Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one, not even the Secret Service, should randomly plug in a strange USB stick

techcrunch.com

Post reply on HN
Print view View original

81–90 of 231 posts

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#81

Post by robertAngst »

taneq wrote: post #62
conistonwater wrote: post #57

Earlier quoted context omitted.

That's kind of ingenious, but is sending temperature data over USB really such a hard problem in the first place? I'm not really familiar with the USB protocol.

USB doesn't work without a driver and sometimes you don't want to (or can't) install a driver. This sounds like the kind of hack that a clever (but arguably unwise) engineer would shove in to help them remotely troubleshoot a device. "Sensor not detected? OK, open up Notepad and hit Caps Lock three times quickly. Did some text appear? The sensor is fine, the problem is with your computer."

why is this unwise?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#82

Post by robertAngst »

q3k wrote: post #17
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

>It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions? Because up until 10 years ago, developing your own USB device was generally expensive and malicious devices ended up being out of scope in threat modelling. In addition, some models these days still define 'physical access == game over'...

>USB device was generally expensive

How expensive? USB is a protocol, a micro, and some power management.

How long ago was this 'out of scope'?

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#83

Post by novaleaf »

bdamm wrote: post #15
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing…

funny thing: my UPS also presents as a keyboard. and made my computer kept waking up from sleep at random intervals.

Very hard to troubleshoot.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#84

Post by runciblespoon »

Ha haa haaaa .. you can not be serious :]

‘Secret Service agent. Samuel Ivanovich, who interviewed Zhang Mar-a-Lago, testified at the hearing. He stated that when another agent put Zhang's thumb-drive into his computer, it immediately began to install files, a "very out-of-the-ordinary" event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any further corruption of his computer, Ivanovich said. The analysis is ongoing but still inconclusive, he testified.’

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#85

Post by kyle-rb »

jimrandomh wrote: post #48
delinka wrote: post #43

Earlier quoted context omitted.

great, now I've typed my password into what turned out to be a malicious device ...

You misunderstand. Malicious USB devices often present themselves to computers as keyboards, which type malicious commands. But they don't look like keyboards, or have keys on them; they usually look like USB storage devices.

Now I'm imagining someone dropping malicious keyboards instead of USB sticks, waiting for people to pick them up and plug them into their computers.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#86

Post by runciblespoon »

jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

> It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system.

Well, just the one OS vendor comes to mind and a particular chip maker also shares the blame. Just how difficult can it be to design-in total isolation into a 'computer'.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#87

Post by verst »

depressed wrote: post #64
verst wrote: post #52

I have a mysterious USB stick I received as a thank you from a delegation of the Chinese department of Customs (中华人民共和国海关总署) after presenting to them in Palo Alto. The USB is branded with the Chinese Customs logo and their slogan. I haven't dared plugging this in. First and foremost I'm afraid it isn't standards compliant and will somehow fry my motherboard, secondly I don't have a burner device and the necessary kno…

On the "determine if anything suspicious is happening" front, you can configure Wireshark to capture USB packets and show you what is going over the wire.

Oh nice! I've used Wireshark for TCP / UDP captures before but that's about it.

Maybe I can use a raspberry pi as burner device and check it out.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#88

Post by gowld »

markaz wrote: post #59
jimrandomh wrote: post #30

Earlier quoted context omitted.

Yes, there are corner cases (another commenter mentioned a temperature sensor, and I this is also common among barcode scanners). These corner cases are not hard to work out; just prompt the user and require them to confirm that the device is, in fact, allowed to act like a keyboard. (Which would mean you can still have malware-download-command-typers pretending to be barcode-scanners pretending to be keyboards, but…

I would guess that 99% of users would click ok for "Allow typing with this keyboard?" when they plug in a USB storage device.

I'd hope the Secret Service is in the 1%.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#89

Post by gowld »

delinka wrote: post #43
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

great, now I've typed my password into what turned out to be a malicious device ...

That's already a risk with any keyboard you use.

Re: No one, not even the Secret Service, should randomly plug in a strange USB stick

#90

Post by gowld »

peterwwillis wrote: post #31
jimrandomh wrote: post #4

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver sh…

Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need protection from advanced thieves you'll need to go through some extra hoops anyway. You could petition OS manufacturers to focus more on physical security, but there's limits to what you can do without piles of abstractions (ala smart phone security)

A human cannot vet an electronic device. We can only interface to it from another electronic device.

The same argument applies to the Internet -- we don't say that it's the human's responsibility to vet every website or email message before we let our computer connect to it. We expect our computer to do that. That's why it was wrong for Outlook to automatically execute every program sent to you via email.

Post reply on HN