4 ms·

Since no one seems to be talking about how to secure devices, I guess I'll get started... USB devices should not accept any incoming connection when the comput

Since no one seems to be talking about how to secure devices, I guess I'll get started... USB devices should not accept any incoming connection when the computer is locked. The only use of USB ports when a computer is locked should be for charging devices (current out, no data in). We also need to ensure that devices that were connected before the computer was locked continue to function. Now obviously, the issue with this would be about external devices that are connected after the device has been locked (drives, keyboards etc. - say for example, keyboard stopped working so you switched it out) but in my opinion, that's an edge case and should not cause too much inconvenience.

theandrewbailey 10y ago
> The only use of USB ports when a computer is locked should be for charging devices (current out, no data in). We also need to ensure that devices that were connected before the computer was locked continue to function. Good idea, but... (hypothetical helpdesk ticket) Oh crap! I knocked my coffee on my keyboard and ruined it as I was sitting down at my locked computer. I connected another keyboard, but the lock screen is not accepting my password! Allow HID class devices to be connected when locked, and that should be OK.
- deleted 10y ago
  [deleted]
- 0x6c6f6c 10y ago
  At that point the measures taken by IT/helpdesk shouldn't allow for a random person to make changes to the computer security measures. Scan your badge to helpdesk or contact local IT to do it for you. Proof of identity is required. Social networking is another thing itself which should be guarded against in any environment, simply suggesting all you have to do is make a helpdesk ticket requires your access already be breached to be done electronically or poor protocols in IT.
  - brazzledazzle 10y ago
    Total lockdown paranoia with client security always sounds good and it is effective. But it comes at a cost. Usability in the security world lags distantly behind and gets dramatically worse the more secure you are. There's a balance that you have to strike based on risk, your capacity to detect/respond, compartmentalization and user experience. If you have your clients locked up like Fort Knox and working in that environment makes your developers feel like they're in hell that is going to be used as a data point when you are compared and contrasted to the competition's work environment. People tell their friends from their other gigs when they find something better. Also worth emphasizing that smart local IT people aren't universal or consistent. It's a mixed bag. Even when they are smart they are incentivized to do one thing: solve your problem as quickly as possible. Upon discovering that your friendly local IT person is meeting their SLA by cutting security corners the immediate response is to add more processes and controls with little thought to the environment that created those perverse incentives in the first place. People care about what you pressure them to care about and the pressure they get every day is their SLA/count/turnaround because there's no dashboard for how securely they do their job. It's things like unbounded security controls, business processes and rubber-stamp approvals that take a company from a creative place to work full of smart people getting stuff done to corporate hell. It never happens overnight because it's a slow death by a thousand cuts and you realize you've finally arrived in the pit because the execs are running internal hackathons to boost innovation and creativity where the participants can't install anything on their computers or get some throwaway VMs without 9 approvals and a business justification. The things that steal our momentum and sap our creativity should have a corresponding immune system that is always trying to remove them by enforcing a justification for them, reassessing the risk, the value and whether or not they're even needed. I got off on a bit of a rant there, sorry.
- ohstopitu 10y ago
  While I can't seem to think of a solution of the top of my head.... Sammy had an older video [0] which showed a device that was not a keyboard acting like a keyboard & mouse. While that required an unlocked computer to function, I feel like adding exceptions to a rule would just make it worse. Another solution would be to sign USB devices (for example, Apple keyboards etc.) and only those signed devices would work when the computer was locked. [0] https://www.youtube.com/watch?v=aSLEq7-hlmo https://www.youtube.com/watch?v=aSLEq7-hlmo
  - madamelic 10y ago
    >Another solution would be to sign USB devices (for example, Apple keyboards etc.) and only those signed devices would work when the computer was locked. Are you proposing DRM for input devices? How would this fix the problem of "Oops, messed up my keyboard, now I have to plug in a new, 'unknown' device"
    - paulmd 10y ago
      It would have to have its drivers signed by a known CA before it was capable of operating while the device was locked - that's all.
  - mnx 10y ago
    I feel like it's too late for that - too many usb devices are already out there.
- nickpsecurity 10y ago
  Really? https://hackaday.com/2013/01/26/extracting-data-with-usb-hid/ https://hackaday.com/2013/01/26/extracting-data-with-usb-hid...
- fweespeech 10y ago
  Requiring a reboot seems more logical and less likely to result in implementation bugs tbh. The same security measures that prevent abuse would play out as normal. (i.e. If someone physically stole the drive and put it in another computer.)
- TazeTSchnitzel 10y ago
  What about monitors?
Tepix 10y ago
Is this really limited to USB devices? What happens when you plug the ethernet cable into a malicious router?

theandrewbailey 10y ago

> The only use of USB ports when a computer is locked should be for charging devices (current out, no data in). We also need to ensure that devices that were connected before the computer was locked continue to function. Good idea, but... (hypothetical helpdesk ticket) Oh crap! I knocked my coffee on my keyboard and ruined it as I was sitting down at my locked computer. I connected another keyboard, but the lock screen is not accepting my password! Allow HID class devices to be connected when locked, and that should be OK.

deleted 10y ago
[deleted]
0x6c6f6c 10y ago
At that point the measures taken by IT/helpdesk shouldn't allow for a random person to make changes to the computer security measures. Scan your badge to helpdesk or contact local IT to do it for you. Proof of identity is required. Social networking is another thing itself which should be guarded against in any environment, simply suggesting all you have to do is make a helpdesk ticket requires your access already be breached to be done electronically or poor protocols in IT.
- brazzledazzle 10y ago
  Total lockdown paranoia with client security always sounds good and it is effective. But it comes at a cost. Usability in the security world lags distantly behind and gets dramatically worse the more secure you are. There's a balance that you have to strike based on risk, your capacity to detect/respond, compartmentalization and user experience. If you have your clients locked up like Fort Knox and working in that environment makes your developers feel like they're in hell that is going to be used as a data point when you are compared and contrasted to the competition's work environment. People tell their friends from their other gigs when they find something better. Also worth emphasizing that smart local IT people aren't universal or consistent. It's a mixed bag. Even when they are smart they are incentivized to do one thing: solve your problem as quickly as possible. Upon discovering that your friendly local IT person is meeting their SLA by cutting security corners the immediate response is to add more processes and controls with little thought to the environment that created those perverse incentives in the first place. People care about what you pressure them to care about and the pressure they get every day is their SLA/count/turnaround because there's no dashboard for how securely they do their job. It's things like unbounded security controls, business processes and rubber-stamp approvals that take a company from a creative place to work full of smart people getting stuff done to corporate hell. It never happens overnight because it's a slow death by a thousand cuts and you realize you've finally arrived in the pit because the execs are running internal hackathons to boost innovation and creativity where the participants can't install anything on their computers or get some throwaway VMs without 9 approvals and a business justification. The things that steal our momentum and sap our creativity should have a corresponding immune system that is always trying to remove them by enforcing a justification for them, reassessing the risk, the value and whether or not they're even needed. I got off on a bit of a rant there, sorry.
ohstopitu 10y ago
While I can't seem to think of a solution of the top of my head.... Sammy had an older video [0] which showed a device that was not a keyboard acting like a keyboard & mouse. While that required an unlocked computer to function, I feel like adding exceptions to a rule would just make it worse. Another solution would be to sign USB devices (for example, Apple keyboards etc.) and only those signed devices would work when the computer was locked. [0] https://www.youtube.com/watch?v=aSLEq7-hlmo https://www.youtube.com/watch?v=aSLEq7-hlmo
- madamelic 10y ago
  >Another solution would be to sign USB devices (for example, Apple keyboards etc.) and only those signed devices would work when the computer was locked. Are you proposing DRM for input devices? How would this fix the problem of "Oops, messed up my keyboard, now I have to plug in a new, 'unknown' device"
  - paulmd 10y ago
    It would have to have its drivers signed by a known CA before it was capable of operating while the device was locked - that's all.
- mnx 10y ago
  I feel like it's too late for that - too many usb devices are already out there.
nickpsecurity 10y ago
Really? https://hackaday.com/2013/01/26/extracting-data-with-usb-hid/ https://hackaday.com/2013/01/26/extracting-data-with-usb-hid...
fweespeech 10y ago
Requiring a reboot seems more logical and less likely to result in implementation bugs tbh. The same security measures that prevent abuse would play out as normal. (i.e. If someone physically stole the drive and put it in another computer.)
TazeTSchnitzel 10y ago
What about monitors?

Tepix 10y ago

Is this really limited to USB devices? What happens when you plug the ethernet cable into a malicious router?