4 ms·

Is it really all that surprising that someone from Elsevier thought it was a good idea?

• Blahah 11y ago
  If there's one thing you can depend on, it's that Elsevier will fuck things up at every opportunity.
  • elektromekatron 11y ago
    So at least they are Baysianly useful.
• Animats 11y ago
  This is a known attack vector. For a major company to use it is probably criminal, under the Computer Fraud and Abuse Act. There's no sign of an EULA here, authorizing them access. Elsevier knows this is an attack. They published a book titled "Seven Deadliest USB Attacks", by Brian Anderson. So they can't claim this wasn't done knowingly. Has anybody found out what the attack does? [1] http://www.elsevier.com/books/seven-deadliest-usb-attacks/anderson/978-1-59749-553-0 http://www.elsevier.com/books/seven-deadliest-usb-attacks/an...
  • klausa 11y ago
    "Making a thing type stuff when you plug it in" is an attack vector in the same way "sending a request over the network" is.
    • lucastx 11y ago
      It's not "typing stuff", it's exercing forced, unasked control of your computer (plus unknown behavior on other operating systems), isn't it? If the user's expectation when handed a thumb drive looking USB device from a big company is that it will display files, and instead it just pretends to be him and controls his computer interface, for me it is at least a gray area regarding computer abuse. But I am not a lawyer.
    • tripzilch 11y ago
      Well it's not "just typing stuff", it's typing some rather specific stuff to make your computer do something quite unexpected. The reasonable expectation (for a promotional item) is that it's a memory stick, not that it suddenly starts typing system control global keyboard shortcuts into your computer. Say you'd post a persistent XSS to a forum, but only use it include Fartscroll.js, is that an attack or not? Cause I consider that to be pretty much the same category as the "surprise" automatic typing USB thing. This weekend actually I used a USB device where this was in fact the intended behaviour: a barcode scanner. It registers as a keyboard and just types the numbers (or string) of whatever it scans. Very clever idea because it makes it very easy to write apps for, you don't need a driver or anything. Except I had momentarily forgotten that was how it works, so it surprised me anyway. Fortunately the numbers didn't do much in the program I had focused but still, that feeling of something else unexpectedly typing on my computer! Yeah if it had sent global keyboard shortcuts in order to make my computer start applications and load webpages, I'd be pretty pissed.
  • ryanlol 11y ago
    Uh... What the fuck? What exactly makes this an attack? I don't see it doing anything malicious. And in any case, how is plugging in a keyboard to your computer not authorizing it to send keypresses?
• Natsu 11y ago
  After reading this, my guess would be that someone in marketing probably bought these from some vendor without understanding them very well or understanding why people would be freaked out by that. It appears to be a keyboard emulator that simply types winkey+R http://[some http://[some URL] It's (sadly) a well-known fact that all unknown USB devices should be considered malicious unless proven otherwise. This is why there are so many things like http://www.umbrellausb.com/ http://www.umbrellausb.com/
  • pbhjpbhj 11y ago
    Hmm, nothing says "we care about your security" more than a website that won't display any information without flash and javascript enabled /s.