5 ms·
> As Ars has noted in previous coverage, the techniques are theoretically effective, but their utility in real-world situations is limited. That's because the c
by colinbartlett 10y ago
> As Ars has noted in previous coverage, the techniques are theoretically effective, but their utility in real-world situations is limited. That's because the computers they target still must be infected by malware. If the computers aren't connected to the Internet, the compromise is likely to be extremely difficult and would most likely require the help of a malicious insider, who very well may have easier ways to obtain data stored on the machine.
Nonetheless, an interesting technique. Is it even possible to have a useful workstation these days without any USB devices?
- kalleboo 10y ago> Is it even possible to have a useful workstation these days without any USB devices All my gear is on the network these days. The only USB device I regularly plug is in a dumb 5V fan from the dollar store... I imagine these days it's more possible than ever. Air-gapped computers (which is what this seems to be targeting) on the other hand are surely going to do all their data transfer over USB.
- tcoppi 10y agoYou have a networked keyboard/mouse?
- csydas 10y agoWell, it's possible they have something like Synergy installed to control multiple machines, maybe. Or else, perhaps they're talking about headless machines where it's just a box with power and ethernet.
- tcoppi 10y agoI could see Synergy for a workstation, but eventually one of the turtles on the way down will most likely have a keyboard/mouse connected to USB. Headless for servers certainly.
- djrogers 10y agoBluetooth - that's a network. Not to mention, my laptop has no external KB or mouse.
- shabble 10y agoA lot of laptops present the keyboard and touchpad/whatever as internally connected USB devices. So, if you want to disable USB by epoxying the externally facing connectors, that might work, but it means you can't do things like completely disable support at the BIOS or kernel level if you want those things to still work.
- dagw 10y agoWell there's bluetooth, but I imagine that that opens up a whole new set problems. I guess it's time to go back to PS/2
- deleted 10y ago[deleted]
- manarth 10y agoMy office still has machines with PS/2 ports, keyboards and mice ;-)
- deleted 10y ago[deleted]
- huehehue 10y agoAre you sure the USB fan isn't carrying a malicious payload? ;)
- Phlarp 10y agoPerhaps we need a USB spec for 5v power only with connectors that do not even have pads/pins for I/O Yes, I am aware you can buy "condom" adapters that provide this.
- ISL 10y agoCoaxial power plugs meet that spec nicely.
- rhizome 10y agoI'm not sure a spec is needed, you can already buy charge-only cables: http://www.mycablemart.com/store/cart.php?m=product_detail&p=5642&gclid=Cj0KEQjw3ZS-BRD1xu3qw8uS2s4BEiQA2bcfM-0Vpkxx7TlmQGw-BCOhmi9gpp0iMiVdy2rshErj80saAvBP8P8HAQ http://www.mycablemart.com/store/cart.php?m=product_detail&p... The fancy ones available elsewhere sometimes have red plugs to differentiate.
- kalleboo 10y agoYeah, because the wires on the switch were too thin and after 2 weeks I had to open it up and resolder them :/ The data pins were definitely not connected
- estebank 10y agoEven if you don't see anything connected to the pins, there could be an entire computer within the plug, connected from below, where you wouldn't be able to see it :)
- mikeash 10y agoThe data pins could be connected to a small malicious payload hidden in the USB plug. I mean, in theory.
- 10y ago
- marcosdumay 10y ago> Air-gapped computers (which is what this seems to be targeting) on the other hand are surely going to do all their data transfer over USB. Why? DVDs still exist.
- AstralStorm 10y agoYou mean BluRay and even that is a bit small for some cases. Not to mention limited in terms of number of rewrites.
- marcosdumay 10y agoHum, 4GB is a quite ok size for transferring data from "this one computer here" to "this other computer at the other end of the desk". It's pretty hard to conceive many¹ situations when you'll need to transport more than this at a single time between a secure computer and an insecure one. Some slowness on those few exceptions is a very low price to pay for disabling unverifiable two-way communication. By the way, buying a new RW disk every several dozen data transfers is also a low price to pay. The biggest problem is the very low throughput of optical drivers - writing to them takes ages. Still, if you need to airgap them, it's probably worth taking that hit. 1 - Original OS installation is a very clear exception, but it does not happen often.
- MaulingMonkey 10y ago4GB is very mediocre. Some situations that come to mind: 0) I've had Original OS installation occur fairly frequently (testing against the bleeding edge, testing installs against a clean install) 1) The installation of new software. 2) Anything with VMs. 3) The last set of builds I signed was 12GB for each set. Individual package files (which is what I needed to sign) didn't fit onto the 4GB USB sticks we had widespread. If there's a more classical use case for an airgapped secure computer, do tell. If you're confident that you're dealing with plain vanilla USB sticks, what advantage does communicating over rewritable DVDs have over rewritable USB sticks? Both are just as "verified" forms of two-way communication.
- 10y ago
- csomar 10y agoYou are exposing yourself to a considerable security risk with the dump 5V fan.
- ArkyBeagle 10y agoPeople do this. Many IT departments roll out Windows at least with reduced if not no USB capability. This came up when I was doing something last week - the place I was doing it at had computers that would not mount a thumb drive.
- notalaser 10y agoThere's an even more extreme form of that where people fill the USB sockets with hot glue. Extraordinary needs call for extraordinary measures.
- NegativeLatency 10y agoThere's an even more extreme form of that where people fill the USB sockets with epoxy.
- maerF0x0 10y agoThere's an even more extreme form of that where people desolder the connectors.
- freshyill 10y agoAnybody who takes security truly seriously desolders the connectors AND fills them with bees.
- m_samuel_l 10y agoand then fill the bees with epoxy
- ArkyBeagle 10y agoNah. Androctonus scorpions and deadly Australian funnel web spiders.
- Florin_Andrei 10y ago> Is it even possible to have a useful workstation these days without any USB devices? A little epoxy putty can go a long way here.