191–200 of 231 posts
It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…
Earlier quoted context omitted.
Or emulate a network, generate a DHCP response for your favorite /31 and don't send a router, and point a public domain name at the other address in that /31.
Can you elaborate? I understand the concept of RNDIS or CDC devices, but if you've sent an IP address only without a router, how is any traffic going to make it back to the other IP in that subnet? I figure it will go back over the default route, but how are you in control of the traffic itself?
It's the same mechanism used to reach your router. Subnet-local / connected routes are routes in themselves. Routers let you leave your subnet.
Earlier quoted context omitted.
It did for a few different devices, they could have mimicked one of those. Source: Have plugged several brands of USB-to-COM adapter in to Win 7 / 8.1 and they've "just worked".
Somebody, somewhere had to install a driver. And, because you could never count on it, you can't design to it. Now, since most things use a Prolific chip, you only have to install the driver for one device and you pick up a ton of them. But it has to be installed by somebody, and that means all of the silliness that goes along with Windows driver installation.
Earlier quoted context omitted.
Somebody, somewhere had to install a driver. And, because you could never count on it, you can't design to it. Now, since most things use a Prolific chip, you only have to install the driver for one device and you pick up a ton of them. But it has to be installed by somebody, and that means all of the silliness that goes along with Windows driver installation.
FTDI chips have their driver deployed by default on most Windows, Mac and Linux installs. It's nice being able to buy a USB/serial cable and it just work, without needing to deploy any drivers at all. Check it out!
I have a mysterious USB stick I received as a thank you from a delegation of the Chinese department of Customs (中华人民共和国海关总署) after presenting to them in Palo Alto. The USB is branded with the Chinese Customs logo and their slogan. I haven't dared plugging this in. First and foremost I'm afraid it isn't standards compliant and will somehow fry my motherboard, secondly I don't have a burner device and the necessary kno…
Given what happens to USB sticks in my household (needed fairly often), you may still be at risk of a family member opening it and using it should they need one in a pinch.
Earlier quoted context omitted.
Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an softwar…
> USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written I won't copy my data on unknown device. Mics and cameras trigger prompts in MacOS. The keyboard device on the other hand, can be used for 5 seconds walk by attack, running install scripts (Bad USB) attack.
You won't, but many people will. They'll plug it in, figure the device is fine, and begin to trust it.
Mics and cameras trigger prompts if they present themselves as USB devices. I'm saying they do not need to do that. They can draw power from the port and send captured data out wirelessly.
I've seen some versions of Windows present a conspicuous file copy dialog box when it sees a new flash drive plugged in (or even the same flash drive plugged in to a new port) - some song and dance about copying *.INF driver files. On the other hand I would expect a malicious flash drive to be as silent as possible. What are the odds the agent was just misinterpreting this?
Earlier quoted context omitted.
On the "determine if anything suspicious is happening" front, you can configure Wireshark to capture USB packets and show you what is going over the wire.
Oh nice! I've used Wireshark for TCP / UDP captures before but that's about it. Maybe I can use a raspberry pi as burner device and check it out.