Dead Drops | Hacker News Reader

Dead Drops

deaddrops.com

29 pointszhte41523 comments

This has been around for a while, and given the vulnerabilities in USB stacks and OSes is somewhat dangerous. When it appeared over at Reddit someone called it a "USB glory hole."

Same thing applies to chargers in public places. You never know whether it's just a charger.

Do the "charge-only" USB cables fix this vulnerability?

e.g. http://www.amazon.com/PortaPow-Micro-USB-Cable-Charging/dp/B...

For chargers, yes. For getting data of a "dead drop", obviously not, and also not if someone connects high voltage or something crazy like that. Or someone manages to exploit the power management system by turning power on and off in just the right way, but that seems far-fetched.

These 'USB condoms' seemed like a novelty at first but now I'm thinking they're going to be standard travel gear.

http://syncstop.com/

formerly

http://int3.cc/products/usbcondoms

Are there any kind of restrictions or requirements that would ensure that a random embedded USB flash drive in the side of a wall in a dark alley would not contain BadUSB exploits, keyloggers, etc.? I kinda assumed initially that this was an extension of the creator's original art project, but it seems like people are actually using these--the security concerns far outweigh the novelty, in my mind.

Came here to say the same thing. With BadUSB and other such exploits, what a way to get pwned.

There are "USB condoms"[0] that let you only use the power pins of USB, but sadly that is not applicable to this concept.

[0]: http://int3.cc/products/usbcondoms

I'm going to assume that there's no way for the creator to enforce this, anyway - but is there any way to access one of these without endangering your machine? I'd rather not use a burner-laptop every time I try to see what's on these guys.

I'd say it's pretty risky either way, but you could insulate yourself from risk somewhat by using a raspberry pi with a fresh image on the SD card each time.

Also, if it's possible to run a raspberry pi from a write-protected SD card (and assuming that SD-card write-protection hardware switches are actual hardware disables not something that just sets a flag that the software can ignore), then you may not need to clean the SD card every time either.

I would assume that it's possible, especially with a Linux laptop, to prepare a USB port to simply mount a drive and not do any of the other magic (like installing human interface devices, or whatever) that leads to vulnerabilities.

Assuming you could get a secure USB controller. It should be possible to tell the OS to only allow a USB Mass Storage device to connect on a particular bus for a particular period of time.

For a more interesting project that resembles a "anonymous, offline, peer to peer file-sharing network in public space" -- but is in fact much more useful, see Edgenet:

proposal: http://cultureandempire.com/html/edgenet.html

slides: http://cultureandempire.com/edgenet.html#/2/1

(funded) indiegogo project: https://www.indiegogo.com/projects/edgenet

• LibraryBox [1] is an open source, portable digital file distribution tool based on inexpensive hardware that enables delivery of educational, healthcare, and other vital information to individuals off the grid.

[1]http://librarybox.us/

• PirateBox [2] is a DIY anonymous offline file-sharing and communications system built with free software and inexpensive off-the-shelf hardware.

[2] http://piratebox.cc/

The map search doesn't seem to work at all - "New York City, NY" decodes to 0.00, 0.00, apparently.

Also, the full-size image for the Union Square Dead Drop[1] is ... not very full-size: https://deaddrops.com/db/images/fullsize/32/935838.jpg

[1] https://deaddrops.com/db/?page=view&id=32

Seeing as this project is 5 years old, I'm curious how many of these are still functioning? None, I would guess, since it seems like more of an art project... but still, I'm a little curious. Is anyone close to any of these that could test them out?

I'll try to find some of the ones in New York.

It would be nice if there was a "confirm" button, to confirm that the drop was still present.

(Maybe just clicking "submit" while the dropdown says "working" does it? Don't want to test this.)

I embedded one into a wall in my neighborhood. It lasted about two weeks before it completely oxidized.

That's about what I had thought would happen.

Every one I've tried in SF doesn't exist anymore.

This seems like a great way to share viruses.

Yes, it seems like the computing equivalent of a glory hole.

the piratebox project is much better http://piratebox.cc

Why not use a burner running Linux?

Reply on news.ycombinator.com