3 ms·

As a user, it'd be nice to assume that if I'm not logged in new USB devices won't be installed though.

by mpeg 10y ago

deleted 10y ago
[deleted]
mnw21cam 10y ago
What about a keyboard? How are you going to log in if your computer won't accept the keyboard that you are trying to plug in?
- throwaway2016a 10y ago
  To expand on that, you could just allow keyboards and not enable other devices but then how do you log in if your login is a network based... now you have to allow network cards. And now this hack is just as effective.
  - SparkyMcUnicorn 10y ago
    Beyond that, you could disguise non-keyboard hardware as a keyboard.
    - pavel_lishin 10y ago
      But then it doesn't get registered as an ethernet device, bypassing this particular problem.
      - jrkatz 10y ago
        It does if you make a keyboard that registers as a hub with both a keyboard and network adapter installed
- Vintila 10y ago
  Could restrict it to HID class USB devices.
  - deleted 10y ago
    [deleted]
- mpeg 10y ago
  I'm cool with HIDs being installed, but an Ethernet device that hijacks my entire network and then quietly disappears? Uh... I'd notice a new usb plugged in, but I wouldn't easily notice this.
  - mnw21cam 10y ago
    I believe there is a proof of concept evil USB device that looks like a USB key, but actually emulates a keyboard and enters all sorts of damaging keystrokes when plugged in. So allowing keyboards is dangerous anyway (although having the screen locked should help). This is the reason why keyboard/mouse connectors should look different to USB connectors, so we can tell the difference.
    - jerf 10y ago
      Screen locking would fix the keyboard attack. It has no input coming back from the computer so it works by blind-spraying keypresses in and hoping.
      - mic159 10y ago
        The numlock and capslock indicators can be used as confirmation signals coming back so it knows if it is working.
        jerf 10y ago
        Not really. By the time you make those signals provide feedback about your task rather than just whether Caps Lock is on, you'll have already accomplished your task and be into the part of the process where you're trying to download or compile some hack to use code to send something useful along Caps Lock signals. It's not a useful feedback mechanism when getting the feedback is an order of magnitude or two harder than the task you're trying to perform in the first place.
    - andresgottlieb 10y ago
      https://github.com/hak5darren/USB-Rubber-Ducky/wiki https://github.com/hak5darren/USB-Rubber-Ducky/wiki
grkvlt 10y ago
What if you're not logged in on the console, but have an SSH session open over the network? Does that count as 'logged in' or not? Imagine a server under a desk with no monitor attached. Or, a thin-client situation, where I am logged in to a virtual console over VNC or RDP or X, but have no access to the actual machine's USB ports?

As a user, it'd be nice to assume that if I'm not logged in new USB devices won't be installed though.

by mpeg 10y ago

As a user, it'd be nice to assume that if I'm not logged in new USB devices won't be installed though.

deleted 10y ago

[deleted]

mnw21cam 10y ago

What about a keyboard? How are you going to log in if your computer won't accept the keyboard that you are trying to plug in?

throwaway2016a 10y ago
To expand on that, you could just allow keyboards and not enable other devices but then how do you log in if your login is a network based... now you have to allow network cards. And now this hack is just as effective.
- SparkyMcUnicorn 10y ago
  Beyond that, you could disguise non-keyboard hardware as a keyboard.
  - pavel_lishin 10y ago
    But then it doesn't get registered as an ethernet device, bypassing this particular problem.
    - jrkatz 10y ago
      It does if you make a keyboard that registers as a hub with both a keyboard and network adapter installed
Vintila 10y ago
Could restrict it to HID class USB devices.
- deleted 10y ago
  [deleted]
mpeg 10y ago
I'm cool with HIDs being installed, but an Ethernet device that hijacks my entire network and then quietly disappears? Uh... I'd notice a new usb plugged in, but I wouldn't easily notice this.
- mnw21cam 10y ago
  I believe there is a proof of concept evil USB device that looks like a USB key, but actually emulates a keyboard and enters all sorts of damaging keystrokes when plugged in. So allowing keyboards is dangerous anyway (although having the screen locked should help). This is the reason why keyboard/mouse connectors should look different to USB connectors, so we can tell the difference.
  - jerf 10y ago
    Screen locking would fix the keyboard attack. It has no input coming back from the computer so it works by blind-spraying keypresses in and hoping.
    - mic159 10y ago
      The numlock and capslock indicators can be used as confirmation signals coming back so it knows if it is working.
      - jerf 10y ago
        Not really. By the time you make those signals provide feedback about your task rather than just whether Caps Lock is on, you'll have already accomplished your task and be into the part of the process where you're trying to download or compile some hack to use code to send something useful along Caps Lock signals. It's not a useful feedback mechanism when getting the feedback is an order of magnitude or two harder than the task you're trying to perform in the first place.
  - andresgottlieb 10y ago
    https://github.com/hak5darren/USB-Rubber-Ducky/wiki https://github.com/hak5darren/USB-Rubber-Ducky/wiki

grkvlt 10y ago

What if you're not logged in on the console, but have an SSH session open over the network? Does that count as 'logged in' or not? Imagine a server under a desk with no monitor attached. Or, a thin-client situation, where I am logged in to a virtual console over VNC or RDP or X, but have no access to the actual machine's USB ports?