31–40 of 42 posts
Earlier quoted context omitted.
This strikes me as the right solution, with two caveats: • It should allow the keyboard through—or have a timeout that defaults to "yes"—if a mouse or keyboard is not already connected. • I should have the option to disable it.
desktops and servers could have special "root ports" physically colored red and hidden at the back of the case that don't require permissions.
As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether. I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what securit…
But it just completely trusts any USB device I plug into it to do whatever. I wonder how much work it would be to have it ask for the user to type a randomly-generated passcode before accepting input from a new USB device?
Earlier quoted context omitted.
I once worked at a place where the keyboard and mouse were chained to the tower and glued in place, and the spare USB ports were glued over.
What happens when you spill coffee on your keyboard?
?
Generally though, places that I've worked at with the same restrictions, also don't let you have liquids at the desk with said stations.
I've been in plenty of machine rooms where liquids == fired/escorted from the building.
Earlier quoted context omitted.
I once worked at a place where the keyboard and mouse were chained to the tower and glued in place, and the spare USB ports were glued over.
What happens when you spill coffee on your keyboard?
At Defcon, a buddy of mine screwed around with a bluetooth HID device, that when connected to, would automatically attempt to open a webpage and send them to an innocuous site (Which obviously could have been a less innocuous site). Couldn't believe we got multiple people to connect to it under the guise the device would do a cool thing.
Well it is a cool thing. It’s different and that makes it interesting. Sometimes I feel like all this worrying about computer security makes it harder for people to share new things.
It's one thing to theorize, discuss and build something dangerous, it's another to actually use it.
See Flamethrowers.
Earlier quoted context omitted.
A simple system like android fine grained permissions? is asking to send keyboard input. Allow/Deny?
This strikes me as the right solution, with two caveats: • It should allow the keyboard through—or have a timeout that defaults to "yes"—if a mouse or keyboard is not already connected. • I should have the option to disable it.
Hasn't this been known for half-a-decade? I mean, it's a product you can literally buy and it's impossible to adequately defend against. https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads https://shop.hak5.org/products/usb-rubber-ducky-deluxe
And i'm pretty sure using this exploit for totally benign marketing purposes is a new one.
I want to say it even lets you disable or whitelist usb keyboards/mice entirely but I’m not 100% certain.
QubesOS is pretty different from other OSes though, I wish those sorts of device isolation were possible or more easily accomplished in other operating systems.
Earlier quoted context omitted.
I thought about disabling ports, and on some machines I do, but for the most part there would be mutiny if people couldn't charge their phones or use USB sticks for legitimate purposes. I try instead to make sure everyone is skeptical and weary of everything technology related+the corporate network. I'm in the process of creating a USB drop-test script for employee training purposes. Awareness and preparedness traini…
For phone and device charging, go purchase a bunch of reputable 2 - 4 port chargers and cables and set a policy that phones at other devices should never be plugged into computers. If you want to really dissuade people, add to the policy that the full contents of any phone plugged into a company computer may be silently downloaded and examined by IT. If the corporate network you're talking about is Windows Active Dir…
And with some of the crazy hardware[1] out there for retrofitting antique equipment with modern functionality; blanket encryption is not always possible either. The cited USB emulator requires that the USB stick be formatted into hundreds of minuscule FAT partitions, simulating floppy disks images and all the documentation comes in one language: Engrish. After that the machines will only load programs that follow a certain naming convention/format/ect... [1]http://www.gotekemulator.com/
So the choices for many organizations are; a) upgrade dozens of custom pieces manufacturing equipment so that they're securely networkable at astronomical cost (if it's even possible). b) Air-gap all the old scary stuff running on ancient OSs & proprietary PLC drivers from god-knows-where and only talk to them via USB/direct interfaces and worry about them when they break.
Earlier quoted context omitted.
This strikes me as the right solution, with two caveats: • It should allow the keyboard through—or have a timeout that defaults to "yes"—if a mouse or keyboard is not already connected. • I should have the option to disable it.
If there's a monitor, you don't need to trust the first keyboard—just display a message with "type this [random] code to allow this keyboard."