Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Google plasma globe affair of 2012

lcamtuf.coredump.cx

Post reply on HN
Print view View original

91–100 of 103 posts

Re: The Google plasma globe affair of 2012

#91

Post by yencabulator »

duped wrote: post #76
Scoundreller wrote: post #67

Earlier quoted context omitted.

How would it know the right device id to spoof? (Definitely doable in a MITM scenario, but more complicated in others).

Pick one of the most popular keyboards used by your target and reuse it. That's how I'd do it. It's not going to get everyone but I think it's a legitimate approach. The alternative methods looking at the time between keystrokes seems more reliable.

Keystroke delay based heuristic is just naive, all that means is that the attack needs to happen on an idle system.

In an ideal world, vendors would actually populate the serial number field with a number that's at least semi-random.

On this computer, only the USB-C HDMI adapter and the fingerprint reader have a serial number that looks random :-(

Re: The Google plasma globe affair of 2012

#92

Post by yencabulator »

carry_bit wrote: post #34

I wonder if it flopped for anyone because they had a different keyboard layout (like Dvorak) set.

Interesting thought: Keyboard layout should be a setting scoped to the specific hardware gadget, and everyone does that wrong because it's easier to do it wrong.

Re: The Google plasma globe affair of 2012

#93

Post by tomcam »

hoseja wrote: post #86
tomcam wrote: post #28

Earlier quoted context omitted.

> My Razer keyboard even installs borderline malware What does the software do? I assume it asks for permission and you decline? In a couple of decades of buying USB keyboards I have never let one install software and I have never noticed any problems.

Sometimes these crapware "drivers" are actually required for full functionality of the hardware, like assigning keys, macros, profile switching, etc...

Very good point, which is why I never even bothered to check what was advertised. I simply did not want to require anything beyond a driver that would probably go out of date anyway

Re: The Google plasma globe affair of 2012

#94

Post by jimrandomh »

mmh0000 wrote: post #56
jimrandomh wrote: post #46

It seems pretty scandalous to me that most operating systems still haven't implemented any mitigation for pretend-to-be-a-USB-keyboard attacks. Fixing it isn't trivial, but it's hardly insurmountable. The solution is fairly simple: Whenever a new keyboard is plugged in or types its first keystroke, lock the screen, and don't accept key input to places other than the login form from a new keyboard until that keyboard…

For those wondering, there is an easy defense against this on Linux, USBGuard ( https://usbguard.github.io/ ) RHEL7+ include USBGuard as part of the standard repo [0] [0] https://access.redhat.com/documentation/en-us/red_hat_enterp...

This isn't very practical as a defense. You can't configure it to ban keyboards, because you still need a keyboard, and you might need to swap keyboards if your original one breaks.

Re: The Google plasma globe affair of 2012

#95

Post by Scoundreller »

nyanpasu64 wrote: post #81
Scoundreller wrote: post #70

Earlier quoted context omitted.

Reminds me of when I ran some autohotkey experiments on a citrix-type system. Turned out I could click on controls before they were even drawn on the screen for super-human speed.

Meanwhile on some UIs, I can click buttons after they're drawn and they do nothing unless you wait for half a second or more.

That kinda makes sense to ensure users don’t click on something that they didn’t have enough time to interpret.

I’ve encountered some interesting situations where clicking and hitting a mouse’s scroll wheel would scroll the point of focus on the next screen…

Re: The Google plasma globe affair of 2012

#96

Post by pabs3 »

godelski wrote: post #89
pabs3 wrote: post #79

Earlier quoted context omitted.

Grant/deny just leads to people clicking accept, you want something where the user has to choose what kind of device the plugged in and if it doesn't match what the device says it is then you reject the device or something. On Linux GNOME already has USBGuard support btw.

> Grant/deny just leads to people clicking accept I was imagining this being in some advanced setting with a "here be dragons" warning. Or even a bit more relaxed like Firefox's strict or custom tracking protection. It comes with warnings and I feel pretty confident to say that most users don't touch these settings. > On Linux GNOME already has USBGuard support btw. Yeah I know there are plenty of hardening tools out…

> I was imagining this being in some advanced setting ... most users don't touch these settings

That just leaves most users unprotected.

> I was suggesting that they come pre-installed

GNOME's support for USBGuard is installed by default, but USBGuard itself may not be depending on the distro. Agreed that it and other security/safety/robustness (for eg SMART disk warnings need to be supported) stuff (should be enabled by default. GNOME should use Flatpak-style sandboxing for natively installed apps too.

Re: The Google plasma globe affair of 2012

#97

Post by checkyoursudo »

godelski wrote: post #40
theptip wrote: post #21

Earlier quoted context omitted.

NSA’s TAO surely has many orders of magnitude more budget than Google’s red team?

I don't think the NSA pays as well though. You also have large restrictions. Not just stuff like never having smoked weed in your life (we are talking about CS people...) but that once you even have a security clearance (a pain to get in the first place) you have a lot of daily life headaches. You have to carefully watch what you say. International travel has to be reported (and can even be a big hassle). Etc. I'm no…

All of this is true, but as a government agent, you will be much less likely to go to jail for participating in adversarial activities, which is not nothing.

Re: The Google plasma globe affair of 2012

#98

Post by ygra »

peddling-brink wrote: post #77
g_sch wrote: post #39

Watching the video, they mention that in order for the red team to reach their goal (downloading Google Glass schematics), they had to pivot from the users they compromised with the plasma globe (who were not working on the Glass project) to users on the Glass team. They seemingly did that using an image attached to an email that executed its payload when the email was opened. They didn't elaborate what the payload d…

I have no insider knowledge, but SVGs can contain JS.

Not when rendered in an img element. Well, they can still contain it, but it won't run.

Re: The Google plasma globe affair of 2012

#99

Post by Fatnino »

godelski wrote: post #55
jimrandomh wrote: post #46

It seems pretty scandalous to me that most operating systems still haven't implemented any mitigation for pretend-to-be-a-USB-keyboard attacks. Fixing it isn't trivial, but it's hardly insurmountable. The solution is fairly simple: Whenever a new keyboard is plugged in or types its first keystroke, lock the screen, and don't accept key input to places other than the login form from a new keyboard until that keyboard…

I think it is a hard problem to solve BUT I think OSs should offer a compromise. That you are notified each time and can grant or deny. This should be an optional setting for those that want to easily add hardening (I think there's no excuse that linux distros don't have a "hardening" setting in their advanced or security settings). I don't know the answer to this, so I'll ask. Can USB ports be programmed to only out…

Android already does this but from the other side. I assume iPhone as well. When you plug in a cable it only does power until explicitly allowed to move data as well.

Re: The Google plasma globe affair of 2012

#100

Post by godelski »

pabs3 wrote: post #96
godelski wrote: post #89

Earlier quoted context omitted.

> Grant/deny just leads to people clicking accept I was imagining this being in some advanced setting with a "here be dragons" warning. Or even a bit more relaxed like Firefox's strict or custom tracking protection. It comes with warnings and I feel pretty confident to say that most users don't touch these settings. > On Linux GNOME already has USBGuard support btw. Yeah I know there are plenty of hardening tools out…

> I was imagining this being in some advanced setting ... most users don't touch these settings That just leaves most users unprotected. > I was suggesting that they come pre-installed GNOME's support for USBGuard is installed by default, but USBGuard itself may not be depending on the distro. Agreed that it and other security/safety/robustness (for eg SMART disk warnings need to be supported) stuff (should be enable…

> That just leaves most users unprotected.

Aren't these users already unprotected? I don't think this is a security concern for most people and turning on by default would frustrate them more. It'd be like shipping Firefox or Chrome with NoScript on my default. Sure, more protection, but it would turn away more people than it would pull in. Better as optional.

Post reply on HN