6 ms·

>Even USB-C chargers can infect your machine Why would anyone assume otherwise?

by swebs 8y ago

eugeniub 8y ago
Not everyone is an opsec expert
- mannykannot 8y ago
  Indeed - and an opsec expert needs to have a clue about human nature, anyway.
- swebs 8y ago
  Ok, but why would you assume that USB-C is somehow more secure than USB-B?
  - okmokmz 8y ago
    My guess would be that many USB-C products are charging cables, dongles, and other items that the average user would not associate with having the capability to store data making them inherently "safe" in their eyes. USB-A, on the other hand, is commonly associated with storing data, and the majority of user awareness and education about the danger of unknown devices is focused on flash drives. For these reasons I can see how someone without technical experience may believe that flash drives specifically are potentially dangerous, while believing that other USB-A/USB-C cables/adapters/chargers are safe. In my experience most users don't even know what USB-B is
dabernathy89 8y ago
I'm a web developer and I had no idea ¯\_(ツ)_/¯
mdip 8y ago
Outside of this audience, it's rather common[0]. It's not something that people, outside of these communities, harp on all that much. But even take things we do harp on, like not reusing passwords, are still things that the majority of people do[1]. I worked in various security positions at one of the US's biggest ISPs and routinely brought these sorts of things up to family members. I am embarrassed by the kinds of practices my family employs. The excuses vary but most of them fall along the lines of the same excuses smokers give when asked about lung cancer risks: "It Won't Happen to Me(tm)". Even within our industry, bad practices exist all over the place. An example I often point to is Code Signing certificates[2] -- I went through the trouble of generating a CSR offline using a Linux live CD, backed up the private key to an encrypted thumb drive and placed the result on a Yubikey to protect it when I need to sign something. The best part was sorting out how to actually give the CSR to the CA I used to purchase the key from. They offer all kinds of convenient, (IE and Firefox-only) in-browser mechanisms which result in generating the key online in a potentially already-compromised machine, but I ended up having to go through several steps using phone support to get my CSR to the CA. The way they did things encourages people to not think about protecting the private key; simply leaving it on an unencrypted volume with (likely) no other encryption used to protect the key. [0] https://thenextweb.com/insider/2011/06/28/us-govt-plant-usb-sticks-in-security-study-60-of-subjects-take-the-bait/ https://thenextweb.com/insider/2011/06/28/us-govt-plant-usb-... And these are specifically the kinds of people that should expect to be targets of an attack like this. [1] https://digitalguardian.com/blog/uncovering-password-habits-are-users-password-security-habits-improving-infographic https://digitalguardian.com/blog/uncovering-password-habits-... [2] I mention this kind of certificate because its credentials are such that an individual or company is named -- it's meant to identify a person or a legal entity, not a domain name -- and things signed with it result in that legal entity or person's legal name being displayed on launch in operating systems like Windows. It's something that you really wouldn't want to have fall into the wrong hands lest your name end up being prominently displayed prior to the installation of malware.
ramy_d 8y ago
People assume cables are dumb metal connections, nothing more. It doesn't help anyone to be condescending about op-sec.
- gascan 8y ago
  Power/charging cables in particular. After all, when was the last time your power drill caught a virus from your extension cord?
bluesnowmonkey 8y ago
We assume that bridges won't collapse, planes won't fall out of the sky. Engineers are supposed to build things that are safe to use. That's a reasonable expectation.
overcast 8y ago
You're more naive than the people you're referring to.
untog 8y ago
Because they are chargers. My 2015 Macbook charger is not vulnerable, my 2016 Macbook charger could be. It's not reasonable to assume that end users intuitively get that.

>Even USB-C chargers can infect your machine Why would anyone assume otherwise?

by swebs 8y ago

>Even USB-C chargers can infect your machine Why would anyone assume otherwise?

eugeniub 8y ago

Not everyone is an opsec expert

mannykannot 8y ago
Indeed - and an opsec expert needs to have a clue about human nature, anyway.
swebs 8y ago
Ok, but why would you assume that USB-C is somehow more secure than USB-B?
- okmokmz 8y ago
  My guess would be that many USB-C products are charging cables, dongles, and other items that the average user would not associate with having the capability to store data making them inherently "safe" in their eyes. USB-A, on the other hand, is commonly associated with storing data, and the majority of user awareness and education about the danger of unknown devices is focused on flash drives. For these reasons I can see how someone without technical experience may believe that flash drives specifically are potentially dangerous, while believing that other USB-A/USB-C cables/adapters/chargers are safe. In my experience most users don't even know what USB-B is

dabernathy89 8y ago

I'm a web developer and I had no idea ¯\_(ツ)_/¯

mdip 8y ago

Outside of this audience, it's rather common[0]. It's not something that people, outside of these communities, harp on all that much. But even take things we do harp on, like not reusing passwords, are still things that the majority of people do[1]. I worked in various security positions at one of the US's biggest ISPs and routinely brought these sorts of things up to family members. I am embarrassed by the kinds of practices my family employs. The excuses vary but most of them fall along the lines of the same excuses smokers give when asked about lung cancer risks: "It Won't Happen to Me(tm)". Even within our industry, bad practices exist all over the place. An example I often point to is Code Signing certificates[2] -- I went through the trouble of generating a CSR offline using a Linux live CD, backed up the private key to an encrypted thumb drive and placed the result on a Yubikey to protect it when I need to sign something. The best part was sorting out how to actually give the CSR to the CA I used to purchase the key from. They offer all kinds of convenient, (IE and Firefox-only) in-browser mechanisms which result in generating the key online in a potentially already-compromised machine, but I ended up having to go through several steps using phone support to get my CSR to the CA. The way they did things encourages people to not think about protecting the private key; simply leaving it on an unencrypted volume with (likely) no other encryption used to protect the key. [0] https://thenextweb.com/insider/2011/06/28/us-govt-plant-usb-sticks-in-security-study-60-of-subjects-take-the-bait/ https://thenextweb.com/insider/2011/06/28/us-govt-plant-usb-... And these are specifically the kinds of people that should expect to be targets of an attack like this. [1] https://digitalguardian.com/blog/uncovering-password-habits-are-users-password-security-habits-improving-infographic https://digitalguardian.com/blog/uncovering-password-habits-... [2] I mention this kind of certificate because its credentials are such that an individual or company is named -- it's meant to identify a person or a legal entity, not a domain name -- and things signed with it result in that legal entity or person's legal name being displayed on launch in operating systems like Windows. It's something that you really wouldn't want to have fall into the wrong hands lest your name end up being prominently displayed prior to the installation of malware.

ramy_d 8y ago

People assume cables are dumb metal connections, nothing more. It doesn't help anyone to be condescending about op-sec.

gascan 8y ago
Power/charging cables in particular. After all, when was the last time your power drill caught a virus from your extension cord?

bluesnowmonkey 8y ago

We assume that bridges won't collapse, planes won't fall out of the sky. Engineers are supposed to build things that are safe to use. That's a reasonable expectation.

overcast 8y ago

You're more naive than the people you're referring to.

untog 8y ago

Because they are chargers. My 2015 Macbook charger is not vulnerable, my 2016 Macbook charger could be. It's not reasonable to assume that end users intuitively get that.