Thought it was a flash drive [video]

Post by fencepost » Mon, Jun 17, 2019, 3:29 PM UTC

zelon88 wrote: post #18

dijit wrote: post #16

Earlier quoted context omitted.

I used to do the other way around, and disable all my ports until I knew I needed to use one. Of course, there's always the possibility that I unlock my port and plug in some infected USB of my own volition and it's much more likely than some random person plugging something in. But, anyway, this thing presents as a keyboard, not a storage device.

I thought about disabling ports, and on some machines I do, but for the most part there would be mutiny if people couldn't charge their phones or use USB sticks for legitimate purposes. I try instead to make sure everyone is skeptical and weary of everything technology related+the corporate network. I'm in the process of creating a USB drop-test script for employee training purposes. Awareness and preparedness traini…

Post by fouronnes3 » Mon, Jun 17, 2019, 3:32 PM UTC

Wowfunhappy wrote: post #22

fouronnes3 wrote: post #12

Earlier quoted context omitted.

A simple system like android fine grained permissions? is asking to send keyboard input. Allow/Deny?

This strikes me as the right solution, with two caveats: • It should allow the keyboard through—or have a timeout that defaults to "yes"—if a mouse or keyboard is not already connected. • I should have the option to disable it.

Post by swiley » Mon, Jun 17, 2019, 3:40 PM UTC

NikolaeVarius wrote: post #24

At Defcon, a buddy of mine screwed around with a bluetooth HID device, that when connected to, would automatically attempt to open a webpage and send them to an innocuous site (Which obviously could have been a less innocuous site). Couldn't believe we got multiple people to connect to it under the guise the device would do a cool thing.

Post by dijit » Mon, Jun 17, 2019, 3:52 PM UTC

mikeash wrote: post #9

makepanic wrote: post #3

Earlier quoted context omitted.

It's a USB keyboard that opens types some commands to open a hard-coded website. You can't really prevent that.

You could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses. I don’t know that people would accept this…

Post by alexhutcheson » Mon, Jun 17, 2019, 3:55 PM UTC

rcfox wrote: post #11

_bxg1 wrote: post #7

As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether. I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what securit…

I once worked at a place where the keyboard and mouse were chained to the tower and glued in place, and the spare USB ports were glued over.