Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

141–150 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#141

Post by hopler »

Reelin wrote: post #135
jimrandomh wrote: post #122

Earlier quoted context omitted.

That's definitely progress, but there's more work needed to make it usable enough to be on by default.

As far as I understand it, this already is on by default for ChromeOS. The kernel patches make it possible to utilize internal USB devices during the boot process without disabling protection - ie there's no vulnerability window prior to user space being up and running. I believe the major missing piece for desktop Linux at this point is that many input devices (including my own) are USB based. Without a way for the…

The only reason your laptop is trusted is because you trust the person who gave you the laptop. The same threat model applies to the first keyboard you get for your desktop. Neither laptop/desktop nor keyboard is inherently more trustworthy.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#142

Post by joering2 »

ceejayoz wrote: post #132
joering2 wrote: post #109

Earlier quoted context omitted.

That's exactly how I travel to tech-related summits around the world, and I have nothing to do with espionage I assure you. I have 3 cellphones - one private (family calls, face time etc), one CDMA phone and one separate GSM for the most of EU countries. And external SSD drive with all my important backups and projects that would take forever to download off of DropBox. And yes - recently even cheap signal detector,…

> That's exactly how I travel to tech-related summits around the world, and I have nothing to do with espionage I assure you. Do you typically sneak into these summits, telling the security staff a variety of lies to do so?

“Sneaking” can be anything. If her mother tounge wasn’t english and she couldn’t communicate with SS, obviously they assumed the worst; that’s what they are paid for. So no wonder they stated she sneaked in. Also as a tourist you could wander in hotel with foreign signs and they will asume you sneaked in as well.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#143

Post by Gaelan »

YjSe2GMQ wrote: post #69
netsharc wrote: post #27

Earlier quoted context omitted.

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

Barcode-as-a-keyboard was one of the vectors that researchers at last CCC used to hack ATMs. End result: show two barcodes, cash gets out. https://media.ccc.de/v/35c3-9761-truly_cardless_jackpotting_... USB is trash for security.

Don’t think that’s a vector per se. The ATM accepts untrusted USB keyboard input (THAT is the bug)—the barcode reader is just a product that happens to make it easy to type in the right series of characters. You could have done the same thing with a normal keyboard (or an Arduino, if you wanted the convenience)

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#144

Post by hopler »

liveoneggs wrote: post #112
netsharc wrote: post #27

Earlier quoted context omitted.

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers. I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

this is how they've always worked. How else should a barcode be entered by a scanner?

The driver could read data from the device and clamp the results to a reasonable number of non control code characters.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#145

Post by salgernon »

For all the complaining about usb devices, the agent behaved recklessly in trying to handle the device. If the person of interest had instead been carrying a quantity of unlabeled pills, the agent would be as wrong to gulp them down.

I would think the secret service would have a policy in place for handling unknown media already, and I’m sure a Very Urgent Memo is wending it’s way from division headquarters as we speak.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#146

Post by darkarmani »

depressed wrote: post #71

Shouldn't preventing this be as easy as turning off autorun? In fact, I thought Windows had that off by default for USB devices. (Of course, I'm assuming we're not dealing with a zero-day in the USB stack or filesystem drivers. But that probably is something that the Secret Service should be on top of, as well.)

> this be as easy as turning off autorun

What does autorun have to do with a mouse or keyboard device? The problem with USB is that you don't know if it is a "mass storage device" or any of the other kinds of devices that can start interfacing with your computer.

If it is an (automated) keyboard device (HID), it will immediately start "typing" which means it can open a terminal window and start executing things.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#148

Post by hopler »

na85 wrote: post #50
samstave wrote: post #42

Earlier quoted context omitted.

If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.

Hasn't the security by obscurity myth been debunked, and furthermore hasn't government proven itself utterly incompetent at designing products?

Defense in depth has not been debunked.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#149

Post by RandomTisk »

na85 wrote: post #50
samstave wrote: post #42

Earlier quoted context omitted.

If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.

Hasn't the security by obscurity myth been debunked, and furthermore hasn't government proven itself utterly incompetent at designing products?

I'm not sure I would classify it as such, it's more of an attack surface reduction, assuming we're only talking about the physical form factor.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#150

Post by mirimir »

01100011 wrote: post #125
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…

> You could do similar things with a USB stick. You could have a high voltage converter which fries your PC the second you plug it in.

See https://hackernoon.com/this-3-diy-usb-device-will-kill-your-...

Post reply on HN