Hacker News Reader

Comment by rdtsc | Hacker News Reader

> This seems apocryphal.

I have no reason to believe the person I worked with would make it up. There would just be no point in it.

> Its trivial to disable USB for a mass storage (or all devices)

Except there are hundreds of different kinds of devices, and you tasked with quickly "doing something to fix the problem". Do you have time to go and dig through different types of BIOS menus or open the cases to all of the machines. Or is it easier to get epoxy plungers and send an army of people from desk to desk. Normal epoxy is a pretty decent electrical insulator (some board or components used to even be dipped in epoxy to protect from environmental damage or tempering).

> I suspect you've never managed a non-trivial network before,

No, but I was selling a solution with one in it. And $40k was making a decent size cut in the profit margin.

View on HN

Why not just unplug the USB header if you want a physical solution? The idea that you're shoving glue in there is incredibly ridiculous. You can chip that off easily with your finger or a key. I seriously doubt this is a real story because it flies in the face of published STIGS and basic common sense. Nor would it stop a remotely determined attacker/idiot.

That said, I could see glueing a panel to block them as a visual to remind people that those ports are off, but not as a primary blocking device. More than likely its done via security policy.

> You can chip that off easily with your finger or a key.

Because it was more of a reminder for stupidity. "Oh, look there is glue in there, that's right we not supposed to stick random USB devices in there". If the machine is on their desk, yes, they could plug in a PCI device that has an USB thing on it and still connect. But by that point they are really going out of their way, they are opening the case and such, and it will be very hard to maintain the idea that it was just a stupid mistake.

Exactly. The other related threat is the new junior admin being asked by a senior exec to allow (windows policy-wise) the USB storage just temporarily. "Because I need this presentation NOW as I have to get to the airport in 45 minutes!

They epoxied the USB ports on my secure machine when I worked at one of the national labs about 12 years ago. One day I came in and the admin had gone through everyone's office the evening before with a bunch of JB weld to fill the USB ports.

So, whether or not you believe that it is a useful solution, it certainly did happen. As for alternatives to gluing, I assume that was time related: filling in a port is certainly faster than opening thousands of machines to give them a physical port-ectomy.

Port-ectomy: a new word in my dictionary, must remember to use it someday!

Rear USB ports are not attached to the motherboard via trivially removable connectors.

It also really is not trivial to chip off most types of even general-purpose epoxy with your finger on a flat surface, let alone a tiny USB port which your finger doesn't fit in. If the epoxy was selected with some level of care, it may be very, very time consuming, or nearly impossible to remove, even with the right tools.

No matter what, it's a helpful measure in addition to every other way you can also disable a USB port.

Reply on news.ycombinator.com