Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

USB Killer

kukuruku.co

Post reply on HN
Print view View original

181–190 of 198 posts

Re: USB Killer

#181

Post by malkia »

zyxley wrote: post #176
Smerity wrote: post #99

Earlier quoted context omitted.

Whilst an option, I feel it's a bad one if security is actually a priority. Having worked at companies who actually have a high level concern over computer security, telling someone simply isn't enough. Being told is passive. Passive defence and active defence are two entirely different states of mind. Defending against an attack needs to be active and instinctual. Every time you open, close, or set down your laptop,…

> One of the companies I worked at actually made a game out of leaving your terminal unlocked. I can tell you, after a few days of your colleagues kindly laughing at you returning to a screen full of Internet memes, you instinctively Ctrl + L upon standing up, even if it's to walk to the windows to look at the view. This was unofficial but standard practice at a support center I once worked at. It was a terrible work…

A guy in my previous work came to me for help, we did some remote desktop to his machine from mine, only to find a big dick drawn in ms paint by someone... kind of funny, but the guy was a bit shocked and felt embarrased, not knowing what to do I simply ignored it as nothing has happened.

Re: USB Killer

#183

Post by derefr »

TeMPOraL wrote: post #105
derefr wrote: post #15

The worst suggestion in the world: make one of these look like one of those USB dead-drops.

I think it's the best idea ever. I mean, seriously, with all those USB-based attack vectors do anyone thinks plugging your computer to a random USB port sticking out of a wall is a good idea ?

It's kind of a snide thing to do, though; every physical interchange medium, or object you might put in proximity to your computer, has physical attack vectors. Optical disks can be weakened so as to become shrapnel inside a disk drive. Magnetic tapes can be replaced with sandpaper and scratch the reader to death. Any cassette media (e.g. floppy disks) can simply be filled with glue—or, better yet, contain a small explosive.

So, there's nothing about USB that makes people especially deserving of punishment if they go using strange ones; there's a base level of societal trust required for the abstraction of a "side-effect-free data storage object" to exist in the first place.

To say otherwise is similar to purposefully driving the wrong way down the road and getting into a 28-car pile-up, and then saying that this is a lesson in how cars are inherently dangerous and people should avoid driving near strangers. The security mindset can only make you so safe; at some point, you have to trust that strangers aren't trying to kill you in order to be able to live your life.

(Though, in this case, you could just avoid all physical peripherals and ask the person to email you the file instead. At least all you can get from that is a virus.)

Re: USB Killer

#184

Post by dfox »

ptaipale wrote: post #175
DanBC wrote: post #160

Earlier quoted context omitted.

That's when you pull the plug out of the socket. OP is talking about the failure mode when you pull the cable out of the plug - the live and neutral cables are shorter and tighter and will fail first, leaving the earth wire to fail last.

I didn't quite understand the whole concept. The idea in Schuko plugs is that you cannot pull the cable out of the plug. It's totally fixed (either inside solid plastic, or attached with a strain relief that fixes it). edit: now that I think of it, Schuko plugs of the install-yourself kind where you can attach cable with a screwdriver (not solid plastic with the cable) are done so that the earth cable is longer than…

Most combination Schuko/French plugs I've seen recently are even designed in such way that when all wires are same length then the PE one has larger slack inside the plug.

Re: USB Killer

#185

Post by e15ctr0n »

stef25 wrote: post #73

I thought I remembered reading something about quite a high profile hack that was carried by infecting computers by people using USB sticks that were strategically left on the floor of a parking lot near their car.

http://www.cnet.com/news/stuxnet-delivered-to-iranian-nuclea...

Re: USB Killer

#186

Post by TeMPOraL »

derefr wrote: post #183
TeMPOraL wrote: post #105

Earlier quoted context omitted.

I think it's the best idea ever. I mean, seriously, with all those USB-based attack vectors do anyone thinks plugging your computer to a random USB port sticking out of a wall is a good idea ?

It's kind of a snide thing to do, though; every physical interchange medium, or object you might put in proximity to your computer, has physical attack vectors. Optical disks can be weakened so as to become shrapnel inside a disk drive. Magnetic tapes can be replaced with sandpaper and scratch the reader to death. Any cassette media (e.g. floppy disks) can simply be filled with glue—or, better yet, contain a small ex…

It's not like that. USB drives are a popular vector for transfering malware both ways. Which means a perfectly good dead drop can become infected when someone who didn't know he had malware plugs his computer in. USB dead drops are not like cars - they're like a bottle of juice chained to a wall, that anyone can drink from and refill it with whatever they want. You don't have to assume malice to expect such a bottle to be a health risk - not everyone who deposits a disease knows he is ill.

Of course I'm joking with my approval for installing boobytrapped dead drops - but the point is, connecting to a random thumbdrive sticking out of a wall sounds like a dumbest computer-related idea ever.

Re: USB Killer

#187

Post by jfoster »

ptaipale wrote: post #100
Smerity wrote: post #22

Someone joked that this would be useful to ensure people won't randomly plug USB drives into their computers. Sounds insane, except that... "During a stop-over in Hong Kong, he finds a spare USB key in his hotel room. Curious, he inserts it into his laptop. By the time he arrives in Australia, his computer is infected."[1] This was the one of the infection vectors for a large flare-up between the Chinese government a…

A standard procedure in somewhat-security-concerned firms is that when you travel, you go and get a freshly installed travel laptop (a loaner) from IT dept, use it on the trip, and after the trip, you return it to the department that wipes out everything on the disk and re-images it. This wouldn't protect against things like firmware-based malware, attacks that major three-letter spy agencies could deploy when they f…

That model may not always work well. At least one country I know of interviews you at your point of departure as to whether your IT department has recently had your laptop in their possession.

Re: USB Killer

#189

Post by ptaipale »

jfoster wrote: post #187
ptaipale wrote: post #100

Earlier quoted context omitted.

A standard procedure in somewhat-security-concerned firms is that when you travel, you go and get a freshly installed travel laptop (a loaner) from IT dept, use it on the trip, and after the trip, you return it to the department that wipes out everything on the disk and re-images it. This wouldn't protect against things like firmware-based malware, attacks that major three-letter spy agencies could deploy when they f…

That model may not always work well. At least one country I know of interviews you at your point of departure as to whether your IT department has recently had your laptop in their possession.

Sure they may interview, but how does that make the model not work? The answer is going to be the same every time: of course my laptop is regularly in the possession of the IT support organisation.

Re: USB Killer

#190

Post by ptaipale »

dfox wrote: post #184
ptaipale wrote: post #175

Earlier quoted context omitted.

I didn't quite understand the whole concept. The idea in Schuko plugs is that you cannot pull the cable out of the plug. It's totally fixed (either inside solid plastic, or attached with a strain relief that fixes it). edit: now that I think of it, Schuko plugs of the install-yourself kind where you can attach cable with a screwdriver (not solid plastic with the cable) are done so that the earth cable is longer than…

Most combination Schuko/French plugs I've seen recently are even designed in such way that when all wires are same length then the PE one has larger slack inside the plug.

Right, that's what I meant (i.e. the earth wire sticking out of cable end is "unnecessary long" if it is the same length as L/N).

However, it is very unusual if the cable comes loose from the plug casing.

Post reply on HN