Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

221–230 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#221

Post by tastroder »

im3w1l wrote: post #115
rblatz wrote: post #5

Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system. “We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.” That's…

> While there is still a very small risk that the malware targets Linux I found that statement surprising. For industrial or nation state spionage I would expect people to target linux in 2019

Why? At least around here both of those sectors are still dominated by Windows with very few exceptions. Plus, in the specific incident, we're talking about a ressort. The likelihood of that having valuable targets for data exfiltration running anything other would be slim to none (with maybe the exception of the odd router, wifi AP or similar that you'd have to know details off beforehand to attack).

Also keep in mind that the most likely accessible targets would be end user type machines, in that area I'd understand if you carry something exploiting a Mac but Linux? That's just virtual dead weight.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#223

Post by tastroder »

rblatz wrote: post #5

Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system. “We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.” That's…

I'm honestly surprised by the statement you quoted. You don't plug a random piece of evidence into your PC, not even for analysis, not even on a pseudo-isolated thing. From what I've seen in the private space you'd at least use something like a Logicube Talon/Falcon or similar device that is certified for forensic use and get an image of that storage medium, then you'd analyse that image.

edit: looks like their products have another name nowadays, basically something that's forensically sound and allows you to create storage images

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#224

Post by mcv »

bdamm wrote: post #15
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

Seems like the core problem is a single standard for many different kinds of devices, which makes it possible for devices to act totally different from what it physically appears to be.

Maybe we should have stuck to PS/2 keyboards after all.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#225

Post by jolmg »

robertAngst wrote: post #82
q3k wrote: post #17

Earlier quoted context omitted.

>It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions? Because up until 10 years ago, developing your own USB device was generally expensive and malicious devices ended up being out of scope in threat modelling. In addition, some models these days still define 'physical access == game over'...

>USB device was generally expensive How expensive? USB is a protocol, a micro, and some power management. How long ago was this 'out of scope'?

I imagine he means before the advent of 3d printing, services like PCBWay, products like Arduino, and online stores like DigiKey. It's probably much easier to make one's own devices today than it was when USB was first being designed.

He's also right about the physical access thing. Fundamentally, it doesn't make much sense to add protections against scenarios where the attacker apparently needs physical access, because there's no way to protect against all things he could possibly do then. It's not really obvious that the user needs protecting from himself as he plugs in a device of doubtful origins. We used to hold the user to higher standards.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#226

Post by grifball »

can't ctrlf on my phone, but I didn't see usbfilter yet https://davejingtian.org/2016/08/04/making-usb-great-again-w... might take some advanced tech skills to install, but this is the only way to be theoretically secure against the most powerful attack vector of these types of attacks, which is to act as an HID and input malware into the computer. basically, you flag a physical USB port as being data-storage-only and your os will prevent any device being plugged into that port as being recognized as a mouse or keyboard or any other powerful USB device.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#227

Post by tedmiston »

kweks wrote: post #32
AlphaWeaver wrote: post #10

Earlier quoted context omitted.

For people unfamiliar with this strategy, check out a commercialized version, the USB Rubber Ducky. https://shop.hak5.org/products/usb-rubber-ducky-deluxe

Or the USBNinja that crams that functionality into a cable identical to major vendors, and is triggerable up to 100m away via Bluetooth.... https://lab401.com/products/usbninja

That is terrifying

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#228

Post by the8472 »

geofft wrote: post #77
the8472 wrote: post #33

Earlier quoted context omitted.

Emulate a MTP device (often used by cameras) and mount with a fuse driver. Since the content on the remote device can change the driver shouldn't be caching it.

Or emulate a network, generate a DHCP response for your favorite /31 and don't send a router, and point a public domain name at the other address in that /31.

I'm not sure if you are serious. My goal was to use an USB device standard for which open source drivers exist and which doesn't open security holes by allowing it into your system.

MTP devices are ~mostly harmless~ and relatively easy to trust. Network devices are not.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#230

Post by jimrandomh »

Terr_ wrote: post #160
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password Probably easier/safer to display a random number on-screen and then ask the user to retype it into the device. I figure numbers are less likely to run into problems when the keyboard isn't US-standard QWERTY. For more paranoia/portability, show the user a repeating rhyt…

The reason for it to be the user's login password is that, in the common case where you plug a keyboard into a computer that's just booted or which has been unattended for awhile, you're already typing a login password, so it isn't making you do anything you weren't doing already.
Post reply on HN