Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Google plasma globe affair of 2012

lcamtuf.coredump.cx

Post reply on HN
Print view View original

81–90 of 103 posts

Re: The Google plasma globe affair of 2012

#81

Post by nyanpasu64 »

Scoundreller wrote: post #70
telotortium wrote: post #51

Google's actual fix was to install a service that detects if keystrokes are being made too quickly for a human (by default, I believe it's 5 keystrokes per 50 milliseconds), and if so, eject the USB device: https://github.com/google/ukip

Reminds me of when I ran some autohotkey experiments on a citrix-type system. Turned out I could click on controls before they were even drawn on the screen for super-human speed.

Meanwhile on some UIs, I can click buttons after they're drawn and they do nothing unless you wait for half a second or more.

Re: The Google plasma globe affair of 2012

#82

Post by xoogler2004 »

golem14 wrote: post #19
alexpotato wrote: post #11

Reading articles like this always causes me to think two things: 1. If this is what a couple of smart guys can do as, essentially, a side project then I can only imagine what nation states with teams of people like this can accomplish. 2. I get why some orgs pour wax into the USB ports of their desktop machines.

That was not a side project from my limited understanding ;) I believe the M$/Alphabet/Meta security teams are probably more advanced or on par with the best state sponsored teams. I could be wrong, plus the state sponsored teams might have infiltrated the FAANG security teams ;) However, I think the FAANG companies act somewhat more restricted. Three letter agencies don't have qualms about things like "chloroforming…

This was a side project.

Re: The Google plasma globe affair of 2012

#83

Post by tellmemore145 »

EthicalSimilar wrote: post #52
tellmemore145 wrote: post #47

Earlier quoted context omitted.

Can you link to one of these watches? If they're being sold with that purpose-build functionality, that's probably a federal crime. You cannot make, possess, or operate a signal jammer in the US.

From what I briefly remember, they aren’t jammers. They’re more akin to a DoS to the access point (I think it has something to do with spamming auth requests?) than jamming any physical signals.

As tgsovlerkhgsel said, they're not the classic style of jammer. That kind of thing is called a "smart jammer". And if you built that exact kind of functionality into a device and sold it (vs. just allowing the customer to code it themselves, like they could on any wifi device), you are probably committing a felony by manufacturing and selling a signal jammer.

Re: The Google plasma globe affair of 2012

#84

Post by matkoniecz »

godelski wrote: post #55
jimrandomh wrote: post #46

It seems pretty scandalous to me that most operating systems still haven't implemented any mitigation for pretend-to-be-a-USB-keyboard attacks. Fixing it isn't trivial, but it's hardly insurmountable. The solution is fairly simple: Whenever a new keyboard is plugged in or types its first keystroke, lock the screen, and don't accept key input to places other than the login form from a new keyboard until that keyboard…

I think it is a hard problem to solve BUT I think OSs should offer a compromise. That you are notified each time and can grant or deny. This should be an optional setting for those that want to easily add hardening (I think there's no excuse that linux distros don't have a "hardening" setting in their advanced or security settings). I don't know the answer to this, so I'll ask. Can USB ports be programmed to only out…

grant/deny can be easily overcome by malicious input device with high pass rate

Re: The Google plasma globe affair of 2012

#85

Post by 411111111111111 »

golem14 wrote: post #19
alexpotato wrote: post #11

Reading articles like this always causes me to think two things: 1. If this is what a couple of smart guys can do as, essentially, a side project then I can only imagine what nation states with teams of people like this can accomplish. 2. I get why some orgs pour wax into the USB ports of their desktop machines.

That was not a side project from my limited understanding ;) I believe the M$/Alphabet/Meta security teams are probably more advanced or on par with the best state sponsored teams. I could be wrong, plus the state sponsored teams might have infiltrated the FAANG security teams ;) However, I think the FAANG companies act somewhat more restricted. Three letter agencies don't have qualms about things like "chloroforming…

> That was not a side project from my limited understanding ;)

First paragraph of the article:

> In episode #3, Daniel Fabian talks about the redteaming efforts - and in particular, about an exercise he and I ran together as a side project back in 2012:

Re: The Google plasma globe affair of 2012

#86

Post by hoseja »

tomcam wrote: post #28
wil421 wrote: post #20

Earlier quoted context omitted.

I’m pretty desensitized to window’s CMD prompts popping up when I install a program or plug in a device. My Razer keyboard even installs borderline malware when you plug it in. However, if this happened on my Mac I would immediately be skeptical.

> My Razer keyboard even installs borderline malware What does the software do? I assume it asks for permission and you decline? In a couple of decades of buying USB keyboards I have never let one install software and I have never noticed any problems.

Sometimes these crapware "drivers" are actually required for full functionality of the hardware, like assigning keys, macros, profile switching, etc...

Re: The Google plasma globe affair of 2012

#87

Post by EthicalSimilar »

tgsovlerkhgsel wrote: post #58
EthicalSimilar wrote: post #52

Earlier quoted context omitted.

From what I briefly remember, they aren’t jammers. They’re more akin to a DoS to the access point (I think it has something to do with spamming auth requests?) than jamming any physical signals.

They aren't jammers in the "blast out RF noise" sense, but since they are meant to disrupt legitimate communications, the FCC considers them jammers and has repeatedly fined companies that run deauth attacks to "encourage" people to use their paid networks: https://www.jdsupra.com/legalnews/fcc-issues-another-fine-fo...

I see, thanks for the clarification

Re: The Google plasma globe affair of 2012

#88

Post by rjmunro »

matkoniecz wrote: post #84
godelski wrote: post #55

Earlier quoted context omitted.

I think it is a hard problem to solve BUT I think OSs should offer a compromise. That you are notified each time and can grant or deny. This should be an optional setting for those that want to easily add hardening (I think there's no excuse that linux distros don't have a "hardening" setting in their advanced or security settings). I don't know the answer to this, so I'll ask. Can USB ports be programmed to only out…

grant/deny can be easily overcome by malicious input device with high pass rate

Surely not if the device has no access to the machine until after you press grant.

Re: The Google plasma globe affair of 2012

#89

Post by godelski »

pabs3 wrote: post #79
godelski wrote: post #55

Earlier quoted context omitted.

I think it is a hard problem to solve BUT I think OSs should offer a compromise. That you are notified each time and can grant or deny. This should be an optional setting for those that want to easily add hardening (I think there's no excuse that linux distros don't have a "hardening" setting in their advanced or security settings). I don't know the answer to this, so I'll ask. Can USB ports be programmed to only out…

Grant/deny just leads to people clicking accept, you want something where the user has to choose what kind of device the plugged in and if it doesn't match what the device says it is then you reject the device or something. On Linux GNOME already has USBGuard support btw.

> Grant/deny just leads to people clicking accept

I was imagining this being in some advanced setting with a "here be dragons" warning. Or even a bit more relaxed like Firefox's strict or custom tracking protection. It comes with warnings and I feel pretty confident to say that most users don't touch these settings.

> On Linux GNOME already has USBGuard support btw.

Yeah I know there are plenty of hardening tools out there, but I was suggesting that they come pre-installed. There's so much bloatware on most systems these days that this seems minor. Or maybe someone could put together a bundling script to make adding all this (e.g. USBGuard + Fail2Ban + Faillock + Firejail + etc) easy to install and configure. I'm not aware of any such tool. But maybe even an Ansible script could go a long way.

Re: The Google plasma globe affair of 2012

#90

Post by yencabulator »

marssaxman wrote: post #64
jimrandomh wrote: post #46

It seems pretty scandalous to me that most operating systems still haven't implemented any mitigation for pretend-to-be-a-USB-keyboard attacks. Fixing it isn't trivial, but it's hardly insurmountable. The solution is fairly simple: Whenever a new keyboard is plugged in or types its first keystroke, lock the screen, and don't accept key input to places other than the login form from a new keyboard until that keyboard…

Don't yubikeys register themselves as keyboards? You can definitely tap the button to get a code typed into any input field.

By default, yes. You can disable the "long-press to send password" feature.

(I kept triggering it by accident, and disabled it.)

Post reply on HN