Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

181–190 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#181
post #19

it immediately began to install files, a “very out-of-the-ordinary” event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any further corruption of his computer This makes it sound like plugging USB sticks guests are carrying into a computer is standard procedure for the Secret Service. That might make sense if they have some sandboxed computer…

The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still, I'd expect more from the organization, and I bet that the specific agents involved are getting disciplined and trained.

Outside the Silicon Valley bubble, cybersecurity means Windows antivirus products, password policies, caution around unsolicited email, etc. Maybe the most sophisticated users of the term have a dim idea of what encryption means. When a government agency has "sophisticated cyber capabilities" I would generally take that to mean reams of paperwork asserting that Norton is properly installed on every desktop.

The whole dimension of vulnerabilities and exploits, protocol flaws, trust boundaries, techniques for selecting or creating less vulnerable software, getting crypto implementation details right, principle of least privilege... none of that stuff even registers. I briefly worked in an IT consulting company that sold security and PCI compliance services; nobody was talking about any of that stuff. It was all password policies, antivirus products, phishing awareness campaigns.

The government definitely has real computer security engineering work happening in the NSA, NIST (FIPS 140-2 in particular is no joke), and other very high end defense-related areas. But I would not generally expect people using the word "cyber" to have a fighting chance against a nation-state-level evil USB stick.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#182

Earlier quoted context omitted.

That's different. Car crashes are unpreventable, unexpected events that we can prepare for. Plugging random USB stick into your computer is preventable, and adding these safety features may cause people to think it is safe to plug in random USB sticks into their computer.

Most car crashes are extremely preventable. Do some people not drive more dangerously because they believe themselves to be safe because of things like seat belts?

You are so right. I never understood the prevalent idea that traffic accidents are somehow random rolls of the dice. Seemingly the vast majority of them are not. Adjust your speed, not too fast, not too slow; stay focused on road, mirrors, and other traffic; keep your distance; don't be drunk; don't fall asleep; know and follow the rules, and you will hugely reduce your risk of harm.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#184

Shouldn't preventing this be as easy as turning off autorun? In fact, I thought Windows had that off by default for USB devices. (Of course, I'm assuming we're not dealing with a zero-day in the USB stack or filesystem drivers. But that probably is something that the Secret Service should be on top of, as well.)

Good question. As I understand it, the USB stick can present itself as a keyboard, which is automatically mounted, and begins entering a series of keystrokes that program the system to compromise itself. In essence, modern OS's give "autorun" privilege to keyboards and mice. That's the HID in this discussion -- Human Interface Device.

Aha, I missed that piece of the puzzle. Thank you.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#185
post #78
post #49

Earlier quoted context omitted.

Well, the head of USSS was fired today. Unclear if it's related.

I'm of the opinion that a POTUS that carries a unsecured iPhone against the recommendations of his staff (and overrules their security clearance decisions for his son-in-law) isn't going to fire anyone due to quibbles over OPSEC.

Generally agree. One thing can nevertheless be used as an excuse for the others, as certain little aides carry out their certain little agendas.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#186

I don't know much about this case but depending on the level of concern, even just plugging the device into a safe, isolated machine and performing an image may be insufficient. You could imagine a USB device that presented as a harmless file store unless certain conditions were detected, in which case the device could re-present as a keyboard (providing pre-programmed keystrokes) or potentially a bluetooth or wirele…

This sounds like an effective way to stall investigations for months in exchange for a movie plot threat scenario.

"Boss, the electron microscope reverse engineering from that USB stick 6 months ago came back. They said they didn't find anything out of ordinary. The bill is $400k. But I guess we can start analyzing the contents now.".

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#187

Earlier quoted context omitted.

It just made a little fire, it didn't "explode". It would melt your floppy drive and make it useless but wouldn't come close to doing enough damage to hurt anyone unless they had their face a few inches from the front of the PC.

Unless the strike surface also contained an accelerant, as well as the igniter...:)

I'm guessing that there are plenty of things that would fit in the floppy and cause serious damage. Mercury fulminate maybe, or ammonium triiodide(?), assuming they didn't just self-detonate.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#189

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

In BSDs and Linux, you can recompile the kernel without USB support. But then you will have to go back to using a PS/2 keyboard and mouse.

In Linux, you don't even need to recompile the kernel. You can simply pass the "nousb" parameter at boot.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#190

Earlier quoted context omitted.

>Am I the only one old enough to remember 'disk bombs' from the 90s where you filled 3.5" floppies with paste made from strike anywhere match heads so when the disk spun up it melted? Damn dude that really worked? I remember reading about it in the anarchist cookbook but didn't go through with the effort after getting thoroughly punked re: smoking banana peels and trying out pressure points on older kids

Just so everyone knows what you smoked: > 1. Obtain 15 lb. of ripe yellow bananas. 2. Peel the bananas and eat the fruit. Save the skins. 3. With a sharp knife, scrape off the insides of the skins and save the scraped material. 4. Put all scraped material in a large pot and add water. Boil for three to four hours until it has attained a solid paste consistency. 5. Spread this paste on cookie sheets and dry it in an o…

https://en.wikipedia.org/wiki/Bananadine

Bananadine is a fictional psychoactive substance which is supposedly extracted from banana peels.

Post reply on HN