Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

251–256 of 256 posts

Re: Kurt Got Got

#251

Post by pas »

eru wrote: post #248
pas wrote: post #237

Earlier quoted context omitted.

Are we still at the "Bill Gates got a BSoD during the demo of USB" level? I know that at least on Linux mounting filesystems can lead to nasty things, so there's FUSE, but ... I have no idea what distros and desktop environments do by default. And then there's all the preview/thumbnail generators and metadata parsers, ...

One big problem with USB is that something might look like a storage device to the human eyes and hands, but it's actually a keyboard as far as the computer is concerned. The U stands for Universal, and it's awfully convenient, but it contributes to the security nightmare. A CD we can just passively read the bytes off, but if we want our keyboards to just work when we plug them in, then it's going to be harder to sec…

Sure, and it can be any kinds of device, and ... it can trick the OS to loading strange drivers (with juicy vulnerabilities), but that's the point. How the fuck is this still the norm? (Despite user mode driver frameworks!?)

Re: Kurt Got Got

#252

Post by zahlman »

JdeBP wrote: post #245
zahlman wrote: post #241

Earlier quoted context omitted.

Sure, but who's going to pick up a random USB-to-SD adapter from the parking lot and plug that into a computer? The point of the USB key experiment is that the "key" form factor advertises "there is potentially interesting data here and your only chance to recover it is to plug this entire thing in wholesale".

You're moving your own goalposts, by now restricting this to a storage device that is fitted into an adapter to make it USB. There is no requirement to limit this to USB, however. They'll pick up the SD/TF card and put it into a card reader that they already have, and end up running something just by opening things out of curiosity to see what's on the card. One could pull this same trick back in the days of floppy d…

> You're moving your own goalposts... This isn't a USB-specific risk

I'm not, because I am talking about a USB-specific risk that has been described repeatedly throughout the thread. In fact, my initial response was to a comment describing that risk:

> A USB can pretend to be just about any type of device to get the appropriate driver installed and loaded. They can then send malformed packets to that driver to trigger some vulnerability and take over the system.

The discussion is not simply about people running malware voluntarily because they have mystery data available to them. It is about the fact that the hardware itself can behave maliciously, causing malware to run without any interaction from the user beyond being plugged in.

The most commonly described mechanism is that the USB device represents itself to the computer as a keyboard rather than as mass storage; then sends data as if the user had typed keyboard shortcuts to open a command prompt, terminal commands etc. Because of common controller hardware on USB keys, it's even possible for a compromised computer to infect other keys plugged into it, causing them to behave in the same way. This is called https://en.wikipedia.org/wiki/BadUSB and the exploit technique has been publicly known for over a decade.

A MicroSD card cannot represent anything other than storage, by design.

Re: Kurt Got Got

#253

Post by yencabulator »

scq wrote: post #189
rm445 wrote: post #178

Earlier quoted context omitted.

I think the claim is that plugging in the USB device is enough. If people needed to try running an executable from the device, some devices would still be compromised, but with lower frequency. I don't know exactly what happens. Automatically-triggered 'driver' install that is actually malware? Presenting as a keyboard and typing commands? Low-level cracks in the OS USB stack? It feels to me more like OSes ought to b…

Usually presents as a keyboard that types commands, yeah. Win-R -> powershell -> execute whatever you want. E.g. https://shop.hak5.org/products/usb-rubber-ducky

Still fits "It feels to me more like OSes ought to be more secure."

New USB-HID keyboard? Ask it to input a sequence shown on screen to gain trust.

Though USB could be better too; having unique gadget serial numbers would help a lot. Matching by vendor:product at least means the duplicate-gadget attack would need to be targeted.

Re: Kurt Got Got

#254

Post by x0x0 »

tptacek wrote: post #226
parliament32 wrote: post #223

Earlier quoted context omitted.

I certainly see you whining a lot about SAML in your history. This lines up with my "SAML is hard" comment above -- SAML is filled with footguns and various perils, but that doesn't necessarily make it bad. OIDC is certainly better in a few aspects (note trading XML parsing for JSON parsing is not one of them), but the killer SAML feature that you (and by you, I mean fly.io, to be clear) is missing is being IdP-agnos…

"SAML is filled with footguns and various perils" is in fact why it's bad. You don't look at an archaic cryptosystem full of design flaws and go "skills issue". The "skills issue" would be using it at all. Sorry, SAML is dead.

But also too almost every vendors implementation is subtly different!

Re: Kurt Got Got

#255

Post by roblabla »

zahlman wrote: post #252
JdeBP wrote: post #245

Earlier quoted context omitted.

You're moving your own goalposts, by now restricting this to a storage device that is fitted into an adapter to make it USB. There is no requirement to limit this to USB, however. They'll pick up the SD/TF card and put it into a card reader that they already have, and end up running something just by opening things out of curiosity to see what's on the card. One could pull this same trick back in the days of floppy d…

> You're moving your own goalposts... This isn't a USB-specific risk I'm not, because I am talking about a USB-specific risk that has been described repeatedly throughout the thread. In fact, my initial response was to a comment describing that risk: > A USB can pretend to be just about any type of device to get the appropriate driver installed and loaded. They can then send malformed packets to that driver to trigge…

SD/MMC does restrict things a bit, however:

1. SD is not storage-only, see SDIO cards. While I don’t think windows auto-installs drivers for SDIO device on connection, it still feels risky.

2. It’s worth noting stuxxnet would have worked equally well on a bog standard SD drive, relying only on a malformed file ^^.

I wouldn’t plug a random microsd in a computer I cared about.

Re: Kurt Got Got

#256

Post by pabs3 »

corndoge wrote: post #229
pabs3 wrote: post #190

Earlier quoted context omitted.

You can do Passkeys entirely in software with KeePassXC.

Let me preface this by saying I use passkeys with KeepassXC. According to WebAuthn, this is not true. Such passkeys are considered "synced passkeys" which are distinct from "device bound" passkeys, which are supposed to be stored in an HSM. WebAuthn allows for an RP to "require" (scare quotes) that the passkey be device bound. Furthermore, the RP can "require" that a specific key store be used. Microsoft enterprise f…

Hmm, I thought there was some form of attestation involved? Is it really as simple as spoofing the device ID? Do you have any more info/links on the spoofing?
Post reply on HN