3 ms·

You really have to trust something that you stick in a USB port and press a button on.

klodolph 8y ago
Yes, that's true! But we are still okay with buying USB keyboards, and typing our passwords in on them. I think once you stop trusting your hardware vendors you are in a very expensive and time-consuming realm of paranoia. The idea that someone has compromised a hardware vendor in order to attack your company is not without its merits, like how RSA was compromised, but the attack is very costly and historically it's followed by key revocation which means that the attack only works once. So you'd only use this kind of attack for extremely high-value targets.
SmellyGeekBoy 8y ago
So? You have to trust your firmware, HDD controller, keyboard controller, OS, browser... What's one more device in that chain of trust?
drcongo 8y ago
Seeing as I'm getting downvoted for this, we've already seen breaches due to infected USB sticks being sold next to NATO in Kabul [1], these seem like a pretty good black hat attack vector to me, especially as most employees are going to carry these things around on a keyring so they don't lose them. It only takes a second to switch it out for a compromised key when that employee is at the bar. [1] http://uk.businessinsider.com/russia-planted-bugged-thumb-drives-to-break-into-us-govt-computers-2017-3?r=US&IR=T http://uk.businessinsider.com/russia-planted-bugged-thumb-dr...
- joshuamorton 8y ago
  Each key is locked to an account. If you tap your key and it doesn't work, that's a potential security issue to be reported.
  - drcongo 8y ago
    Yes, yes it is.
    - joshuamorton 8y ago
      My point is 1. This is immidiately obvious 2. You've now maybe pwnd a single device, but in doing so you also removed any credentials from the device, so it's not valuable 3. USB mice and keyboards already exist, and are plugged in to most computers.
      - palisade 8y ago
        I think drcongo's point is that if an operative meets someone at the pub and swaps out a similar looking fob on his keychain for one that contains a virus. It doesn't matter if you only "pwned" a single device, you're in the network and it is time to start exploring.
        joshuamorton 8y ago
        But you're not in the network. You have to authenticate to access the network, and that requires the u2f key that you just removed.
        palisade 8y ago
        Your virus is on a machine in the network, therefore you're in the network. At that point, it is a matter of exploring the network, fingerprinting systems, scraping for exploits, and attempting intrusions. Or, waiting until an administrator does something silly like attempt to use their privileges on the machine to accomplish some task. I believe this was exactly how the Sony hack was conducted. Edit: Also, at some point the employee will be reissued a new key fob for the "broken" one and at that point they will enter their credentials into the network again on that machine giving you access. Edit 2: I guess a procedure that could prevent this is to require I.T. check the serial number of a fob that has been reported as "broken" thereby verifying there hasn't been a potential intrusion.

Yes, that's true! But we are still okay with buying USB keyboards, and typing our passwords in on them. I think once you stop trusting your hardware vendors you are in a very expensive and time-consuming realm of paranoia. The idea that someone has compromised a hardware vendor in order to attack your company is not without its merits, like how RSA was compromised, but the attack is very costly and historically it's followed by key revocation which means that the attack only works once. So you'd only use this kind of attack for extremely high-value targets.

SmellyGeekBoy 8y ago

So? You have to trust your firmware, HDD controller, keyboard controller, OS, browser... What's one more device in that chain of trust?

drcongo 8y ago

Seeing as I'm getting downvoted for this, we've already seen breaches due to infected USB sticks being sold next to NATO in Kabul [1], these seem like a pretty good black hat attack vector to me, especially as most employees are going to carry these things around on a keyring so they don't lose them. It only takes a second to switch it out for a compromised key when that employee is at the bar. [1] http://uk.businessinsider.com/russia-planted-bugged-thumb-drives-to-break-into-us-govt-computers-2017-3?r=US&IR=T http://uk.businessinsider.com/russia-planted-bugged-thumb-dr...

joshuamorton 8y ago
Each key is locked to an account. If you tap your key and it doesn't work, that's a potential security issue to be reported.
- drcongo 8y ago
  Yes, yes it is.
  - joshuamorton 8y ago
    My point is 1. This is immidiately obvious 2. You've now maybe pwnd a single device, but in doing so you also removed any credentials from the device, so it's not valuable 3. USB mice and keyboards already exist, and are plugged in to most computers.
    - palisade 8y ago
      I think drcongo's point is that if an operative meets someone at the pub and swaps out a similar looking fob on his keychain for one that contains a virus. It doesn't matter if you only "pwned" a single device, you're in the network and it is time to start exploring.
      - joshuamorton 8y ago
        But you're not in the network. You have to authenticate to access the network, and that requires the u2f key that you just removed.
        palisade 8y ago
        Your virus is on a machine in the network, therefore you're in the network. At that point, it is a matter of exploring the network, fingerprinting systems, scraping for exploits, and attempting intrusions. Or, waiting until an administrator does something silly like attempt to use their privileges on the machine to accomplish some task. I believe this was exactly how the Sony hack was conducted. Edit: Also, at some point the employee will be reissued a new key fob for the "broken" one and at that point they will enter their credentials into the network again on that machine giving you access. Edit 2: I guess a procedure that could prevent this is to require I.T. check the serial number of a fob that has been reported as "broken" thereby verifying there hasn't been a potential intrusion.