Thought it was a flash drive [video] • Hacker News Board

Re: Thought it was a flash drive [video]

#11

Post by rcfox » Mon, Jun 17, 2019, 2:55 PM UTC

_bxg1 wrote: post #7

As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether. I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what securit…

I once worked at a place where the keyboard and mouse were chained to the tower and glued in place, and the spare USB ports were glued over.

Re: Thought it was a flash drive [video]

#12

Post by fouronnes3 » Mon, Jun 17, 2019, 2:57 PM UTC

_bxg1 wrote: post #7

As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether. I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what securit…

A simple system like android fine grained permissions? is asking to send keyboard input. Allow/Deny?

Re: Thought it was a flash drive [video]

#13

Post by zelon88 » Mon, Jun 17, 2019, 3:01 PM UTC

_bxg1 wrote: post #7

As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether. I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what securit…

I made a script which runs on user logon in my Windows domain and watches for any USB storage device.

It doesn't stop the attack, but in my small(ish) network I can easily recognize unauthorized devices. https://github.com/zelon88/Workstation_USB_Monitor

Re: Thought it was a flash drive [video]

#14

Post by [deleted] » Mon, Jun 17, 2019, 3:04 PM UTC

mikeash wrote: post #9

makepanic wrote: post #3

Earlier quoted context omitted.

It's a USB keyboard that opens types some commands to open a hard-coded website. You can't really prevent that.

You could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses. I don’t know that people would accept this…

[deleted]

Re: Thought it was a flash drive [video]

#15

Post by dijit » Mon, Jun 17, 2019, 3:09 PM UTC

Hasn't this been known for half-a-decade?

I mean, it's a product you can literally buy and it's impossible to adequately defend against.

https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads

https://shop.hak5.org/products/usb-rubber-ducky-deluxe

Re: Thought it was a flash drive [video]

#16

Post by dijit » Mon, Jun 17, 2019, 3:11 PM UTC

zelon88 wrote: post #13

_bxg1 wrote: post #7

As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether. I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what securit…

I made a script which runs on user logon in my Windows domain and watches for any USB storage device. It doesn't stop the attack, but in my small(ish) network I can easily recognize unauthorized devices. https://github.com/zelon88/Workstation_USB_Monitor

I used to do the other way around, and disable all my ports until I knew I needed to use one.

Of course, there's always the possibility that I unlock my port and plug in some infected USB of my own volition and it's much more likely than some random person plugging something in.

But, anyway, this thing presents as a keyboard, not a storage device.

Re: Thought it was a flash drive [video]

#17

Post by paxswill » Mon, Jun 17, 2019, 3:14 PM UTC

AdmiralAsshat wrote: post #4

makepanic wrote: post #3

Earlier quoted context omitted.

It's a USB keyboard that opens types some commands to open a hard-coded website. You can't really prevent that.

This is pretty much the way a Yubikey or other 2FA token works, no? The only difference being that it doesn't send the text until the sensor is covered.

It's one way a Yubikey can work: Yubikey one time password (OTP). The more common (I think? Newer and standardized at least) way (U2F) accesses the key over some other method that doesn't have it act like a keyboard. There are other operation modes for Yubikeys, but personally I only use U2F and the CCID (aka act like a smartcard) modes.

Re: Thought it was a flash drive [video]

#18

Post by zelon88 » Mon, Jun 17, 2019, 3:16 PM UTC

dijit wrote: post #16

zelon88 wrote: post #13

Earlier quoted context omitted.

I made a script which runs on user logon in my Windows domain and watches for any USB storage device. It doesn't stop the attack, but in my small(ish) network I can easily recognize unauthorized devices. https://github.com/zelon88/Workstation_USB_Monitor

I used to do the other way around, and disable all my ports until I knew I needed to use one. Of course, there's always the possibility that I unlock my port and plug in some infected USB of my own volition and it's much more likely than some random person plugging something in. But, anyway, this thing presents as a keyboard, not a storage device.

I thought about disabling ports, and on some machines I do, but for the most part there would be mutiny if people couldn't charge their phones or use USB sticks for legitimate purposes. I try instead to make sure everyone is skeptical and weary of everything technology related+the corporate network.

I'm in the process of creating a USB drop-test script for employee training purposes. Awareness and preparedness training has been one of my best investments of time and energy with a staggering ROI. My team recently passed my last phishing test 100%.

Re: Thought it was a flash drive [video]

#19

Post by fencepost » Mon, Jun 17, 2019, 3:22 PM UTC

There are a variety of physical port blockers available as well as devices to lock cables in place. Some protrude, others are flush and require a key for removal.

If you have business policies and training in place, hopefully the additional steps of removing a lock will also provide time for adequate second thoughts to percolate through those with poor judgment. Malicious actors won't be seriously deterred, but that's a different matter.

Re: Thought it was a flash drive [video]

#20

Post by [deleted] » Mon, Jun 17, 2019, 3:23 PM UTC

fouronnes3 wrote: post #12

_bxg1 wrote: post #7

As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether. I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what securit…

A simple system like android fine grained permissions? is asking to send keyboard input. Allow/Deny?

[deleted]