Hacker News Reader

Comment by akira2501 | Hacker News Reader

> the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network.

Which is clever, but given the current level of small scale integration you could just as easily hide the same exploits inside of a charging cable, a USB fan, or really any other small-form factor USB-pluggable gadget. The problem isn't them discriminating between "hacked" and "non-hacked" devices -- it's them plugging _anything_ non work related or issued into their USB ports.

View on HN

Anecdotally, I heard of a toy radio control quadcopter belonging to western military personnel in Afghanistan that turned out to be trying to phone home to ${badguy} when they plugged it into a laptop to charge. This stuff is everywhere, and has been for years.

This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

Wouldn’t everything then only charge at 100 mA?

No, shorting the data pins signals "this is a charger, you can charge as fast as you want, until it's so much current that the voltage starts to drop too much".

Except when the device is designed to prefer chargers from $vendor. LG was notorious for this some years back.

Which is totally redundant because that can be done on operating system level, but hey, bottled water is a huge industry too.

USB drivers can still be vulnerable, though.

Epoxy can't break with a security update

you could warm it up and pick it out when soft though

Not if it's the right kind of epoxy...

Epoxy doesn't melt. It burns--at a temperature where your computer case starts melting.

How is that better than epoxy squirted into all unused ports of your existing computers while also distributing fast charging USB wall warts across the office like confetti? Even the good ones are relatively cheap, especially if bought in bulk. Relative to the cost of a desktop computer they're practically free.

(I'm genuinely surprised that the standard DELL and HP corporate workstation doesn't have its front USB ports deleted and its rear port access covered by a lockable metal cowl.)

How do you know the wall wart is not a fake one?

I noticed that with my mobile wifi (Huawei) which I generally leave plugged in, when my friend plugged in her Windows 10 tablet to the same power outlet (2 sockets), it suddenly noticed it as a new USB device. I don't ever plug anything in there except a charger for my bike light so had never noticed but I don't know if it has an autorun to install drivers they often do. Obviously the data wires are joined there..

How do you know your security guard is not a fake one?

At least on Dell, USB ports can be disabled in the BIOS (with separate options for front and rear ports). Disclaimer: I haven't tried to do it so I don't know if it actually works.

Caveat: you'll need to hire a lot more IT people because everyone in the company will be lined up out the door with complaints. "This computer doesn't work with my keyboard, I need a new one." "My mouse isn't working." "This computer won't read my flash drive and I have to get this file to accounting by 10:00!" "This computer isn't working with my pen tablet and the deadline for getting these graphics done is tomorrow!"

So you'll have to replace all of your intentionally-broken computers with good ones, which will cost a fortune on top of all the employees' lost work time and no one will want to buy the broken computers from you so you'll have to pay to have them scrapped.

Disabling USB ports, for example in the BIOS, is very common in larger corporations. Dell sell a secure cover to prevent access to the rear ports.

The person with the accounting data on a USB stick will get a formal reprimand for breaking the security policy.

You still need to hook up stuff to a computer - mice, keyboards, those weird 3D-mice our CAD people use, printers, and these days even displays are all attached to USB ports. And since the ports USB replaces have mostly gone, there is little alternative left.

At work, we keep a couple of power-socket-to-USB chargers around, if people want to charge their smartphone they can grab one. But simply disabling the USB ports on our users machines is not a realistic option at this point.

A previous employer would buy modified motherboards with the data traces removed/cut.

Reply on news.ycombinator.com