131–140 of 231 posts
Earlier quoted context omitted.
Well, the head of USSS was fired today. Unclear if it's related.
I'm of the opinion that a POTUS that carries a unsecured iPhone against the recommendations of his staff (and overrules their security clearance decisions for his son-in-law) isn't going to fire anyone due to quibbles over OPSEC.
Earlier quoted context omitted.
True, but there's a lot more going on here than "had a USB stick". > She was caught by the Secret Service with four cellphones, a laptop, cash, an external hard drive, a signals detector to spot hidden cameras, and a thumb drive.
That's exactly how I travel to tech-related summits around the world, and I have nothing to do with espionage I assure you. I have 3 cellphones - one private (family calls, face time etc), one CDMA phone and one separate GSM for the most of EU countries. And external SSD drive with all my important backups and projects that would take forever to download off of DropBox. And yes - recently even cheap signal detector,…
Do you typically sneak into these summits, telling the security staff a variety of lies to do so?
Earlier quoted context omitted.
The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still, I'd expect more from the organization, and I bet that the specific agents involved are getting disciplined and trained.
Well, the head of USSS was fired today. Unclear if it's related.
>Mr. Alles was told to develop an exit plan before the arrest of a Chinese woman carrying a malware-laced device at Mar-a-Lago, exposing holes in the security of the private club.
https://www.nytimes.com/2019/04/08/us/politics/randolph-alle...
Earlier quoted context omitted.
USB doesn't work without a driver and sometimes you don't want to (or can't) install a driver. This sounds like the kind of hack that a clever (but arguably unwise) engineer would shove in to help them remotely troubleshoot a device. "Sensor not detected? OK, open up Notepad and hit Caps Lock three times quickly. Did some text appear? The sensor is fine, the problem is with your computer."
why is this unwise?
Earlier quoted context omitted.
Better late than never? https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.... https://usbguard.github.io
That's definitely progress, but there's more work needed to make it usable enough to be on by default.
I believe the major missing piece for desktop Linux at this point is that many input devices (including my own) are USB based. Without a way for the device to cryptographically attest its identity, you either have to accept vulnerability from wired external devices during boot or do without input until user space has been started.
Edit: My mistake. It appears that it was opt-in as of January, will become on-by-default at some point in the future, and only blocks devices during boot and while the screen is locked. It appears to trust all devices plugged into it once you've logged in. (https://www.forbes.com/sites/leemathews/2019/01/07/google-sh...)
The article assumes (or at least implies) the secret service member was plugging it into his own personal laptop or something. Why? It may very well be a computer specifically setup to screen devices, including USB drives. It may be a sandboxed and sanitized environment. Or not, but we just don't know, and this article seems a little sensationalist in casting a negative light in the secret service absent details.
If it were set up for this purpose, they wouldn’t have ripped it out in a panic.
It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…
Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…
It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…
Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…
www.fiftythree.org/etherkiller/
Miniaturized wireless electronics is the Ice IX that will destroy civilization
wikipedia.org/wiki/Ice_IX
I was surprised from the get-go that no-one seem to be talking about the legality of an ad-hoc search of a USB thumb-drive. The stupidity of it (from an infosec standpoint) should be a given, yet this aspect appears to be the focus of the debate. Am I missing something?
Totally aside from that, all of Florida is in the 100 mile civil rights suspension zone: https://www.aclu.org/other/constitution-100-mile-border-zone
Earlier quoted context omitted.
Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…
Seat belts and airbags don't save you in all cases, but we use them.