41–50 of 195 posts
If you are paranoid about something like this happening, just use https://www.qubes-os.org/ . all usb devices are jailed in a non-networked vm by default. In general, if what you do warrants that level of paranoia, qubes will help you massively. Micah Lee held a great overview talk at HOPE 2018: https://www.youtube.com/watch?v=f4U8YbXKwog
Earlier quoted context omitted.
Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…
> depending on the OS, it's possible to craft a USB stick that copies files to a remote server as soon as it's plugged in. Is this possible with Linux?
Earlier quoted context omitted.
Autorun has been disabled by default for a long time (with good reason). And it has never worked with USB drives, only ones which emulated a CD drive such as U3 USB drives.
Autorun attempts results in a prompt since Vista. Apparently, autorun from USB volumes was enabled for XP SP2: https://support.microsoft.com/en-us/help/967715/how-to-disab... >Before Windows XP SP2, AutoPlay was disabled by default on removable drives, such as the floppy disk drive (but not the CD drive), and on network drives. Starting with Windows XP SP2, AutoPlay is enabled for removable drives. This includes ZIP…
Earlier quoted context omitted.
That would only work on a known operating system and window manager with known keyboard shortcuts, unless a terminal is already focused.
In theory, you could fingerprint the host OS first and then run the appropriate commands (of course more tricky with more custom Linux setups, does CTRL+ALT+Fn still work to get to a text console?): https://www.cise.ufl.edu/~butler/pubs/sadfe11.pdf
Earlier quoted context omitted.
Yes, but that's unrelated. The idea here is that if a USB device is connected to your machine, it's an indicator that your machine is compromised. Mouse jigglers that stop your lock screen from activating are very common when confiscating machines: https://www.cru-inc.com/products/wiebetech/mouse_jiggler_mj-... And of course, depending on the OS, it's possible to craft a USB stick that copies files to a remote server…
An alternative approach may be to check idVendor and idProduct (lsusb) to see if either matches a mouse jiggler supplier or product.
Earlier quoted context omitted.
You can get a 'USB rubber ducky' [1] which emulates both a USB memory stick and a USB keyboard, allowing you to script keystrokes for the keyboard [2] So it can do anything a newly plugged in keyboard can do. Which, if the user is already logged in, makes grabbing the user's files easy. [1] https://shop.hak5.org/collections/usb-rubber-ducky/products/... [2] https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads
This will only work, I suppose, if the attacker knows beforehand a keychord that will focus a terminal.
Obligatory $5 wrench comment: https://xkcd.com/538/ Something like this is probably good when you - as a person - are not around when your hardware gets extracted from your place. But then again, why would it be running openly and unattended in the first place?
If you are paranoid about something like this happening, just use https://www.qubes-os.org/ . all usb devices are jailed in a non-networked vm by default. In general, if what you do warrants that level of paranoia, qubes will help you massively. Micah Lee held a great overview talk at HOPE 2018: https://www.youtube.com/watch?v=f4U8YbXKwog
How does that work with input devices like keyboard and mouse?
details on using usb keyboard and mouse here: https://www.qubes-os.org/doc/usb-qubes/
If you are paranoid about something like this happening, just use https://www.qubes-os.org/ . all usb devices are jailed in a non-networked vm by default. In general, if what you do warrants that level of paranoia, qubes will help you massively. Micah Lee held a great overview talk at HOPE 2018: https://www.youtube.com/watch?v=f4U8YbXKwog
I don't think it solves same problem.
I attended a talk by GSK and there was part of the talk about security. They don't allow usb devices to be plugged into their analysis computers. But every year they get an intern that tries to charge their phone from the PC USB. Something like this, that doesnt halt the computer but shows a warning on screen and logs information would perhaps be a solution to their problem. Although in the case of industrial espiona…