Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

USBdriveby – Exploiting USB in Style

samy.pl

Post reply on HN
Print view View original

1–10 of 26 posts

Re: USBdriveby – Exploiting USB in Style

#7

Post by e12e »

> "In OS X, if you attempt to adjust DNS servers via networksetup -setdnsservers, it asks for a password. (...) However, if you can go into the Network settings and manually click some buttons that the system prevents you from clicking with the keyboard, you can adjust settings without a password."

Interesting hack, somewhat relieved to see that a) it's for OS X, and b) it just leverages a poor design/trade-off between security and convenience on that platform.

I suppose this kind of stuff is a good reason to disable sudo-session caching (or whatever it's called) and demand an OTP for elevating privileges [on Linux].

Looks like windows supports OTP, but only with a dedicated server handling the authentication -- does anyone know if there's an easy way to demand OTP for UAC elevation to local admin on a stand-alone windows 8.1 workstation?

[edit: for Linux/freeBSD the libpam-oath package/toolkit can be used to enable TOTP (Time Based One-time Passwords) that are compatible with Google Authenticator -- there are a lot of tutorials on how to use it with openssh (and with the new ability to demand a set of authentication methods, how to demand eg: both ssh-key and a TOTP). With a little familiarity with pam, it's easy to set up for demanding OTP for sudo. AFAIK OS X also supports pam -- but if the gui allows the system to be backdoored, there's not much point...]

Re: USBdriveby – Exploiting USB in Style

#8

Post by samyk »

totony wrote: post #4

This exploit is mitigated by the fact that the keyboard/mouse normally only have user permission (not admin)

Hi totony, unfortunately with the way our systems are designed today, it's typically trivial to usurp admin later on when the user escalates privileges, even after the USB device has been removed. Examples such as injected LD_PRELOAD, adjusting PATH to MITMA sudo, etc.

In my example, we interestingly see how by default, OS X does not require additional permissions in this unique scenario. Crazy!

Re: USBdriveby – Exploiting USB in Style

#9

Post by lsiebert »

I recently got a teensy 2.0 for rooting my chromecast, (which it does, roughly by appearing to chain 32 usb hubs, better description at https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt... )

They are nifty little dev boards, as you can pretend to be a variety of different devices, but the real benefit in my mind is the ease at which you can use the solder pads to build a device and connect it to usb. YOu can dump roms.

The teensy 3.0 is a 32 bit arm processor and has extra ram and flash memory, which is certainly an improvement over the 8 bit avr processor... that said the teensy 2.0 or 2.0++ might be better if you have arduino experience. Both are great boards to play around with, and I expect lots more exploits based around pretending to be various usb devices.

Post reply on HN