Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

241–250 of 256 posts

Re: Kurt Got Got

#241

Post by zahlman »

JdeBP wrote: post #225
zahlman wrote: post #211

Earlier quoted context omitted.

Do people still commonly use USB for removable storage? I kinda assumed it was all SD/microSD now.

They certainly still plug those SD/TF cards into USB card readers that present themselves as USB mass storage devices.

Sure, but who's going to pick up a random USB-to-SD adapter from the parking lot and plug that into a computer? The point of the USB key experiment is that the "key" form factor advertises "there is potentially interesting data here and your only chance to recover it is to plug this entire thing in wholesale".

Re: Kurt Got Got

#243

Post by mrkurt »

000ooo000 wrote: post #105
jryio wrote: post #3

I'm always glad to see when companies, developers and CEOs make a heartfelt and humanistic mae culpa. We would like to think that we're the smart ones and above such low level types of exploits, but the reality is that they can catch us at any moment on a good or bad day. Good write up

>heartfelt and humanistic mae culpa They literally admit they pay a Zoomer to make memes for Twitter. I think you are falling for the PR.

I am confused. Are we not supposed to pay zoomers.

Re: Kurt Got Got

#244

Post by 000ooo000 »

mrkurt wrote: post #243
000ooo000 wrote: post #105

Earlier quoted context omitted.

>heartfelt and humanistic mae culpa They literally admit they pay a Zoomer to make memes for Twitter. I think you are falling for the PR.

I am confused. Are we not supposed to pay zoomers.

I'll explain more, reach out to me on X https://www.privatemessage-x.com/000OOO000

Re: Kurt Got Got

#245

Post by JdeBP »

zahlman wrote: post #241
JdeBP wrote: post #225

Earlier quoted context omitted.

They certainly still plug those SD/TF cards into USB card readers that present themselves as USB mass storage devices.

Sure, but who's going to pick up a random USB-to-SD adapter from the parking lot and plug that into a computer? The point of the USB key experiment is that the "key" form factor advertises "there is potentially interesting data here and your only chance to recover it is to plug this entire thing in wholesale".

You're moving your own goalposts, by now restricting this to a storage device that is fitted into an adapter to make it USB. There is no requirement to limit this to USB, however.

They'll pick up the SD/TF card and put it into a card reader that they already have, and end up running something just by opening things out of curiosity to see what's on the card.

One could pull this same trick back in the days of floppy discs. Indeed, it was a standard caution three decades ago to reformat found or (someone else's) used floppy discs. Hell, at the time the truly cautious even reformatted bought-new pre-formatted floppy discs.

This isn't a USB-specific risk. It didn't come into being because of USB, and it doesn't go away when the storage medium becomes SD/TF cards.

Re: Kurt Got Got

#246

Post by Aeolun »

taneq wrote: post #160
solid_fuel wrote: post #117

Earlier quoted context omitted.

At a previous position, I had a rather strained relationship with the IT department - they were very slow to fill requests and maintained an extremely locked down windows server that we were supposed to develop for. It wasn't the worse environment, but the constant red tape was pretty frustrating. I got got when they sent out a phishing test email disguised as a survey of user satisfaction with the IT department. Hon…

TBH this is probably the best argument for actually conducting phishing pentests. It shuts up the technical users who think they're too smart to need the handrails and safety nets that the IT department set up for the rest of the average plebs who work there. (Speaking as one of the technical users here. Of course, it wouldn't happen to ME! :P )

I dunno, if I get phishing emails in my inbox I feel like a certain team has already failed. We have a firewall that blocks anything non- approved. Do the same thing with emails.

Re: Kurt Got Got

#247

Post by JdeBP »

BobaFloutist wrote: post #240
JdeBP wrote: post #224

Earlier quoted context omitted.

Mine. Not asking whoever happens to have local physical access interactively , strictly speaking, as that just papers over one of the problems; but controlling what Human Input Devices are allowed when plugged in, by applying rules (keyable on various device parameters) set up by the administrator. Working thus far on NetBSD, FreeBSD, and Linux. OpenBSD to come when I can actually get it to successfully install on th…

Assuming the OS isn't running on a laptop, how do you approve the first keyboard or mouse you plug in?

It's not an interactive approval process, remember. It's a ruleset-matching process. There's not really a chicken-and-egg problem where one builds up from nothing by interactively approving things at device insertion time using a keyboard, here. One does not have to begin with nothing, and one does not necessarily need to have any keyboard plugged in to the machine to adjust the ruleset.

The first possible approach is to start off with a non-empty ruleset that simply uses the "old model" (q.v.) and then switch to "opt-in" before commissioning the machine.

The second possible approach is to configure the rules from empty having logged in via the network (or a serial terminal).

The third possible approach is actually the same answer that you are envisaging for the laptop. On the laptop you "know" where the USB builtin keyboard will appear, and you start off having a rule that exactly matches it. If there's a "known" keyboard that comes "in the box" with some other type of machine, you preconfigure for that whatever it is. You can loosen it to matching everything on one specific bus, or the specific vendor/product of the supplied keyboard wherever it may be plugged in, or some such, according to what is "known" about the system; and then tighten the ruleset before commissioning the machine, as before.

The fourth possible approach is to take the boot DASD out, add it to another machine, and change the rules with that machine.

The fifth possible approach is for there to be a step that is part of installation that enumerates what is present at installation time and sets up appropriate rules for it.

Re: Kurt Got Got

#248

Post by eru »

pas wrote: post #237
eru wrote: post #171

Earlier quoted context omitted.

Yes. People used to laugh at the auto-play for CD-ROMs in Windows 95. But if a USB device can hijack your system, is it that different?

Are we still at the "Bill Gates got a BSoD during the demo of USB" level? I know that at least on Linux mounting filesystems can lead to nasty things, so there's FUSE, but ... I have no idea what distros and desktop environments do by default. And then there's all the preview/thumbnail generators and metadata parsers, ...

One big problem with USB is that something might look like a storage device to the human eyes and hands, but it's actually a keyboard as far as the computer is concerned.

The U stands for Universal, and it's awfully convenient, but it contributes to the security nightmare.

A CD we can just passively read the bytes off, but if we want our keyboards to just work when we plug them in, then it's going to be harder to secure a supposedly dumb storage device.

Re: Kurt Got Got

#250

Post by windward »

tsimionescu wrote: post #217
windward wrote: post #187

Earlier quoted context omitted.

I've only seen it on Macs

Out of curiosity, how does that work if this is the only input method connected? Or is this only shown if you have another keyboard (and/or mouse) already connected.

Sorry, IDK, I've only used their laptops
Post reply on HN