FounderSec

Thanks! There are a ton of other things you can do, but I find once you start moving into that territory, you're in power user space, and if a normal person can't get google docs to work, they're likely to throw the baby out with the basket haha.

Good tips for all new folks to freelancing. Especially feedback cycles and re-evaluating scope regularly.

LUKS is great on Linux, and with most of the big Linux distros (Ubuntu, Fedora, etc) there will usually be a quick and easy button to turn on full-disk encryption while you're installing the OS. In terms of additional file/folder encryption, it depends on what you're doing. A good example, in one of the previous articles I mentioned using backups as a good way to reduce the impact of ransomware, and many of the options I suggested include encryption by default, so you wouldn't need to encrypt those again. I'll write soon about different ways you can encrypt files/folders (usually Veracrypt is a good solution for this!).

Thanks! I'm hopeful that things are slowly getting better, but it's still something folks have to be aware of. Especially when it comes to IP cameras. It's terrifying how many cameras are connected to the web and have default credentials. With a few clicks on Shodan, you could be looking through people's webcams without their knowledge. Insane!

I mentioned in the other reply to T3OU-736 that the real issue is how wide the spectrum of attacks are. There are things that are on the userspace level (assuming you'll run a file with malware hidden in it), to the hardware level (device emulation to pretend like it's a keyboard or ethernet adapter) and even down to the firmware/USB specification level (device firmware upgrade attacks or the USB Kill stick). That's why generally the best advice is to never trust a USB device that isn't yours, otherwise you're going to get involved in layers upon layers of mitigations, and often the more layers of mitigation layers you add can actually end up increasing your attack surface if you don't properly maintain them or fully understand them.

You could have a kind of air-gapped system that is running a non-persistent OS like Tails, plug in USB keys into that to check them for basic things, but again, the risk/reward tradeoff seems quite heavily leaning towards risk.

Evil maid could definitely do that, but that comes to your threat model. If evil maids are in your threat model, then you should never leave your computer (let alone your USB devices) unattended. Regardless of the USB devices, evil maid would probably just go in for your computer or power supply first. Most threat models that involve evil maid attacks would also mitigate those by having fully separated sets of hardware just for travel that are always treated as being potentially compromised.

For the drive-by plugin, that's a very real threat to some orgs, which is why a lot of orgs with sensitive data will just shut off USB ports in the system BIOS, so that nothing can ever be plugged in anyways, or they use some more sneaker-net tactics and put tape or other coverings on exposed USB ports.

You could have an OS level intervention, but again, a lot of attacks are closer to the metal than the OS, which is why it's such a mess :(

Best strategy is still only use your own devices that you own. I don't even really accept USB devices from others. If they need to send me some files, I get them to use Dropbox or similar.

QubesOS does have an interesting way of handling USB device management and protection locally, but getting into using Qubes can be quite tricky for normal people, so it might actually just create a larger attack surface if you use it incorrectly.

Great discussion there. That USBguard tool seems interesting. I'll take a look, but the tricky thing with these USB Drop Attacks is the range of forms they can take and the levels of complexity. That USBguard mentions it blocks them from userspace, and without having looked at the code I imagine there's still negotiation that happens at the firmware level, which still leaves quite a lot of room for bad things to happen. For example you could make the perfect whitelist of your devices, but someone could still easily plug in the $60 USB Kill stick and it would fry your system. They could also take advantage of firmware level USB exploits such as a DFU (device firmware update) attack to inject malicious malware at the firmware level of your system. Off top of my head, I would guess USBguard wouldn't be able to stop that lower level of exploitation, so that's why I stick with not plugging anything in that isn't mine and in more sensitive IT departments, they can disable USB ports completely from BIOS.

Agreed :)

I'm planning to get a good coverage of topics in there. Starting with some low hanging fruit like password managers and 2FA (next week). But then would like to cover anything that would be useful for people who have something to lose but not the security background. Cloud choices and data security definitely would fall under that. If you have anything in particular you'd like to see covered, just let me know :)