Hacker News Reader

Comment by Sandman | Hacker News Reader

So the point of this article is that it's not stupid to plug in random USB sticks you find on the street? That's what USB sticks are for? What if you found a big slice of your favorite type of cake on a park bench, would you eat it? You wouldn't? Why not, hell, that's what cakes are for.

Picking up random USB sticks and sticking them into your computer is the equivalent of having sex with random people you meet on the street. The only thing you can hope for if you do that is that whatever you're having as protection is going to save you from catching something nasty. But by the time you find out if your protection actually protected you or not, it might already be too late.

I agree that it would be great if our systems could save us from anything and everything malware writers can come up with. But unfortunately, they can't, so our first line of defense should just be plain old common sense.

View on HN

I must confess that I plug in unknown USB sticks quite frequently, and even knowing the risk, I probably won't stop.

I work part-time at a reception desk (the computer has access to nothing important). The assumption seems to be that found USB sticks are suspicious, but they actually show up quite frequently. People lose their USB stick--usually in one of the lab computers. The overwhelming majority seem to be personal drives that people have lost. Often there are obviously non-confidential files ("Econ101Paper.odt") on the drive, and it's easy to contact the owner to let them know where they can find their lost drive.

The average user simply doesn't see USB sticks as malicious (recall how much pain it took until people generally recognized unknown email attachments as dangerous!) and is occasionally exposed to lost USB sticks that they can helpfully return. This is a problem that will not be fixed by user education, except perhaps in secure facilities where USB devices are prohibited completely.

It makes sense to have a dedicated kiosk machine, hardened, connected to nothing, and regularly re-imaged, to test unknown USB drives in. That's a little different from plugging one into the computer you do your work or finances on.

Humans have a lot of machinery dedicated to determining whether or not to eat a given piece of food. Bad food has been around as long as humans, so those without any equipment for detecting tainted food have long since died off. Hence, most people would not eat that cake on the park bench, because they have a lot of senses (physical and emotional) that tell them not to.

USB drives, on the other hand, have not been around for very long. When you plug in an evil USB stick, nothing bad happens. Maybe in a few years someone buys some shit with your credit card, and your bank has to send you a new one. That's about it, though, and that negative consequence isn't enough to override the curiosity intrinsic in humanity. So people find USB drives and plug them in, just because they are curious for a glimpse into other peoples' lives. See also: tabloids.

"(physical and emotional)"

It's rationality that stops one from not eating the cake. One's physical and emotional "sense" wil tell one to eat the damn thing (if it looks good!). Similarly, unknown USB sticks should be used rationally.

That's a good analogy to describe the current state of things, by why can't we aim for something better? For example, I would not be afraid to put a random CD in my CD player.

Maybe you should: http://www.itworld.com/security/139794/with-hacking-music-ca...

> Picking up random USB sticks and sticking them into your computer is the equivalent of having sex with random people you meet on the street

I can't tell if that's an awful analogy because people do it all the time, or a brilliant analogy, because unless you do it safely you will eventually catch something nasty.

All of a sudden picking up random USB sticks and sticking them into your computer sounds like a lot more fun than it used to.

I believe the point of this article is that if your system assumes that humans aren't stupid, then your system will fail. Blaming the humans for being stupid is no more useful than blaming rain for being wet. Shaking your head and saying that the system is fine because it was only defeated by people being stupid ends up missing the point.

Right. If 6% of people fell for this, shame on them. But if 60% of people fell for it, shame on the security team.

I can see your point, but think of it this way: No amount of security can protect against human stupidity. If I accidentally download and run an unknown application, and it asks for root privileges and I grant them, then if anything bad happens, I really can't blame the system. The system did exactly what it was supposed to do, it required the user to confirm the operation by entering the root username and password and if I did that then I explicitly granted this process to run as root. Same goes for surfing under an administrator account on Windows. Most malware these days is not successful because of their ingenious design (although there are such examples) but because they employed a successful social engineering tactic. I do agree that we should strive to create more secure systems, but I think that you can only go so far with that. In the end, users need to be educated not to grant root privileges to strange apps they just downloaded from the web or open weird-looking attachments they receive in their e-mail (even if the message seems to be coming from their friends). My point is that people should have the same amount of healthy cautiosness when surfing the web or handling unknown data storage as they generally have in their day-to-day lives.

Reply on news.ycombinator.com