Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

211–220 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#211

Post by InitialLastName »

oarsinsync wrote: post #193
bsder wrote: post #102

Earlier quoted context omitted.

Somebody, somewhere had to install a driver. And, because you could never count on it, you can't design to it. Now, since most things use a Prolific chip, you only have to install the driver for one device and you pick up a ton of them. But it has to be installed by somebody, and that means all of the silliness that goes along with Windows driver installation.

FTDI chips have their driver deployed by default on most Windows, Mac and Linux installs. It's nice being able to buy a USB/serial cable and it just work, without needing to deploy any drivers at all. Check it out!

IIRC the FTDI chips use a non-standard com driver on Win 7. IF you want your device (with your VID and PID) to show up as a serial port, you need to associate your device with the usbserial driver, which at the very least requires a custom .inf.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#212

Post by InitialLastName »

interfixus wrote: post #182
oh_sigh wrote: post #158

Earlier quoted context omitted.

Most car crashes are extremely preventable. Do some people not drive more dangerously because they believe themselves to be safe because of things like seat belts?

You are so right. I never understood the prevalent idea that traffic accidents are somehow random rolls of the dice. Seemingly the vast majority of them are not. Adjust your speed, not too fast, not too slow; stay focused on road, mirrors, and other traffic; keep your distance; don't be drunk; don't fall asleep; know and follow the rules, and you will hugely reduce your risk of harm.

> I never understood the prevalent idea that traffic accidents are somehow random rolls of the dice.

It's pushed by the auto manufacturers and insurance companies to normalize driving and make you pay for more expensive safety features. If people drive irresponsibly enough to wreck their cars, but not enough to kill themselves (modulo the safety level of their car), they buy more cars and spend more money on car insurance.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#213

Post by delinka »

jimrandomh wrote: post #48
delinka wrote: post #43

Earlier quoted context omitted.

great, now I've typed my password into what turned out to be a malicious device ...

You misunderstand. Malicious USB devices often present themselves to computers as keyboards, which type malicious commands. But they don't look like keyboards, or have keys on them; they usually look like USB storage devices.

You misunderstand. Start forcing me to type my password as the first thing into a new keyboard, and now malicious keyboards can be certain that the first characters up to are a valid password for the device in question.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#214

Post by HocusLocus »

sokoloff wrote: post #202
YjSe2GMQ wrote: post #179

Earlier quoted context omitted.

As far as I remember that's roughly how that exploit against an ATM worked: https://xlab.tencent.com/badbarcode/ Also, perhaps folks working in data centers can and confirm/deny, but from what I know it's usually strictly forbidden to bring any USB devices into a data center area.

We use USB drives as installers and, in some cases, as boot volumes. (And of course keyboards and mice on crash carts and USB serial ports for laptops.) We’re not a cloud provider, but I’ve been in lots of DCs and seen plenty of USB devices.

I'd love to have a crash cart. I'd spend all day crashing it into other carts.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#215

Post by thinkingemote »

ceejayoz wrote: post #98
Taniwha wrote: post #55

The thing that no one seems to point out is that just about any normal person carrying around a windows USB stick is likely to have malware on it. Just possessing a bad USB stick doesn't seem to be particularly incriminating by itself.

True, but there's a lot more going on here than "had a USB stick". > She was caught by the Secret Service with four cellphones, a laptop, cash, an external hard drive, a signals detector to spot hidden cameras, and a thumb drive.

Most of that is what was in her hotel room, not what she was caught with.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#216

Post by megous »

cortesoft wrote: post #154
megous wrote: post #96

Earlier quoted context omitted.

It's not that hard to pick some standard class, like CDC and have a userspace app that uses it just like a serial device. You can get info on which serial device to use via sysfs on Linux. The rest is just making up a serial protocol. No need for a special driver.

Would this work for every operating system without requiring the user to do anything?

Well, define "work", "every operating system", and "requiring user to do anythig".

:D Obviously you have to consider needs of your users as an engineer, when chosing any technology, for their particular problem.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#217

Post by rootlocus »

> “It’s entirely possible that the sensitivities over determining whether Zhang was targeting Mar-a-Lago or the president — or whether she was a legitimate guest or member — may have contributed to the agent’s actions on the ground,”

Plot twist: she was a legitimate member with a personal malware ridden usb stick she wasn't aware was infected. /joke

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#218

Post by inetknght »

auslander wrote: post #157
01100011 wrote: post #125

Earlier quoted context omitted.

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…

> USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written I won't copy my data on unknown device. Mics and cameras trigger prompts in MacOS. The keyboard device on the other hand, can be used for 5 seconds walk by attack, running install scripts (Bad USB) attack.

> Mics and cameras trigger prompts in MacOS.

That's assuming it presents itself as a mic or camera. What's to say it can't have the hardware embedded in the device but not present it to the host machine? Then any exfiltration technique can get a direct look into audio/video of the area.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#219

Post by [deleted] »

novaleaf wrote: post #83
bdamm wrote: post #15

Earlier quoted context omitted.

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

funny thing: my UPS also presents as a keyboard. and made my computer kept waking up from sleep at random intervals. Very hard to troubleshoot.

[deleted]

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#220

Post by tonyarkles »

cortesoft wrote: post #154
megous wrote: post #96

Earlier quoted context omitted.

It's not that hard to pick some standard class, like CDC and have a userspace app that uses it just like a serial device. You can get info on which serial device to use via sysfs on Linux. The rest is just making up a serial protocol. No need for a special driver.

Would this work for every operating system without requiring the user to do anything?

It was a long time ago, but I’m pretty sure CDC doesn’t auto-enumerate on Windows. Mac and Linux is fine. I think you still need a .inf for Windows, and for it to work generally, you need WHQL signing ($$, time).

The free (money-wise) approach we ended up doing was to use WinUSB and marking the device as “vendor specific”, and using libusb to talk directly to it. That was a bit awkward, but covered Windows, Linux, and OSX for us.

This was 5 years ago though. Windows 10 might directly support generic CDC devices, but Win 8.1 didn’t.

Edit: sibling mentions HID. HID does work like this, but we needed more bandwidth than HID provided. CDC was perfect for what we were doing but it didn’t auto install. Mass storage auto-installs but didn’t fit what we were doing.

Post reply on HN