Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

201–210 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#201

Post by romanovcode »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Because then mouse, keyboard and other devices will not automatically work when you plug them in and 99% of users will hate that.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#202

Post by sokoloff »

YjSe2GMQ wrote: post #179
tyingq wrote: post #177

Earlier quoted context omitted.

I wouldn't be terribly surprised if you could create a barcode that caused a barcode reader to send +r and run some arbitrary command. So perhaps it wasn't a vector for an ATM, but maybe some other barcode reader where workers scan in arbitrary things they are handed...TSA maybe?

As far as I remember that's roughly how that exploit against an ATM worked: https://xlab.tencent.com/badbarcode/ Also, perhaps folks working in data centers can and confirm/deny, but from what I know it's usually strictly forbidden to bring any USB devices into a data center area.

We use USB drives as installers and, in some cases, as boot volumes. (And of course keyboards and mice on crash carts and USB serial ports for laptops.)

We’re not a cloud provider, but I’ve been in lots of DCs and seen plenty of USB devices.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#203

Post by j16sdiz »

jakeinspace wrote: post #9
steven777400 wrote: post #3

I don't know much about this case but depending on the level of concern, even just plugging the device into a safe, isolated machine and performing an image may be insufficient. You could imagine a USB device that presented as a harmless file store unless certain conditions were detected, in which case the device could re-present as a keyboard (providing pre-programmed keystrokes) or potentially a bluetooth or wirele…

I can't think of many things more fun than coming up with some clever USB descriptor hacks to allow an innocuous drive full of pictures of grandchildren to carefully switch into an HID device when it thinks the coast is clear. I have to imagine there's a lot of little tricks you could implement which would be difficult to trigger in a sandbox and might require dumping the EEPROM (if that's possible).

There are quite a few usb descriptor related exploits.

e.g. https://www.cvedetails.com/cve/CVE-2013-3200/

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#204

Post by itronitron »

kyle-rb wrote: post #85
jimrandomh wrote: post #48

Earlier quoted context omitted.

You misunderstand. Malicious USB devices often present themselves to computers as keyboards, which type malicious commands. But they don't look like keyboards, or have keys on them; they usually look like USB storage devices.

Now I'm imagining someone dropping malicious keyboards instead of USB sticks, waiting for people to pick them up and plug them into their computers.

They don't drop them but instead ship them to arrive for Friday delivery. Over the course of the weekend the malicious keyboard cuts its way out of the shipping envelope and scans the target office for the nearest USB port. More recent models will shove the existing keyboard behind the desk, like a Cuckoo chick does with any remaining eggs after hatching.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#205

Post by gambiting »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

I'd like to point out that nearly every single USB barcode scanner shows up as a keyboard to the operating system. Your point of sale system has to have focus on the field awaiting input and then when you scan a barcode it just "types in" the scanned number. What you are suggesting would immediately brake compatibility with a huge number of devices out there.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#207

Post by noir_lord »

bdamm wrote: post #15
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

I've use those as well, bit of a pain to work with in non keyboard mode but they are at least accurate enough.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#208

Post by ololobus »

hopler wrote: post #138
01100011 wrote: post #125

Earlier quoted context omitted.

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…

This is why Steve Jon's wanted all peripherals wireless ;-) www.fiftythree.org/etherkiller/ Miniaturized wireless electronics is the Ice IX that will destroy civilization wikipedia.org/wiki/Ice_IX

Off topic, but my life will never be the same again, there are 18 types of crystalline water ice and one amorphous! [1]

[1] https://en.wikipedia.org/wiki/Ice#Phases

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#209

Post by russdill »

bdamm wrote: post #15
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

You can actually use the USB hid class to present pretty much any data in any way you want. The reason they present as a keyboard is probably so they don't need to worry about drivers. With newer versions of windows I think you can work with such hid devices without special drivers though.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#210

Post by russdill »

tropo wrote: post #73
steven777400 wrote: post #3

I don't know much about this case but depending on the level of concern, even just plugging the device into a safe, isolated machine and performing an image may be insufficient. You could imagine a USB device that presented as a harmless file store unless certain conditions were detected, in which case the device could re-present as a keyboard (providing pre-programmed keystrokes) or potentially a bluetooth or wirele…

Suppose it is just harmless to the computer, but it uses the USB port to power something else. It could contain a microphone and a transmitter. A more evil device, for assassination, could contain explosives or nerve gas. Plugging in the device is fatal.

Great plot device. When a certain file is opened, the nerve gas is released. Or when a file is saved with certain text or properties (author, etc).

However, I'm doubtful that a small USB drive would have enough volume to be effective. Wouldn't matter on TV though.

Post reply on HN