Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Google plasma globe affair of 2012

lcamtuf.coredump.cx

Post reply on HN
Print view View original

61–70 of 103 posts

Re: The Google plasma globe affair of 2012

#61

Post by smegger001 »

duped wrote: post #60
jimrandomh wrote: post #46

It seems pretty scandalous to me that most operating systems still haven't implemented any mitigation for pretend-to-be-a-USB-keyboard attacks. Fixing it isn't trivial, but it's hardly insurmountable. The solution is fairly simple: Whenever a new keyboard is plugged in or types its first keystroke, lock the screen, and don't accept key input to places other than the login form from a new keyboard until that keyboard…

How do you distinguish between a new keyboard and a bad USB cable that gets wiggled a bit?

check the Device ID, if its the same as the one that was in the port a second ago it the same.

Re: The Google plasma globe affair of 2012

#62

Post by MisterTea »

smegger001 wrote: post #61
duped wrote: post #60

Earlier quoted context omitted.

How do you distinguish between a new keyboard and a bad USB cable that gets wiggled a bit?

check the Device ID, if its the same as the one that was in the port a second ago it the same.

What about spoofing?

Re: The Google plasma globe affair of 2012

#63

Post by duped »

smegger001 wrote: post #61
duped wrote: post #60

Earlier quoted context omitted.

How do you distinguish between a new keyboard and a bad USB cable that gets wiggled a bit?

check the Device ID, if its the same as the one that was in the port a second ago it the same.

An attacker can lie about what their device id is

Re: The Google plasma globe affair of 2012

#64

Post by marssaxman »

jimrandomh wrote: post #46

It seems pretty scandalous to me that most operating systems still haven't implemented any mitigation for pretend-to-be-a-USB-keyboard attacks. Fixing it isn't trivial, but it's hardly insurmountable. The solution is fairly simple: Whenever a new keyboard is plugged in or types its first keystroke, lock the screen, and don't accept key input to places other than the login form from a new keyboard until that keyboard…

Don't yubikeys register themselves as keyboards? You can definitely tap the button to get a code typed into any input field.

Re: The Google plasma globe affair of 2012

#65

Post by WaitWaitWha »

I am always amazed when old things we used to do show up again, and again, with minor variation.

We used to be able to make (I think you could buy it too) PS/2 keyboards or dongles/warts/mitm devices that did this. The attacker interface was a bit more cumbersome, but ultimately did the same thing.

Re: The Google plasma globe affair of 2012

#66

Post by CamperBob2 »

Arainach wrote: post #44
godelski wrote: post #40

Earlier quoted context omitted.

I don't think the NSA pays as well though. You also have large restrictions. Not just stuff like never having smoked weed in your life (we are talking about CS people...) but that once you even have a security clearance (a pain to get in the first place) you have a lot of daily life headaches. You have to carefully watch what you say. International travel has to be reported (and can even be a big hassle). Etc. I'm no…

Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time". Citations: https://apply.intelligencecareers.gov/job-description/119486... Cyber Mitigations Analyst/System Vulnerability Analyst - Entry to Expert Level (Maryland…

Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time"

Or "I'm a covert foreign asset, so I DGAF what I get paid."

Re: The Google plasma globe affair of 2012

#67

Post by Scoundreller »

duped wrote: post #63
smegger001 wrote: post #61

Earlier quoted context omitted.

check the Device ID, if its the same as the one that was in the port a second ago it the same.

An attacker can lie about what their device id is

How would it know the right device id to spoof? (Definitely doable in a MITM scenario, but more complicated in others).

Re: The Google plasma globe affair of 2012

#68

Post by Scoundreller »

godelski wrote: post #40
theptip wrote: post #21

Earlier quoted context omitted.

NSA’s TAO surely has many orders of magnitude more budget than Google’s red team?

I don't think the NSA pays as well though. You also have large restrictions. Not just stuff like never having smoked weed in your life (we are talking about CS people...) but that once you even have a security clearance (a pain to get in the first place) you have a lot of daily life headaches. You have to carefully watch what you say. International travel has to be reported (and can even be a big hassle). Etc. I'm no…

Had a friend with a restriction like this and then switched to a more public unrestricted job.

To be honest, I liked hanging out with them more when they couldn't talk about work :)

Re: The Google plasma globe affair of 2012

#69

Post by Scoundreller »

Arainach wrote: post #44
godelski wrote: post #40

Earlier quoted context omitted.

I don't think the NSA pays as well though. You also have large restrictions. Not just stuff like never having smoked weed in your life (we are talking about CS people...) but that once you even have a security clearance (a pain to get in the first place) you have a lot of daily life headaches. You have to carefully watch what you say. International travel has to be reported (and can even be a big hassle). Etc. I'm no…

Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time". Citations: https://apply.intelligencecareers.gov/job-description/119486... Cyber Mitigations Analyst/System Vulnerability Analyst - Entry to Expert Level (Maryland…

Caps are getting raised, at least at DHS:

> The CTMS [Cybersecurity Talent Management System] salary range has an upper limit of the vice president's salary ($255,800 in 2021), plus an extended range for use in limited circumstances, which has an upper limit of $332,100 in 2021.

https://www.zdnet.com/article/the-us-government-just-launche...

Re: The Google plasma globe affair of 2012

#70

Post by Scoundreller »

telotortium wrote: post #51

Google's actual fix was to install a service that detects if keystrokes are being made too quickly for a human (by default, I believe it's 5 keystrokes per 50 milliseconds), and if so, eject the USB device: https://github.com/google/ukip

Reminds me of when I ran some autohotkey experiments on a citrix-type system.

Turned out I could click on controls before they were even drawn on the screen for super-human speed.

Post reply on HN