4 ms·

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug someth

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?

wepple 8y ago
Well for starters, if you’re curiously plugging it in, you’re going to mount it aren’t you? Second, it can emulate an HID keyboard device and type keystrokes faster than you can react and pull it out, at which point it’s far too late - it’s pulled a secondary payload down or mounted a USB mass storage device and you’re owned.
- deytempo 8y ago
  You got me at the emulate a keyboard thing. Now I’m thinking that you shouldn’t plug strange keyboards or mice in because they could have an onboard payload. The crash cart at a data center is kind of a dumb idea in a way except the place is full of cameras usually
  - deaps 8y ago
    You're absolutely correct. You know those little desk fans that come with a USB now and also an adapter to plug into the electrical outlet. I don't plug those into my laptops ever - who knows if there's a payload on them. I will say this. I currently work, and have worked at, a few secret and top secret facilities - and the number of people I see plugging those (and similar) devices into their laptops is scary.
    - jlgaddis 8y ago
      > the number of people I see plugging those (and similar) devices into their laptops is scary. If such a device is able to cause a compromise / incident in a secure facility, well, several different "failures" at several different levels have occurred in order for it to get to that point.
Evidlo 8y ago
Proof of concept: https://samy.pl/poisontap/ https://samy.pl/poisontap/
- justinclift 8y ago
  Reading through the sequence of what that does... nasty piece of work that. And kind of brilliant.
protonfish 8y ago
Yeah, it irks me that this is seen a "stupid users" problem when our OSes are programmed to automatically execute code on a USB stick. I don't think the users are the stupid ones in this scenario.
jlgaddis 8y ago
> If you plug something into a centOS machine it’s not going to be able to do anything until you mount it ... You may want to double check your CentOS desktop's defaults (you might be surprised). My most critical machines have a file named /etc/modprobe.d/disabled.conf with entries such as these for dozens of filesystems, network protocols, and such: install usb-storage /bin/false install vfat /bin/false When absolutely required, they can quickly be temporarily commented out (but not by mistake) and there's some very extensive auditing rules that keep an eye on things at that point. It's really not that hard to lock a machine down and yet still have it actually remain usable. With the exceptions of the few security-focused distributions (Qubes OS, Tails, etc.), I can't think of any Linux distribution / desktop environment that even comes remotely close to doing anything like that (OOTB) by default, though.
evilDagmar 8y ago
...because there are still bugs being found in the USB handling code that can occasionally be exploited for code execution.

wepple 8y ago

Well for starters, if you’re curiously plugging it in, you’re going to mount it aren’t you? Second, it can emulate an HID keyboard device and type keystrokes faster than you can react and pull it out, at which point it’s far too late - it’s pulled a secondary payload down or mounted a USB mass storage device and you’re owned.

deytempo 8y ago
You got me at the emulate a keyboard thing. Now I’m thinking that you shouldn’t plug strange keyboards or mice in because they could have an onboard payload. The crash cart at a data center is kind of a dumb idea in a way except the place is full of cameras usually
- deaps 8y ago
  You're absolutely correct. You know those little desk fans that come with a USB now and also an adapter to plug into the electrical outlet. I don't plug those into my laptops ever - who knows if there's a payload on them. I will say this. I currently work, and have worked at, a few secret and top secret facilities - and the number of people I see plugging those (and similar) devices into their laptops is scary.
  - jlgaddis 8y ago
    > the number of people I see plugging those (and similar) devices into their laptops is scary. If such a device is able to cause a compromise / incident in a secure facility, well, several different "failures" at several different levels have occurred in order for it to get to that point.

Evidlo 8y ago

Proof of concept: https://samy.pl/poisontap/ https://samy.pl/poisontap/

justinclift 8y ago
Reading through the sequence of what that does... nasty piece of work that. And kind of brilliant.

protonfish 8y ago

Yeah, it irks me that this is seen a "stupid users" problem when our OSes are programmed to automatically execute code on a USB stick. I don't think the users are the stupid ones in this scenario.

jlgaddis 8y ago

> If you plug something into a centOS machine it’s not going to be able to do anything until you mount it ... You may want to double check your CentOS desktop's defaults (you might be surprised). My most critical machines have a file named /etc/modprobe.d/disabled.conf with entries such as these for dozens of filesystems, network protocols, and such: install usb-storage /bin/false install vfat /bin/false When absolutely required, they can quickly be temporarily commented out (but not by mistake) and there's some very extensive auditing rules that keep an eye on things at that point. It's really not that hard to lock a machine down and yet still have it actually remain usable. With the exceptions of the few security-focused distributions (Qubes OS, Tails, etc.), I can't think of any Linux distribution / desktop environment that even comes remotely close to doing anything like that (OOTB) by default, though.

evilDagmar 8y ago

...because there are still bugs being found in the USB handling code that can occasionally be exploited for code execution.