No one, not even the Secret Service, should randomly plug in a strange USB stick

There are some implementation details that the KVM maker would have to get right, but if they don't screw it up, it all works as expected.

Good KVMs already look at the keyboards they have connected, present separate virtual keyboards to connected computers, and route keystrokes explicitly based on state. You just need them to count the keyboards connected to them, and present a separate virtual keyboard for each downstream connected keyboard, so that the connected computers can tell which keystrokes came from which keyboard.

And because the 99% use case is: "I plug it in and I want it to just work"

This type of protection parent is referencing is "endpoint protection" and there are many industry standard solutions. Why should an OS be more limiting? If you have physical access to a machine that stores things you shouldn't have access to, it's already compromised in my opinion. Why the eff are people overlooking physical security in 2019 is the better question.

The key thing to realize is that malicious USB devices get to choose which device they identify themself as to the operating system, but have much less control over what they physically look like to the user.

If you plug in an old printer, you know you just plugged in an old printer; you can load the old-printer device driver and it probably won't exploit it. But if you plug in a USB stick you found in the parking lot, and it asks you whether you just plugged in an old printer, then the game is up; you know it's a tricky device, pretending to be something it's not in order to target a security vulnerability.

Eeewww. Why not just make it a virtual com port, which most computers already have drivers for?

The keyboard trick is quite a hack, but creative. At the same time afaik most barcode scanners also act as keyboards, you scan a number, it "types in" those numbers.

I can't see how the filesystem hack would work, if the OS has the drive mounted, it would cache files in memory, and not notice the file contents changing. You can't even modify the metadata, because most of that might also be in memory.

That's kind of ingenious, but is sending temperature data over USB really such a hard problem in the first place? I'm not really familiar with the USB protocol.

funny thing: my UPS also presents as a keyboard. and made my computer kept waking up from sleep at random intervals.

Very hard to troubleshoot.

I've use those as well, bit of a pain to work with in non keyboard mode but they are at least accurate enough.

You can actually use the USB hid class to present pretty much any data in any way you want. The reason they present as a keyboard is probably so they don't need to worry about drivers. With newer versions of windows I think you can work with such hid devices without special drivers though.

Seems like the core problem is a single standard for many different kinds of devices, which makes it possible for devices to act totally different from what it physically appears to be.

Maybe we should have stuck to PS/2 keyboards after all.

>USB device was generally expensive

How expensive? USB is a protocol, a micro, and some power management.

How long ago was this 'out of scope'?

You would only need the password-auth to bootstrap your primary keyboard. If you already have a keyboard you can just accept the prompt.

Yes, there are corner cases (another commenter mentioned a temperature sensor, and I this is also common among barcode scanners). These corner cases are not hard to work out; just prompt the user and require them to confirm that the device is, in fact, allowed to act like a keyboard.

(Which would mean you can still have malware-download-command-typers pretending to be barcode-scanners pretending to be keyboards, but you can't have malware-download-command-typers pretending to be storage devices pretending to be keyboards, because the "Allow typing with this keyboard?" dialog will give it away.)

This was super easy to setup in Ubuntu, thanks!

If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.

It’s largely shortcomings of “modern” OS designs and hardware. Things like kernel-space drivers and dma for peripherals make it very hard to have any reasonable level of protection.

> This is likely not enough to secure a system against a sufficiently skilled adversary.

That statement is not helpful, because it remains true for any security measure.

The GP suggestions can make everyone's computers more secure now, at what would seem to be a low cost...

Yes, there will likely still be ways for a malicious USB device to use electrical side-channels to attack a connected computer. But devices like that will be much harder to develop. And more importantly: compromised devices which weren't originally designed to do that, won't be able to rewire themselves into side-channel-exploiters. So if my USB storage device has a firmware vulnerability, and a malicious computer reprograms it, it won't be able to use electrical side-channels to attack my other computers because it doesn't have a suitable DAC and ADC.

A human cannot vet an electronic device. We can only interface to it from another electronic device.

The same argument applies to the Internet -- we don't say that it's the human's responsibility to vet every website or email message before we let our computer connect to it. We expect our computer to do that. That's why it was wrong for Outlook to automatically execute every program sent to you via email.

> it's your responsibility to vet what you plug into it

Okay, please explain a little more. I'll give you a concrete example of a device to work with.

Last week I accidentally left my usb flash drive at a coffee shop with some important files on it. When I went back, the coffee shop had it in the lost and found. It looks the same on the outside, but it's a mass-produced model.

How do a vet this hardware before plugging it into my computer? I do need to access the files on it, but also attackers may have had access to it for several hours.

You only need to authenticate a device once, when you first acquire it, or after it is tainted due to loss of physical control. This is how Bluetooth works today.

You misunderstand. Malicious USB devices often present themselves to computers as keyboards, which type malicious commands. But they don't look like keyboards, or have keys on them; they usually look like USB storage devices.

That's already a risk with any keyboard you use.

Better late than never?

https://www.phoronix.com/scan.php?page=news_item&px=Linux-5....

https://usbguard.github.io

Definitely a good start but in a targeted attack scenario that's pretty trivial to bypass, if someone brags about having the latest Das Keyboard or something that's all it'd take... we need cryptographic authentication in the USB specification or at least a randomized serial that'd be unique per device so an attacker would need physical access to clone your keyboard.

I believe modern Thunderbolt already has this sort of cryptographic device authentication, which means not only physical access but at least a bit of reverse engineering skill, a much higher barrier than knowing their keyboard model.

Seat belts and airbags don't save you in all cases, but we use them.

This is why Steve Jon's wanted all peripherals wireless ;-)

www.fiftythree.org/etherkiller/

Miniaturized wireless electronics is the Ice IX that will destroy civilization

wikipedia.org/wiki/Ice_IX

> You could do similar things with a USB stick. You could have a high voltage converter which fries your PC the second you plug it in.

See https://hackernoon.com/this-3-diy-usb-device-will-kill-your-...

I suspect you're arguing from the point of view of a determined attacker against a specific target, in which case, I agree -- there's an infinite number of different attacks you can try, with the caveat that any failed attempt is possibly going to tip your target off and make them up their opsec game, becoming a much more difficult target.

I took the OP to be talking more about general case. Random people plugging into a public recharge station, using (shady) Amazon/Ebay USB drives, plugging in a "found" USB stick, etc. The OS can at least help thwart simple attacks here.

In the worst case, the device contains a GSM modem which is powered by USB but otherwise only appears to the host as a USB drive -- and if you can get the target to write useful data to it, I guess you have something? That's an awfully expensive attack that I would assume has relatively low chance of yielding something useful. (Unless maybe you market it as a "secure cryptocurrency wallet", and hope you can sell enough to people that then put on enough cryptocurrency to make up for the significant manufacturing expensive which you're able to steal before anyone notices there's a modem in it and sounds the alarm..)

> You could do similar things with a USB stick. You could have a high voltage converter which fries your PC the second you plug it in.

This has not only been done, it is a commercial product: https://usbkill.com/

While being obnoxious and causing one (random?) person some money (presumably they will destroy or throw out this USB drive aftward), it doesn't really get you anything. There's many other cheaper ways to destroy someone's computer, as there are many other things you can destroy to cause a person expense and/or inconvenience.

> Basically, it is always a bad idea to plug in unknown peripherals to your computers. The OS isn't going to save you in all cases.

100% agree, but that doesn't mean it shouldn't try at all.

> USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written

I won't copy my data on unknown device. Mics and cameras trigger prompts in MacOS. The keyboard device on the other hand, can be used for 5 seconds walk by attack, running install scripts (Bad USB) attack.

>Am I the only one old enough to remember 'disk bombs' from the 90s where you filled 3.5" floppies with paste made from strike anywhere match heads so when the disk spun up it melted?

Damn dude that really worked? I remember reading about it in the anarchist cookbook but didn't go through with the effort after getting thoroughly punked re: smoking banana peels and trying out pressure points on older kids

Would plugging it in through a USB hub on an old laptop running Linux not be sufficient?

Edit there is usbguard too:

https://usbguard.github.io/

In Linux, you don't even need to recompile the kernel. You can simply pass the "nousb" parameter at boot.

Then in a walk-by attack the attacker can just type the number or play the game. Hopefully they wouldn't know the user's password.

The reason for it to be the user's login password is that, in the common case where you plug a keyboard into a computer that's just booted or which has been unattended for awhile, you're already typing a login password, so it isn't making you do anything you weren't doing already.

Well, the head of USSS was fired today. Unclear if it's related.

Well, they are supposed to.

"The Secret Service agent who questioned Ms. Zhang after her arrest, Samuel Ivanovich, said during testimony... [h]is four-and-a-half hour interrogation of Ms. Zhang was recorded by video... but it lacked sound because he didn’t realize that the agency’s office in Palm Beach didn’t have that capability." [0]

[0] https://www.nytimes.com/2019/04/08/us/chinese-woman-mar-a-la... ¶12

Outside the Silicon Valley bubble, cybersecurity means Windows antivirus products, password policies, caution around unsolicited email, etc. Maybe the most sophisticated users of the term have a dim idea of what encryption means. When a government agency has "sophisticated cyber capabilities" I would generally take that to mean reams of paperwork asserting that Norton is properly installed on every desktop.

The whole dimension of vulnerabilities and exploits, protocol flaws, trust boundaries, techniques for selecting or creating less vulnerable software, getting crypto implementation details right, principle of least privilege... none of that stuff even registers. I briefly worked in an IT consulting company that sold security and PCI compliance services; nobody was talking about any of that stuff. It was all password policies, antivirus products, phishing awareness campaigns.

The government definitely has real computer security engineering work happening in the NSA, NIST (FIPS 140-2 in particular is no joke), and other very high end defense-related areas. But I would not generally expect people using the word "cyber" to have a fighting chance against a nation-state-level evil USB stick.

Or the USBNinja that crams that functionality into a cable identical to major vendors, and is triggerable up to 100m away via Bluetooth.... https://lab401.com/products/usbninja

An out of the box Linux installation with a few changes should be enough. Though you should probably use a hardened distribution. The above poster basically listed the final steps. Go to the kernel and build a white list of valid USB devices (the machine's keyboard and mouse) to prevent it from talking to a "keyboard" you plug in. Turn off auto-mounting features, record traffic so you can double check. And keep the machine physically airgaped.

Why? At least around here both of those sectors are still dominated by Windows with very few exceptions. Plus, in the specific incident, we're talking about a ressort. The likelihood of that having valuable targets for data exfiltration running anything other would be slim to none (with maybe the exception of the odd router, wifi AP or similar that you'd have to know details off beforehand to attack).

Also keep in mind that the most likely accessible targets would be end user type machines, in that area I'd understand if you carry something exploiting a Mac but Linux? That's just virtual dead weight.

There are quite a few usb descriptor related exploits.

e.g. https://www.cvedetails.com/cve/CVE-2013-3200/

Look, I hate Trump as much as the next guy(or gal) but do we really have to make EVERYTHING about trump.?

Great plot device. When a certain file is opened, the nerve gas is released. Or when a file is saved with certain text or properties (author, etc).

However, I'm doubtful that a small USB drive would have enough volume to be effective. Wouldn't matter on TV though.

Oh nice! I've used Wireshark for TCP / UDP captures before but that's about it.

Maybe I can use a raspberry pi as burner device and check it out.

Fortunately I live alone and I can't remember the last time I used a USB drive. I have Gigabit Fiber so I transfer everything online.

Or a high-level agent. There are many dimensions where level is independent of tech savvy. I'm sure >50% of Fortune 500 CEOs could be tricked in the same way -- at least among the ones who use a computer.

Aha, I missed that piece of the puzzle. Thank you.

That's exactly how I travel to tech-related summits around the world, and I have nothing to do with espionage I assure you.

I have 3 cellphones - one private (family calls, face time etc), one CDMA phone and one separate GSM for the most of EU countries. And external SSD drive with all my important backups and projects that would take forever to download off of DropBox. And yes - recently even cheap signal detector, as I don't want to be watched in my hotel room, even only for "security reasons" as to whether I will demolish the room or not. (call me paranoid but so was I before Snowden files and I was proven right)

I usually carry about $3,000 USD total in different currency - usually 20% AUD, 20% CAD, 30% USD and rest EUR/GBP. Trust me so many times paying with cash comes to be much cheaper, and at some occasions the only way to go!

Yes, thumb drive too; usually empty so that if I am at the meeting and someone wants to send me some heavy files, I can give them my thumb and viola!

If all this makes me a spy then I definitely need to change my profession :|

Most of that is what was in her hotel room, not what she was caught with.

It sounds like they had a computer specifically configured for analysis of drives. I'm going to guess that's not just Agent Smith's normal computer he/she uses to write reports, email, etc. In which case, taking out the drive was an unnecessary reflex as the malware wouldn't get much traction on a system isolated from others and not used for much else. But I could also be wrong, I'm just speculating. Which is my point-- that's all the article was doing too, speculating.