Hacker News Reader

Comment by wowokay | Hacker News Reader

Idk it’s basic workplace trading now, I think most people plugging in a random usb here are at least doing it in an isolated VM or something.

View on HN

Maybe in San Fransisco, US it's basic workplace training, but outside of very technology focused cities, people definitely don't know how easy it is to be compromised by a USB is.

Most computers in various places like hospitals, veterinarians, shops, gyms and more all have exposed USB ports where it'd be trivial to plug something in when the clerk/assistant is looking the other way, just as another example.

In a isolated VM? No way. Most people don’t know what a VM is. Hopefully most people wouldn’t plug a random USB into their computer, but I suspect that (# of people who would plug in a random USB) > (# of people who know about VMs)

Even among the people who "know about VMs" how many of them could confidently plug in a physical device to a physical machine and be sure that it was somehow isolated to the VM? I must have a dozen ways to run VMs here, but I couldn't do that.

What is the most common attack vector to fear? I thought maybe auto-run had been disabled by default, in most modern versions of Windows, for the past 10-15 years at least.

If you plug a USB keyboard, windows will automatically set it up. All the stick needs to do is emulate a keyboard, then it can send keystroke to the OS as yourself, no need for auto-run.

Reply on news.ycombinator.com