:

https://usbguard.github.io/

Post reply on HN