Hacker News Reader

Comment by JonnyNova | Hacker News Reader

The US military is ass-backwards when it comes to dealing with technology.

Want to transfer files between computers? Can't use a thumb drive! You need to burn a disk (for real).

If you look deeper into the security issues of USB and it’s less surprising: beyond the risk of basic malware, the devices are usually hackable which makes really hard to be certain about anything. Cutting out whole classes of attack makes sense when you know you have highly-skilled, well-funded adversaries and the budget to simply write off the extra overhead. Remember that their threat model doesn’t end at “my dirty picture collection leaked” but “we lost a war” or “we have to ask Congress for 10e9+ dollars for repairs/replacements”.

This got a lot of attention a couple years ago:

https://www.blackhat.com/us-14/briefings.html#badusb-on-acce...

This kind of problem is endemic to small cheap devices, too – for example:

https://www.bunniestudios.com/blog/?p=3554

I'm intrigued.

Around here a lot of places don't allow USB drives, but .. I think that's mostly a "Do Not Steal Our Data" policy.

Not, my real question is: Does that make sense? People talk about USB HID things, but .. I would expect that most keyboards and mice these days are using USB. So if you find a way to block USB drives for mass storage aka "Do Not Steal Data" uses, are you still open for all the "I type in exploits because I'm not really a USB drive, I can be a keyboard too" things?

Do these places typically let you bring a mouse/keyboard from home?

They don't, but I'm confused how that matters.

Say you're in a "secure" place, where I'm not allowed to do stuff. You probably have keyboard/mouse connected via USB, right?

I can easily unplug them and insert my own, if you don't glue them in place. I did that in a number of internet cafes in the past.

> I can easily unplug them and insert my own, if you don't glue them in place.

Correct. If you're doing it right, you've blocked all unused ports, and you've glued in all used ports. Ideally having testing that the devices you're plugging in aren't already compromised first.

USB device fails and needs replacing? One place I worked disposed of the whole unit and bought a new computer to replace it, rather than dealing with glue removal. It's difficult to distinguish between legit and illegit tampering, so better to have no signs of tampering.

>They don't, but I'm confused how that matters.

>I can easily unplug them and insert my own [keyboard/mouse]

Can you see where the problem lies? For you to be able to insert your own kb/mouse, you'd need to bring it from home in the first place. And while it might work if you're at an Internet cafe which isn't super strictly controlled, in an office with more stringent security requirements and checks you'd at least raise some eyebrows.

I was talking about the risks of having a USB device (not a keyboard, nor a mouse) being able to _act_ as one, delivering payloads. It can look like a normal usb drive or be tiny like a yubico key.

My subthread started as a reply to "Want to transfer files between computers? Can't use a thumb drive" and I wondered if that on its own - disallowing data transfers by say blocking USB mass storage device drivers or something - is useful or enough, when anything I can connect via USB can _act_ as a keyboard for example.

At no point did I talk about bringing an actual keyboard or mouse anywhere.

At least 15 years ago I was told that the standard fix was epoxy: they’d pay a tech to chisel it off if the keyboard needed replacing rather than take the risk of unknown devices being plugged in.

Could this be taken care of at the computer end instead, having the computer not automatically run things from a drive? It seems to me like the natural way to resolve the problem.

The drive itself can be running code. That could hide malware until some trigger event, allow you to write a file which will be concealed, etc.

The drive might not be a drive but actually a program presenting as a keyboard that waits for a sufficient period of inactivity before performing a series of keypresses that runs arbitrary code and exfiltrates data off the back of that.

Not to mention lower level exploits that exist for USB.

USB devices get to move the mouse pointer, click, and send keystrokes.

It's up to the host to heed such commands, right?

How do you "pair" a bluethooth keyboard if you haven't plugged in a normal keyboard?

Install OS, plug in keyboard and mouse, turn off the automatic acceptance of any new such devices.

Alternatively, have the driver require that keyboards verify themselves with a digital signature from a trusted source.

That does't sound like terrible infosec.

Flash drives are a huge security vulnerability. With more secure workstations you can't plug in any USB peripherals, because they're such big risk.

Write only media is a lot safer, despite the waste it causes.

I'm pretty sure SD cards have a lot less vulnerabilities than USB sticks. Especially because they cannot pretend to be a keyboard.

They can still pretend to have / not have files so it’s hard to say that you’ve verified nothing sensitive is leaving or that no malware is coming in.

There's WiFi enabled SD cards[0]. I had one of those and it was running Linux, you could SSH into it. Maybe the attack-surface to the host computer is smaller (I'm not sure about that either). But there's certainly enough bad stuff an SD card could do.

[0] https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-...

Reply on news.ycombinator.com