Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

281–290 of 358 posts

Re: Found hooked up to my router

#281

Post by majewsky »

LeonM wrote: post #273
DoubleGlazing wrote: post #252

Earlier quoted context omitted.

I was at a financial software firm that dealt with USB security issues by filling the USB sockets with epoxy. The keyboard and mouse could not be removed from their USB sockets as they were held in place with a metal collar bolted to the case. Simple and effective, although it destroyed any resale value of the PCs.

Do businesses (other than super small startups) actually sell their old hardware? Genuinely curious.

In my company (Fortune 500), we get new notebooks every 3 years and IT persistently pesters owners of old notebooks to return them. Given the sheer number of devices, I can imagine a reselling contract to be a nice additional source of income.

Re: Found hooked up to my router

#282

Post by protonfish »

deytempo wrote: post #163
Merad wrote: post #106

Earlier quoted context omitted.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?

Yeah, it irks me that this is seen a "stupid users" problem when our OSes are programmed to automatically execute code on a USB stick. I don't think the users are the stupid ones in this scenario.

Re: Found hooked up to my router

#283

Post by deadmanwalking »

Merad wrote: post #181
sjwright wrote: post #167

Earlier quoted context omitted.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…

I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.

Work at a fortune 500 company, we're currently eliminating USB ports for data devices - but leaving them open for other devices that do not identify as media.

We are dragging people to a corporate cloud solution, however we are finding that the drive to cloud has severely underestimated the volume of data that people will sync across the network, and how much work is done outside official corporate systems and in Excel instead.

This is having 2 effects our network capacity is being drained, and users are reporting performance issues due to latency associated with poorly developed excel applications.

Re: Found hooked up to my router

#284

Post by michaelt »

rjmunro wrote: post #277
mike-cardwell wrote: post #237

Earlier quoted context omitted.

If the site is non-SSL, then there's nothing stopping somebody in control of the network from replacing all "password" fields with plain "text" fields, and then applying a custom font to them so every character entered is displayed as a "•"

That's basically what a password field already is. That would make no difference to anything - the password would be sent over the network in exactly the same way either way.

Right, but some browsers display a small warning message when you select a password field on a non-https page [1]

If instead of a password field it's a text field with a custom font, no such warning will be presented.

[1] https://blog.mozilla.org/security/2017/01/20/communicating-t... http://http-password.badssl.com/

Re: Found hooked up to my router

#285

Post by cesarb »

sjwright wrote: post #165
illumin8 wrote: post #143

Earlier quoted context omitted.

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

How is that better than epoxy squirted into all unused ports of your existing computers while also distributing fast charging USB wall warts across the office like confetti? Even the good ones are relatively cheap, especially if bought in bulk. Relative to the cost of a desktop computer they're practically free. (I'm genuinely surprised that the standard DELL and HP corporate workstation doesn't have its front USB po…

At least on Dell, USB ports can be disabled in the BIOS (with separate options for front and rear ports). Disclaimer: I haven't tried to do it so I don't know if it actually works.

Re: Found hooked up to my router

#286

Post by osrec »

earenndil wrote: post #183
osrec wrote: post #177

Earlier quoted context omitted.

Do they? I don't think so... Try http://login.ebiquity.com Do you see any warnings in your browser? I see no warnings in Chrome.

This is shown in firefox: https://files.catbox.moe/srdxhe.png

Interesting. With the latest version of Chrome on Linux I see no warnings whatsoever...

Re: Found hooked up to my router

#287

Post by cesarb »

colejohnson66 wrote: post #150
illumin8 wrote: post #143

Earlier quoted context omitted.

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

Wouldn’t everything then only charge at 100 mA?

No, shorting the data pins signals "this is a charger, you can charge as fast as you want, until it's so much current that the voltage starts to drop too much".

Re: Found hooked up to my router

#288

Post by justinclift »

Evidlo wrote: post #175
deytempo wrote: post #163

Earlier quoted context omitted.

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?

Proof of concept: https://samy.pl/poisontap/

Reading through the sequence of what that does... nasty piece of work that. And kind of brilliant.

Re: Found hooked up to my router

#289

Post by hunter2_ »

tomsmeding wrote: post #276
mijowi wrote: post #244

Earlier quoted context omitted.

Of course it's not real. Its a subdomain of chase.com. Parent should've said something like chase.evil.com.

If the user hasn't visited the subdomain evil.chase.com yet, a http downgrade attack ( https://news.ycombinator.com/item?id=18090419 ) would maybe work.

That's not a downgrade, but a lack of upgrade. A few comments back said https://evil but it would have to instead be http://evil assuming no rogue root cert is installed.

And requires that if the user had visited chase.com, that chase.com not have includeSubdomains in their HSTS header.

Re: Found hooked up to my router

#290

Post by lllr_finger »

sjwright wrote: post #203
Merad wrote: post #181

Earlier quoted context omitted.

I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.

Maybe someone needs to invent a USB-based thumb drive reader that only allows generic mass storage devices to be attached but does not work as a hub, rather as a proxy device. Bonus points: don't mount the drive directly, instead connect it to a centralised server on the corporate network that scans for threats and mounts a sanitised version of the drive's contents as a network share. Triple word score: audit everyth…

Your triple word score is already handled by a dozen different companies doing endpoint security from advanced heuristics at the kernel level like Crowdstrike, or just filenames and hashes like Code42.
Post reply on HN