5 ms·

I would take a pass on adding his information - Stuxnet was first detected in June by a security firm based in Belarus, but may have been circulating

I would take a pass on adding his information - Stuxnet was first detected in June by a security firm based in Belarus, but may have been circulating since 2009. Unlike most viruses, the worm targets systems that are traditionally not connected to the internet for security reasons. Instead it infects Windows machines via USB keys - commonly used to move files around - infected with malware.

ugh 16y ago
I wonder whether that’s a sensible position or just paranoia. I have no reason to believe that someone who hands me over his card wants to infect my PC, that seems just absurd to me. Any such infection would have to be accidental and I don’t know how likely that is. Should I also reject USB drives my friends give me when they want to share something with me? It seems like I should if USB drives are really that dangerous.
- klochner 16y ago
  I doubt anyone that who unknowingly transmitted stuxnet expected that the system would be infected. I also don't understand why people even use USB drives given that cloud storage is so cheap and accessible. Throw the files on dropbox, grab anywhere, share with anyone.
  - ugh 16y ago
    I have no control over other people nor would I want to. That brings up an interesting point, though. Would it be possible for worms to use Dropbox to spread?
  - viraptor 16y ago
    Putting 2GB on a USB drive and handing it to someone else is easy. Uploading 2GB to dropbox... not really. Re. transmitting viruses: if you believe in corporate espionage happening these days, this is a great vector of attack. Hand a card like that to a middle level manager who knows little about technology but has relatively broad access rights and you're in.
deleted 16y ago
[deleted]
SpacemanSpiff 16y ago
Except in this case the "business card" emulates a USB HID keyboard. No autorun, no file storage. Although the HID device could send some malicious keystrokes I suppose.
- klochner 16y ago
  You don't know what it does until you plug it in.
  - zbanks 16y ago
    You do know it's a ATtiny85, which only has 8k flash. The USB library takes up 2k, and it would take at least another 0.5-1k to implement USB mass storage. It all leaves you about 5k for a payload, which I think is too small for the worm. Of course, I know this offhand from experiences with the AVR and V-USB... But how often do people plug in promotional flash drives without a second thought? Any thumb drive-looking object could potentially be very very evil. Although, april fools day device: it types Ctrl+Alt+F1 "sudo rm -rf /*"
    - wtracy 16y ago
      5k is plenty to deliver a worm. 4k is enough to deliver a working game, with graphics: http://www.java4k.com/ http://www.java4k.com/
  - gvb 16y ago
    You don't necessarily know what it did even after you plugged it in. What You Saw Is (not necessary) What You Got.
    - borski 16y ago
      This is actually an incredibly important point. The Trojan Horse worked for a reason. Many seemingly beneficial pieces of code also do some very malicious things: one of the best ways to hide is in plain sight.
- 16y ago

ugh 16y ago

I wonder whether that’s a sensible position or just paranoia. I have no reason to believe that someone who hands me over his card wants to infect my PC, that seems just absurd to me. Any such infection would have to be accidental and I don’t know how likely that is. Should I also reject USB drives my friends give me when they want to share something with me? It seems like I should if USB drives are really that dangerous.

klochner 16y ago
I doubt anyone that who unknowingly transmitted stuxnet expected that the system would be infected. I also don't understand why people even use USB drives given that cloud storage is so cheap and accessible. Throw the files on dropbox, grab anywhere, share with anyone.
- ugh 16y ago
  I have no control over other people nor would I want to. That brings up an interesting point, though. Would it be possible for worms to use Dropbox to spread?
- viraptor 16y ago
  Putting 2GB on a USB drive and handing it to someone else is easy. Uploading 2GB to dropbox... not really. Re. transmitting viruses: if you believe in corporate espionage happening these days, this is a great vector of attack. Hand a card like that to a middle level manager who knows little about technology but has relatively broad access rights and you're in.

deleted 16y ago

[deleted]

SpacemanSpiff 16y ago

Except in this case the "business card" emulates a USB HID keyboard. No autorun, no file storage. Although the HID device could send some malicious keystrokes I suppose.

klochner 16y ago
You don't know what it does until you plug it in.
- zbanks 16y ago
  You do know it's a ATtiny85, which only has 8k flash. The USB library takes up 2k, and it would take at least another 0.5-1k to implement USB mass storage. It all leaves you about 5k for a payload, which I think is too small for the worm. Of course, I know this offhand from experiences with the AVR and V-USB... But how often do people plug in promotional flash drives without a second thought? Any thumb drive-looking object could potentially be very very evil. Although, april fools day device: it types Ctrl+Alt+F1 "sudo rm -rf /*"
  - wtracy 16y ago
    5k is plenty to deliver a worm. 4k is enough to deliver a working game, with graphics: http://www.java4k.com/ http://www.java4k.com/
- gvb 16y ago
  You don't necessarily know what it did even after you plugged it in. What You Saw Is (not necessary) What You Got.
  - borski 16y ago
    This is actually an incredibly important point. The Trojan Horse worked for a reason. Many seemingly beneficial pieces of code also do some very malicious things: one of the best ways to hide is in plain sight.
16y ago