USBdriveby – Exploiting USB in Style • Hacker News Board

Re: USBdriveby – Exploiting USB in Style

#21

Post by totony » Fri, Dec 19, 2014, 4:01 AM UTC

samyk wrote: post #8

totony wrote: post #4

This exploit is mitigated by the fact that the keyboard/mouse normally only have user permission (not admin)

Hi totony, unfortunately with the way our systems are designed today, it's typically trivial to usurp admin later on when the user escalates privileges, even after the USB device has been removed. Examples such as injected LD_PRELOAD, adjusting PATH to MITMA sudo, etc. In my example, we interestingly see how by default, OS X does not require additional permissions in this unique scenario. Crazy!

That's true, but this hack is a (clever) way to shortcut doing user commands (if you have access to the USB port and the logged user's unlocked screen, then it is conceivable that you should be able to do such a thing without such a tool).

The exploits that could lead to privilege escalation are a different matter (imo they should be fixed).

This hack is very relevent for personal computers, where the user account (in windows i.e.) is an admin and plugging in a USB device does not seem as dangerous as you demonstrated it is.

Re: USBdriveby – Exploiting USB in Style

#22

Post by yazinsai » Fri, Dec 19, 2014, 7:33 AM UTC

wyager wrote: post #3

I have a Teensy firmware sitting around somewhere that immediately BSODs any Windows 7 machine. It's a good trick for nerd parties.

But how can you tell if you actually caused the BSOD? ;)

Re: USBdriveby – Exploiting USB in Style

#23

Post by thinkling » Sat, Dec 20, 2014, 1:21 AM UTC

elithrar wrote: post #16

e12e wrote: post #7

> "In OS X, if you attempt to adjust DNS servers via networksetup -setdnsservers, it asks for a password. (...) However, if you can go into the Network settings and manually click some buttons that the system prevents you from clicking with the keyboard, you can adjust settings without a password." Interesting hack, somewhat relieved to see that a) it's for OS X, and b) it just leverages a poor design/trade-off betwe…

Note that you can also force the admin password for any System Preferences GUI changes with a single click. I'm not sure whether the default for non-admin accounts is this, though.

For me under Mavericks, the Networks control panel always requires a click on the lock + then authentication to make DNS changes.

Re: USBdriveby – Exploiting USB in Style

#24

Post by freshfey » Sun, Dec 21, 2014, 12:32 PM UTC

A bit off topic but how does one learn the skills that Samy repeatedly uses to build/hack things like this? Any guide you could recommend?

Re: USBdriveby – Exploiting USB in Style

#25

Post by bnewyork » Tue, Dec 23, 2014, 7:19 PM UTC

New so interesting.

Re: USBdriveby – Exploiting USB in Style

#26

Post by bnewyork » Tue, Dec 23, 2014, 7:20 PM UTC

bobevans783@gmail.com any news letters.