4 ms·

Teardown of USB Fan Reveals Journalists’ Lack of Opsec

19 points by oedmarap 8y ago

sctb 8y ago
Recent discussion: https://news.ycombinator.com/item?id=17459041 https://news.ycombinator.com/item?id=17459041.
acomjean 8y ago
I guess the downside of having “one port” for power/ stoarage and peripherals, is that you really can’t know what’s going to happen when you plug a device in. It’s almost like you want a dialog box approving what the usb device can do. But nobody really wants that. Convenience over security.
- jgibson 8y ago
  Android already does this. When you plug in you get a notification with options for - Charging only (with direction selection if your phone supports it) - USB media protocol - USB flash storage
  - dawnerd 8y ago
    That’s assuming the software can’t be exploited.
ballenf 8y ago
A physical switch on all ports that are sometimes used for power-only, disconnecting data lines, would be worthwhile for many people. Or just train people to use power banks for USB-powered accessories instead of their computers.
- jpindar 8y ago
  There are cables and adapters that don't have the data lines connected, they are sometimes called USB condoms.
  - beamatronic 8y ago
    I would expect them to be made of clear plastic for easy visual confirmation
    - monocasa 8y ago
      That just makes me want to design a fake USB condom that looks legit. Maybe modulating the data over the power cables using ICs implanted in the connector...
lainga 8y ago
Is OPSEC covered in modern journalism degrees?
kilo_bravo_3 8y ago
Title: TEARDOWN OF USB FAN REVEALS JOURNALISTS’ LACK OF OPSEC Content: "The real story here is that accomplished journalists would be grateful for a random USB device given to them by a foreign government. There is every indication this journalist actually plugged this USB fan into his computer. But even if he went the safe route and opted to use a USB battery or a cable with data lines disconnected to protect against malware, I’m sure others didn’t take precautions. Out of 2500 journalists at the Singapore summit, some unquestionably plugged this threat into their computer." Question: What is the indication that the journalist actually plugged this USB fan into his computer? Reality: there is no evidence of any journalist plugging in the USB fan. Conclusion: YAZWPSRAAS (yet another zer0cool wannabe posting self-righteous articles about security)
- geofft 8y ago
  Exactly - the photo shows the fan in the plastic bag, the evidence is it was not used! Also, "The journalist who started this whole mess by posting the image of the USB fan drive on Twitter" how is posting the image on Twitter starting a mess? This is a bad article with a blatant disregard for fact, and I've flagged it.
zerocrates 8y ago
Seems like a strange headline... the teardown apparently didn't "reveal" anything unexpected at all. "Lack of opsec" is still all fine and good as a comment about this story, but this article is implying (really, more than implying) that they actually found something hidden in the fan.
- zantana 8y ago
  Agreed. Based on the headline I was expecting the journalist had inadvertently revealed some data about which they weren't intending to.
pinebox 8y ago
Teardown of article on USB Fan teardown reveals lack of teardown
securityDouche 8y ago
Wow, security douche. You are so smart. Thank god you are saving us from the absolute nothing that happened. Please tell us more about how much we should all stop and think about you, before not paying any attention to worthless schlock and swag, because we're not children around technology, and don't care about shiny toys with USB plugs, in the same way that you might be projecting your own tendencies onto the rest of the world. Yes, we realize you were once 14 years old, and played video games, and to you, those USB fans look just like the plugs to your video game console's favoritest controller. Yes, we too, know that those are not actually plugs to your video game console's favoritest controller. Yes, we too know that we now have to consider that the United States has delivered malware to Iran with malicious USB devices, and that that ruined USB devices for everyone, forever. Great. Nothing happened. Good game. Nice blog.
badrabbit 8y ago
Alternative headline: Teardown of USB fan reveals systems were engineered without taking into account the need for user-friendly security ¯\_(ツ)_/¯ Can't have opsec if you don't know "op"(how a system operates and is meant to be operated) or or "sec".

19 points by oedmarap 8y ago

sctb 8y ago

Recent discussion: https://news.ycombinator.com/item?id=17459041 https://news.ycombinator.com/item?id=17459041.

I guess the downside of having “one port” for power/ stoarage and peripherals, is that you really can’t know what’s going to happen when you plug a device in. It’s almost like you want a dialog box approving what the usb device can do. But nobody really wants that. Convenience over security.

jgibson 8y ago
Android already does this. When you plug in you get a notification with options for - Charging only (with direction selection if your phone supports it) - USB media protocol - USB flash storage
- dawnerd 8y ago
  That’s assuming the software can’t be exploited.

ballenf 8y ago

A physical switch on all ports that are sometimes used for power-only, disconnecting data lines, would be worthwhile for many people. Or just train people to use power banks for USB-powered accessories instead of their computers.

jpindar 8y ago
There are cables and adapters that don't have the data lines connected, they are sometimes called USB condoms.
- beamatronic 8y ago
  I would expect them to be made of clear plastic for easy visual confirmation
  - monocasa 8y ago
    That just makes me want to design a fake USB condom that looks legit. Maybe modulating the data over the power cables using ICs implanted in the connector...

lainga 8y ago

Is OPSEC covered in modern journalism degrees?

kilo_bravo_3 8y ago

Title: TEARDOWN OF USB FAN REVEALS JOURNALISTS’ LACK OF OPSEC Content: "The real story here is that accomplished journalists would be grateful for a random USB device given to them by a foreign government. There is every indication this journalist actually plugged this USB fan into his computer. But even if he went the safe route and opted to use a USB battery or a cable with data lines disconnected to protect against malware, I’m sure others didn’t take precautions. Out of 2500 journalists at the Singapore summit, some unquestionably plugged this threat into their computer." Question: What is the indication that the journalist actually plugged this USB fan into his computer? Reality: there is no evidence of any journalist plugging in the USB fan. Conclusion: YAZWPSRAAS (yet another zer0cool wannabe posting self-righteous articles about security)

geofft 8y ago
Exactly - the photo shows the fan in the plastic bag, the evidence is it was not used! Also, "The journalist who started this whole mess by posting the image of the USB fan drive on Twitter" how is posting the image on Twitter starting a mess? This is a bad article with a blatant disregard for fact, and I've flagged it.

zerocrates 8y ago

Seems like a strange headline... the teardown apparently didn't "reveal" anything unexpected at all. "Lack of opsec" is still all fine and good as a comment about this story, but this article is implying (really, more than implying) that they actually found something hidden in the fan.

zantana 8y ago
Agreed. Based on the headline I was expecting the journalist had inadvertently revealed some data about which they weren't intending to.

pinebox 8y ago

Teardown of article on USB Fan teardown reveals lack of teardown

securityDouche 8y ago

Wow, security douche. You are so smart. Thank god you are saving us from the absolute nothing that happened. Please tell us more about how much we should all stop and think about you, before not paying any attention to worthless schlock and swag, because we're not children around technology, and don't care about shiny toys with USB plugs, in the same way that you might be projecting your own tendencies onto the rest of the world. Yes, we realize you were once 14 years old, and played video games, and to you, those USB fans look just like the plugs to your video game console's favoritest controller. Yes, we too, know that those are not actually plugs to your video game console's favoritest controller. Yes, we too know that we now have to consider that the United States has delivered malware to Iran with malicious USB devices, and that that ruined USB devices for everyone, forever. Great. Nothing happened. Good game. Nice blog.

badrabbit 8y ago

Alternative headline: Teardown of USB fan reveals systems were engineered without taking into account the need for user-friendly security ¯\_(ツ)_/¯ Can't have opsec if you don't know "op"(how a system operates and is meant to be operated) or or "sec".