23 ms·

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password (EDIT: or the user explicitly authorizes the device using a different keyboard). If it identifies itself as a storage device, the filesystem driver should be hardened. If it identifies itself as an obscure 90s printer with a buggy driver written in C, it should prompt the user to confirm the device type before it loads the driver. It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions?

jakeinspace 8y ago
One small example: KVM switches would become incredibly cumbersome to use. However, I agree, there should be a much higher security standard for USB devices on the OS-level.
- jimrandomh 8y ago
  There are some implementation details that the KVM maker would have to get right, but if they don't screw it up, it all works as expected. Good KVMs already look at the keyboards they have connected, present separate virtual keyboards to connected computers, and route keystrokes explicitly based on state. You just need them to count the keyboards connected to them, and present a separate virtual keyboard for each downstream connected keyboard, so that the connected computers can tell which keystrokes came from which keyboard.
  - jakeinspace 8y ago
    That makes sense, guess I never really took time to think about it or inspect.
pilsetnieks 8y ago
Because very many people (and more importantly, businesses) have obscure buggy printers from the 90s or the equivalent thereof.
- jimmy1 8y ago
  And because the 99% use case is: "I plug it in and I want it to just work" This type of protection parent is referencing is "endpoint protection" and there are many industry standard solutions. Why should an OS be more limiting? If you have physical access to a machine that stores things you shouldn't have access to, it's already compromised in my opinion. Why the eff are people overlooking physical security in 2019 is the better question.
- jimrandomh 8y ago
  The key thing to realize is that malicious USB devices get to choose which device they identify themself as to the operating system, but have much less control over what they physically look like to the user. If you plug in an old printer, you know you just plugged in an old printer; you can load the old-printer device driver and it probably won't exploit it. But if you plug in a USB stick you found in the parking lot, and it asks you whether you just plugged in an old printer, then the game is up; you know it's a tricky device, pretending to be something it's not in order to target a security vulnerability.
  - Godel_unicode 8y ago
    You are putting way, way too much faith in the average user. See, for instance, TLS exceptions. Also, realize that all the adversary needs to do is some trivial social engineering. A label on the thumb drive with a picture of the prompt and a mouse over "ok" would probably do it.
bdamm 8y ago
Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing various virtual files that contain temperature data in them, but the cat's out of the bag, so to speak.
- jpindar 8y ago
  Eeewww. Why not just make it a virtual com port, which most computers already have drivers for?
  - bsder 8y ago
    Because Windows, the most popular operating system on the planet, didn't have VCOM drivers by default until Windows 10. This is why everybody tries to piggyback on being a USB HID device.
    - taneq 8y ago
      It did for a few different devices, they could have mimicked one of those. Source: Have plugged several brands of USB-to-COM adapter in to Win 7 / 8.1 and they've "just worked".
      - bsder 8y ago
        Somebody, somewhere had to install a driver. And, because you could never count on it, you can't design to it. Now, since most things use a Prolific chip, you only have to install the driver for one device and you pick up a ton of them. But it has to be installed by somebody, and that means all of the silliness that goes along with Windows driver installation.
        oarsinsync 8y ago
q3k 8y ago
>It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions? Because up until 10 years ago, developing your own USB device was generally expensive and malicious devices ended up being out of scope in threat modelling. In addition, some models these days still define 'physical access == game over'...
- robertAngst 8y ago
  >USB device was generally expensive How expensive? USB is a protocol, a micro, and some power management. How long ago was this 'out of scope'?
  - jolmg 8y ago
    I imagine he means before the advent of 3d printing, services like PCBWay, products like Arduino, and online stores like DigiKey. It's probably much easier to make one's own devices today than it was when USB was first being designed. He's also right about the physical access thing. Fundamentally, it doesn't make much sense to add protections against scenarios where the attacker apparently needs physical access, because there's no way to protect against all things he could possibly do then. It's not really obvious that the user needs protecting from himself as he plugs in a device of doubtful origins. We used to hold the user to higher standards.
enraged_camel 8y ago
Because the overwhelming majority of computer users in the world are not sophisticated, and want things to "just work" once those things are plugged in. I don't think it's an unreasonable expectation/desire, despite the risks. Keep in mind that autoplay is not unique to USB drives either. CD-ROM drives have had that feature forever.
xtreme 8y ago
> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password. Wireless presenters often identify themselves as keyboards so that they can "press" the arrow keys to move forward or backward. How are you going to type your password using such a device?
- the8472 8y ago
  You would only need the password-auth to bootstrap your primary keyboard. If you already have a keyboard you can just accept the prompt.
- jimrandomh 8y ago
  Yes, there are corner cases (another commenter mentioned a temperature sensor, and I this is also common among barcode scanners). These corner cases are not hard to work out; just prompt the user and require them to confirm that the device is, in fact, allowed to act like a keyboard. (Which would mean you can still have malware-download-command-typers pretending to be barcode-scanners pretending to be keyboards, but you can't have malware-download-command-typers pretending to be storage devices pretending to be keyboards, because the "Allow typing with this keyboard?" dialog will give it away.)
  - markaz 8y ago
    I would guess that 99% of users would click ok for "Allow typing with this keyboard?" when they plug in a USB storage device.
    - gowld 8y ago
      I'd hope the Secret Service is in the 1%.
the8472 8y ago
You can lockdown USB access on linux with usbguard[0]. IIRC windows 10 enterprise also has some USB whitelist feature somewhere. [0] https://usbguard.github.io/ https://usbguard.github.io/
- regecks 8y ago
  This was super easy to setup in Ubuntu, thanks!
travisglines 8y ago
I wish I could upvote this comment twice. At this point in 2019 intelligence gathering and government/corporate security vulnerabilities are much more in the digital realm than physical. Wifi enabled cameras/microphones, cell phones, servers, consumer computers, usb devices, iot devices are all used to that end. We need to hold the flame to OS vendors to handle basic security precautions. It's not like the US government doesn't have contract negotiations with them large enough to force the issue. It's also unacceptable to have security around the most protected person on the planet be ignorant to common attack vectors and procedures.
- samstave 8y ago
  If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.
  - na85 8y ago
    Hasn't the security by obscurity myth been debunked, and furthermore hasn't government proven itself utterly incompetent at designing products?
    - samstave 8y ago
      Thats not really what I meant. I am just saying that they should have a pre usb meter that prevents the usb stick from being attached to a device directly such that they can screen it off ...
    - Godel_unicode 8y ago
      > incompetent at designing products? You mean like SELinux? Or SE Android? Or the STIGs?
    - hopler 8y ago
      Defense in depth has not been debunked.
    - RandomTisk 8y ago
loser777 8y ago
This is likely not enough to secure a system against a sufficiently skilled adversary. An OS has limited control over many of the side-channels available to the USB stick once it is inserted into the system (e.g., fluctuations in the voltage rails that give away what the processor is doing). If you are thinking in terms of "if it identifies itself as...," then there is a good chance that something lower in the stack may be compromised. This gets even more troublesome once we consider that people sometimes forget that seemingly "dumb" dongles such as display adapters can be very similar to USB sticks from an implementation and vulnerability point of view (e.g., "Thunderclap"). I think the overhead of hardening systems for each of these scenarios would be immense.
- robocat 8y ago
  > This is likely not enough to secure a system against a sufficiently skilled adversary. That statement is not helpful, because it remains true for any security measure. The GP suggestions can make everyone's computers more secure now, at what would seem to be a low cost...
- jimrandomh 8y ago
  Yes, there will likely still be ways for a malicious USB device to use electrical side-channels to attack a connected computer. But devices like that will be much harder to develop. And more importantly: compromised devices which weren't originally designed to do that, won't be able to rewire themselves into side-channel-exploiters. So if my USB storage device has a firmware vulnerability, and a malicious computer reprograms it, it won't be able to use electrical side-channels to attack my other computers because it doesn't have a suitable DAC and ADC.
sjg007 8y ago
Backwards compatibility.. /s
peterwwillis 8y ago
Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need protection from advanced thieves you'll need to go through some extra hoops anyway. You could petition OS manufacturers to focus more on physical security, but there's limits to what you can do without piles of abstractions (ala smart phone security)
- gowld 8y ago
  A human cannot vet an electronic device. We can only interface to it from another electronic device. The same argument applies to the Internet -- we don't say that it's the human's responsibility to vet every website or email message before we let our computer connect to it. We expect our computer to do that. That's why it was wrong for Outlook to automatically execute every program sent to you via email.
  - peterwwillis 8y ago
    Your computer isn't vetting things it gets from the internet at all, with the exception of TLS certs and anti-virus scanning. Virtually all other operations done with remote content are unvetted; it's play & pray. You clicking a button is the only vetting process.
- TheDong 8y ago
  > it's your responsibility to vet what you plug into it Okay, please explain a little more. I'll give you a concrete example of a device to work with. Last week I accidentally left my usb flash drive at a coffee shop with some important files on it. When I went back, the coffee shop had it in the lost and found. It looks the same on the outside, but it's a mass-produced model. How do a vet this hardware before plugging it into my computer? I do need to access the files on it, but also attackers may have had access to it for several hours.
  - 781 8y ago
    If security is so important to you, you buy a $100 laptop, put the stick in it, get the files and upload them somewhere then burn the laptop and stick. Or just go to an "Internet Cafe" and do it there.
jolmg 8y ago
Yubikeys can pretend to be keyboards to type your password. It's a simple way to get maximum compatibility for a hardware key. I imagine there's other legitimate use-cases for non-keyboards to act like keyboards. Still, requiring one to type a password in a newly connected keyboard is a pretty good idea as long as it's a configuration option. I imagine you'd also like something similar for the mouse. Maybe having to type a password on a virtual keyboard. It's annoying to have to do something like that every time a computer is woken up. You're talking about typing a password 3 times. Once to log the keyboard in, then to log the mouse in, then to select a user and log the user in. Your other suggestions are vague, so I'm not sure what you mean by "basic". I mean, if one knows a driver is buggy, those bugs would be taken care of (from the developer's point of view; the administrator might not update the software, but what can the developer do?). And what does it mean to "harden" a filesystem driver when a device identifies itself as a storage device? A filesystem driver should be "hard", period. All the time. That's something done when the driver is being written, not until it identifies a device.
- hopler 8y ago
  You only need to authenticate a device once, when you first acquire it, or after it is tainted due to loss of physical control. This is how Bluetooth works today.
  - jolmg 8y ago
    Maybe I'm wrong, but there's currently no sort of authentication protocol for devices in USB, right? I (and I think jimrandomh too) was thinking of USB as-is. Something that OSes can do right now without having to wait for whoever controls the USB spec. As it is, how can an OS know that the mouse it sees on waking up is the same mouse that was connected before it slept or powered off? I don't think there's any sort of cryptographic authentication specified for USB devices.
delinka 8y ago
great, now I've typed my password into what turned out to be a malicious device ...
- jimrandomh 8y ago
  You misunderstand. Malicious USB devices often present themselves to computers as keyboards, which type malicious commands. But they don't look like keyboards, or have keys on them; they usually look like USB storage devices.
  - kyle-rb 8y ago
    Now I'm imagining someone dropping malicious keyboards instead of USB sticks, waiting for people to pick them up and plug them into their computers.
    - itronitron 8y ago
      They don't drop them but instead ship them to arrive for Friday delivery. Over the course of the weekend the malicious keyboard cuts its way out of the shipping envelope and scans the target office for the nearest USB port. More recent models will shove the existing keyboard behind the desk, like a Cuckoo chick does with any remaining eggs after hatching.
  - delinka 8y ago
    You misunderstand. Start forcing me to type my password as the first thing into a new keyboard, and now malicious keyboards can be certain that the first characters up to <ENTER> are a valid password for the device in question.
- gowld 8y ago
  That's already a risk with any keyboard you use.
deleted 8y ago
[deleted]
lawl 8y ago
> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions? For linux you can actually require USB devices to be authorized first by changing a few kernel settings. A friend of mine wrote a few shellscripts a few years ago to do exactly that: https://git.quitesimple.org/usbfilter/tree/ https://git.quitesimple.org/usbfilter/tree/ As you can see it's something that's very simple to do, there's just no good "normal user" UI for it.
- Reelin 8y ago
  Better late than never? https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.1-USB-Auth-Default-2 https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.... https://usbguard.github.io https://usbguard.github.io
  - jimrandomh 8y ago
    That's definitely progress, but there's more work needed to make it usable enough to be on by default.
    - Reelin 8y ago
      As far as I understand it, this already is on by default for ChromeOS. The kernel patches make it possible to utilize internal USB devices during the boot process without disabling protection - ie there's no vulnerability window prior to user space being up and running. I believe the major missing piece for desktop Linux at this point is that many input devices (including my own) are USB based. Without a way for the device to cryptographically attest its identity, you either have to accept vulnerability from wired external devices during boot or do without input until user space has been started. Edit: My mistake. It appears that it was opt-in as of January, will become on-by-default at some point in the future, and only blocks devices during boot and while the screen is locked. It appears to trust all devices plugged into it once you've logged in. (https://www.forbes.com/sites/leemathews/2019/01/07/google-shields-chromebooks-from-sneaky-usb-attacks https://www.forbes.com/sites/leemathews/2019/01/07/google-sh...)
nkozyra 8y ago
Why is the secret service using Windows, osx or Linux to do USB analysis in the first place?
runciblespoon 8y ago
> It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. Well, just the one OS vendor comes to mind and a particular chip maker also shares the blame. Just how difficult can it be to design-in total isolation into a 'computer'.
admax88q 8y ago
Problem is some of the vulnerabilities can be in the USB controller firmware itself.
flukus 8y ago
> It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. Universal plug'n'play is USB's reason for existence, if it can't do that then maybe we should step away from USB itself. Back when keyboards were plugged into PS/2 ports I didn't have to worry a floppy disk would emulate one (ignoring autorun). I'm sure it's possible to have a malicious PS/2 device, but having it plug into the keyboard port would at least indicate what it's going to do.
01100011 8y ago
Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an software defined radio which could execute arbitrary bluetooth and WiFi attacks while allowing remote control via RF. Am I the only one old enough to remember 'disk bombs' from the 90s where you filled 3.5" floppies with paste made from strike anywhere match heads so when the disk spun up it melted? You could do similar things with a USB stick. You could have a high voltage converter which fries your PC the second you plug it in. Basically, it is always a bad idea to plug in unknown peripherals to your computers. The OS isn't going to save you in all cases.
- oh_sigh 8y ago
  Seat belts and airbags don't save you in all cases, but we use them.
  - identity0 8y ago
    That's different. Car crashes are unpreventable, unexpected events that we can prepare for. Plugging random USB stick into your computer is preventable, and adding these safety features may cause people to think it is safe to plug in random USB sticks into their computer.
    - oh_sigh 8y ago
      Most car crashes are extremely preventable. Do some people not drive more dangerously because they believe themselves to be safe because of things like seat belts?
      - interfixus 8y ago
        You are so right. I never understood the prevalent idea that traffic accidents are somehow random rolls of the dice. Seemingly the vast majority of them are not. Adjust your speed, not too fast, not too slow; stay focused on road, mirrors, and other traffic; keep your distance; don't be drunk; don't fall asleep; know and follow the rules, and you will hugely reduce your risk of harm.
i_feel_great 8y ago
In BSDs and Linux, you can recompile the kernel without USB support. But then you will have to go back to using a PS/2 keyboard and mouse.
- jlgaddis 8y ago
  In Linux, you don't even need to recompile the kernel. You can simply pass the "nousb" parameter at boot.
Terr_ 8y ago
> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password Probably easier/safer to display a random number on-screen and then ask the user to retype it into the device. I figure numbers are less likely to run into problems when the keyboard isn't US-standard QWERTY. For more paranoia/portability, show the user a repeating rhythm-game and wait for them to hit any keys they want as long as it is close enough to the correct pattern. ("Shave and a haircut... two bits!") You could also use audio output for the user to hear, but then the attacker could embed a tiny microphone in the USB stick...
- jpindar 8y ago
  Then in a walk-by attack the attacker can just type the number or play the game. Hopefully they wouldn't know the user's password.
  - Terr_ 8y ago
    Confirming a new device should always be separate from the dozens of unique and distinctive scenarios where a user might (or might not) need to authenticate themselves.
- jimrandomh 8y ago
  The reason for it to be the user's login password is that, in the common case where you plug a keyboard into a computer that's just booted or which has been unattended for awhile, you're already typing a login password, so it isn't making you do anything you weren't doing already.
deleted 8y ago
[deleted]
romanovcode 8y ago
Because then mouse, keyboard and other devices will not automatically work when you plug them in and 99% of users will hate that.
gambiting 8y ago
I'd like to point out that nearly every single USB barcode scanner shows up as a keyboard to the operating system. Your point of sale system has to have focus on the field awaiting input and then when you scan a barcode it just "types in" the scanned number. What you are suggesting would immediately brake compatibility with a huge number of devices out there.

jakeinspace 8y ago

One small example: KVM switches would become incredibly cumbersome to use. However, I agree, there should be a much higher security standard for USB devices on the OS-level.

jimrandomh 8y ago
There are some implementation details that the KVM maker would have to get right, but if they don't screw it up, it all works as expected. Good KVMs already look at the keyboards they have connected, present separate virtual keyboards to connected computers, and route keystrokes explicitly based on state. You just need them to count the keyboards connected to them, and present a separate virtual keyboard for each downstream connected keyboard, so that the connected computers can tell which keystrokes came from which keyboard.
- jakeinspace 8y ago
  That makes sense, guess I never really took time to think about it or inspect.

pilsetnieks 8y ago

Because very many people (and more importantly, businesses) have obscure buggy printers from the 90s or the equivalent thereof.

jimmy1 8y ago
And because the 99% use case is: "I plug it in and I want it to just work" This type of protection parent is referencing is "endpoint protection" and there are many industry standard solutions. Why should an OS be more limiting? If you have physical access to a machine that stores things you shouldn't have access to, it's already compromised in my opinion. Why the eff are people overlooking physical security in 2019 is the better question.
jimrandomh 8y ago
The key thing to realize is that malicious USB devices get to choose which device they identify themself as to the operating system, but have much less control over what they physically look like to the user. If you plug in an old printer, you know you just plugged in an old printer; you can load the old-printer device driver and it probably won't exploit it. But if you plug in a USB stick you found in the parking lot, and it asks you whether you just plugged in an old printer, then the game is up; you know it's a tricky device, pretending to be something it's not in order to target a security vulnerability.
- Godel_unicode 8y ago
  You are putting way, way too much faith in the average user. See, for instance, TLS exceptions. Also, realize that all the adversary needs to do is some trivial social engineering. A label on the thumb drive with a picture of the prompt and a mouse over "ok" would probably do it.

bdamm 8y ago

Recently I tried out some USB temperature sensors. They present as both a proprietary temperature sensor and also as a USB keyboard. In the event you don't have a driver for the sensor, you can still get your readings by toggling the caps lock which sends a "turn on caps lock lamp" signal to the "keyboard", which responds by "typing" the temperature data. I'd rather this device presented itself as a drive containing various virtual files that contain temperature data in them, but the cat's out of the bag, so to speak.

jpindar 8y ago
Eeewww. Why not just make it a virtual com port, which most computers already have drivers for?
- bsder 8y ago
  Because Windows, the most popular operating system on the planet, didn't have VCOM drivers by default until Windows 10. This is why everybody tries to piggyback on being a USB HID device.
  - taneq 8y ago
    It did for a few different devices, they could have mimicked one of those. Source: Have plugged several brands of USB-to-COM adapter in to Win 7 / 8.1 and they've "just worked".
    - bsder 8y ago
      Somebody, somewhere had to install a driver. And, because you could never count on it, you can't design to it. Now, since most things use a Prolific chip, you only have to install the driver for one device and you pick up a ton of them. But it has to be installed by somebody, and that means all of the silliness that goes along with Windows driver installation.
      - oarsinsync 8y ago

q3k 8y ago

>It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions? Because up until 10 years ago, developing your own USB device was generally expensive and malicious devices ended up being out of scope in threat modelling. In addition, some models these days still define 'physical access == game over'...

robertAngst 8y ago
>USB device was generally expensive How expensive? USB is a protocol, a micro, and some power management. How long ago was this 'out of scope'?
- jolmg 8y ago
  I imagine he means before the advent of 3d printing, services like PCBWay, products like Arduino, and online stores like DigiKey. It's probably much easier to make one's own devices today than it was when USB was first being designed. He's also right about the physical access thing. Fundamentally, it doesn't make much sense to add protections against scenarios where the attacker apparently needs physical access, because there's no way to protect against all things he could possibly do then. It's not really obvious that the user needs protecting from himself as he plugs in a device of doubtful origins. We used to hold the user to higher standards.

enraged_camel 8y ago

Because the overwhelming majority of computer users in the world are not sophisticated, and want things to "just work" once those things are plugged in. I don't think it's an unreasonable expectation/desire, despite the risks. Keep in mind that autoplay is not unique to USB drives either. CD-ROM drives have had that feature forever.

xtreme 8y ago

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password. Wireless presenters often identify themselves as keyboards so that they can "press" the arrow keys to move forward or backward. How are you going to type your password using such a device?

the8472 8y ago
You would only need the password-auth to bootstrap your primary keyboard. If you already have a keyboard you can just accept the prompt.
jimrandomh 8y ago
Yes, there are corner cases (another commenter mentioned a temperature sensor, and I this is also common among barcode scanners). These corner cases are not hard to work out; just prompt the user and require them to confirm that the device is, in fact, allowed to act like a keyboard. (Which would mean you can still have malware-download-command-typers pretending to be barcode-scanners pretending to be keyboards, but you can't have malware-download-command-typers pretending to be storage devices pretending to be keyboards, because the "Allow typing with this keyboard?" dialog will give it away.)
- markaz 8y ago
  I would guess that 99% of users would click ok for "Allow typing with this keyboard?" when they plug in a USB storage device.
  - gowld 8y ago
    I'd hope the Secret Service is in the 1%.

the8472 8y ago

You can lockdown USB access on linux with usbguard[0]. IIRC windows 10 enterprise also has some USB whitelist feature somewhere. [0] https://usbguard.github.io/ https://usbguard.github.io/

regecks 8y ago
This was super easy to setup in Ubuntu, thanks!

travisglines 8y ago

I wish I could upvote this comment twice. At this point in 2019 intelligence gathering and government/corporate security vulnerabilities are much more in the digital realm than physical. Wifi enabled cameras/microphones, cell phones, servers, consumer computers, usb devices, iot devices are all used to that end. We need to hold the flame to OS vendors to handle basic security precautions. It's not like the US government doesn't have contract negotiations with them large enough to force the issue. It's also unacceptable to have security around the most protected person on the planet be ignorant to common attack vectors and procedures.

samstave 8y ago
If i were a gov, id have a gov only interface. One that isnt common and available to every person on the planet.
- na85 8y ago
  Hasn't the security by obscurity myth been debunked, and furthermore hasn't government proven itself utterly incompetent at designing products?
  - samstave 8y ago
    Thats not really what I meant. I am just saying that they should have a pre usb meter that prevents the usb stick from being attached to a device directly such that they can screen it off ...
  - Godel_unicode 8y ago
    > incompetent at designing products? You mean like SELinux? Or SE Android? Or the STIGs?
  - hopler 8y ago
    Defense in depth has not been debunked.
  - RandomTisk 8y ago

loser777 8y ago

This is likely not enough to secure a system against a sufficiently skilled adversary. An OS has limited control over many of the side-channels available to the USB stick once it is inserted into the system (e.g., fluctuations in the voltage rails that give away what the processor is doing). If you are thinking in terms of "if it identifies itself as...," then there is a good chance that something lower in the stack may be compromised. This gets even more troublesome once we consider that people sometimes forget that seemingly "dumb" dongles such as display adapters can be very similar to USB sticks from an implementation and vulnerability point of view (e.g., "Thunderclap"). I think the overhead of hardening systems for each of these scenarios would be immense.

robocat 8y ago
> This is likely not enough to secure a system against a sufficiently skilled adversary. That statement is not helpful, because it remains true for any security measure. The GP suggestions can make everyone's computers more secure now, at what would seem to be a low cost...
jimrandomh 8y ago
Yes, there will likely still be ways for a malicious USB device to use electrical side-channels to attack a connected computer. But devices like that will be much harder to develop. And more importantly: compromised devices which weren't originally designed to do that, won't be able to rewire themselves into side-channel-exploiters. So if my USB storage device has a firmware vulnerability, and a malicious computer reprograms it, it won't be able to use electrical side-channels to attack my other computers because it doesn't have a suitable DAC and ADC.

sjg007 8y ago

Backwards compatibility.. /s

peterwwillis 8y ago

Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need protection from advanced thieves you'll need to go through some extra hoops anyway. You could petition OS manufacturers to focus more on physical security, but there's limits to what you can do without piles of abstractions (ala smart phone security)

gowld 8y ago
A human cannot vet an electronic device. We can only interface to it from another electronic device. The same argument applies to the Internet -- we don't say that it's the human's responsibility to vet every website or email message before we let our computer connect to it. We expect our computer to do that. That's why it was wrong for Outlook to automatically execute every program sent to you via email.
- peterwwillis 8y ago
  Your computer isn't vetting things it gets from the internet at all, with the exception of TLS certs and anti-virus scanning. Virtually all other operations done with remote content are unvetted; it's play & pray. You clicking a button is the only vetting process.
TheDong 8y ago
> it's your responsibility to vet what you plug into it Okay, please explain a little more. I'll give you a concrete example of a device to work with. Last week I accidentally left my usb flash drive at a coffee shop with some important files on it. When I went back, the coffee shop had it in the lost and found. It looks the same on the outside, but it's a mass-produced model. How do a vet this hardware before plugging it into my computer? I do need to access the files on it, but also attackers may have had access to it for several hours.
- 781 8y ago
  If security is so important to you, you buy a $100 laptop, put the stick in it, get the files and upload them somewhere then burn the laptop and stick. Or just go to an "Internet Cafe" and do it there.

jolmg 8y ago

Yubikeys can pretend to be keyboards to type your password. It's a simple way to get maximum compatibility for a hardware key. I imagine there's other legitimate use-cases for non-keyboards to act like keyboards. Still, requiring one to type a password in a newly connected keyboard is a pretty good idea as long as it's a configuration option. I imagine you'd also like something similar for the mouse. Maybe having to type a password on a virtual keyboard. It's annoying to have to do something like that every time a computer is woken up. You're talking about typing a password 3 times. Once to log the keyboard in, then to log the mouse in, then to select a user and log the user in. Your other suggestions are vague, so I'm not sure what you mean by "basic". I mean, if one knows a driver is buggy, those bugs would be taken care of (from the developer's point of view; the administrator might not update the software, but what can the developer do?). And what does it mean to "harden" a filesystem driver when a device identifies itself as a storage device? A filesystem driver should be "hard", period. All the time. That's something done when the driver is being written, not until it identifies a device.

hopler 8y ago
You only need to authenticate a device once, when you first acquire it, or after it is tainted due to loss of physical control. This is how Bluetooth works today.
- jolmg 8y ago
  Maybe I'm wrong, but there's currently no sort of authentication protocol for devices in USB, right? I (and I think jimrandomh too) was thinking of USB as-is. Something that OSes can do right now without having to wait for whoever controls the USB spec. As it is, how can an OS know that the mouse it sees on waking up is the same mouse that was connected before it slept or powered off? I don't think there's any sort of cryptographic authentication specified for USB devices.

delinka 8y ago

great, now I've typed my password into what turned out to be a malicious device ...

jimrandomh 8y ago
You misunderstand. Malicious USB devices often present themselves to computers as keyboards, which type malicious commands. But they don't look like keyboards, or have keys on them; they usually look like USB storage devices.
- kyle-rb 8y ago
  Now I'm imagining someone dropping malicious keyboards instead of USB sticks, waiting for people to pick them up and plug them into their computers.
  - itronitron 8y ago
    They don't drop them but instead ship them to arrive for Friday delivery. Over the course of the weekend the malicious keyboard cuts its way out of the shipping envelope and scans the target office for the nearest USB port. More recent models will shove the existing keyboard behind the desk, like a Cuckoo chick does with any remaining eggs after hatching.
- delinka 8y ago
  You misunderstand. Start forcing me to type my password as the first thing into a new keyboard, and now malicious keyboards can be certain that the first characters up to <ENTER> are a valid password for the device in question.
gowld 8y ago
That's already a risk with any keyboard you use.

deleted 8y ago

[deleted]

lawl 8y ago

> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions? For linux you can actually require USB devices to be authorized first by changing a few kernel settings. A friend of mine wrote a few shellscripts a few years ago to do exactly that: https://git.quitesimple.org/usbfilter/tree/ https://git.quitesimple.org/usbfilter/tree/ As you can see it's something that's very simple to do, there's just no good "normal user" UI for it.

Reelin 8y ago
Better late than never? https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.1-USB-Auth-Default-2 https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.... https://usbguard.github.io https://usbguard.github.io
- jimrandomh 8y ago
  That's definitely progress, but there's more work needed to make it usable enough to be on by default.
  - Reelin 8y ago
    As far as I understand it, this already is on by default for ChromeOS. The kernel patches make it possible to utilize internal USB devices during the boot process without disabling protection - ie there's no vulnerability window prior to user space being up and running. I believe the major missing piece for desktop Linux at this point is that many input devices (including my own) are USB based. Without a way for the device to cryptographically attest its identity, you either have to accept vulnerability from wired external devices during boot or do without input until user space has been started. Edit: My mistake. It appears that it was opt-in as of January, will become on-by-default at some point in the future, and only blocks devices during boot and while the screen is locked. It appears to trust all devices plugged into it once you've logged in. (https://www.forbes.com/sites/leemathews/2019/01/07/google-shields-chromebooks-from-sneaky-usb-attacks https://www.forbes.com/sites/leemathews/2019/01/07/google-sh...)

nkozyra 8y ago

Why is the secret service using Windows, osx or Linux to do USB analysis in the first place?

runciblespoon 8y ago

> It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. Well, just the one OS vendor comes to mind and a particular chip maker also shares the blame. Just how difficult can it be to design-in total isolation into a 'computer'.

admax88q 8y ago

Problem is some of the vulnerabilities can be in the USB controller firmware itself.

flukus 8y ago

> It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. Universal plug'n'play is USB's reason for existence, if it can't do that then maybe we should step away from USB itself. Back when keyboards were plugged into PS/2 ports I didn't have to worry a floppy disk would emulate one (ignoring autorun). I'm sure it's possible to have a malicious PS/2 device, but having it plug into the keyboard port would at least indicate what it's going to do.

01100011 8y ago

Sure, you can fix it so devices don't appear as unauthorized keyboards... you still leave yourself open to a near infinite number of other attacks. What stops me from creating a USB device that appears as a storage medium, yet contains a transmitter which slowly exfiltrates any data written? What about a USB-powered microphone or camera posing as a flash drive? Hell, it would be of great value to just have an software defined radio which could execute arbitrary bluetooth and WiFi attacks while allowing remote control via RF. Am I the only one old enough to remember 'disk bombs' from the 90s where you filled 3.5" floppies with paste made from strike anywhere match heads so when the disk spun up it melted? You could do similar things with a USB stick. You could have a high voltage converter which fries your PC the second you plug it in. Basically, it is always a bad idea to plug in unknown peripherals to your computers. The OS isn't going to save you in all cases.

oh_sigh 8y ago
Seat belts and airbags don't save you in all cases, but we use them.
- identity0 8y ago
  That's different. Car crashes are unpreventable, unexpected events that we can prepare for. Plugging random USB stick into your computer is preventable, and adding these safety features may cause people to think it is safe to plug in random USB sticks into their computer.
  - oh_sigh 8y ago
    Most car crashes are extremely preventable. Do some people not drive more dangerously because they believe themselves to be safe because of things like seat belts?
    - interfixus 8y ago
      You are so right. I never understood the prevalent idea that traffic accidents are somehow random rolls of the dice. Seemingly the vast majority of them are not. Adjust your speed, not too fast, not too slow; stay focused on road, mirrors, and other traffic; keep your distance; don't be drunk; don't fall asleep; know and follow the rules, and you will hugely reduce your risk of harm.

i_feel_great 8y ago

In BSDs and Linux, you can recompile the kernel without USB support. But then you will have to go back to using a PS/2 keyboard and mouse.

jlgaddis 8y ago
In Linux, you don't even need to recompile the kernel. You can simply pass the "nousb" parameter at boot.

Terr_ 8y ago

> If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until that keyboard has typed the user's login password Probably easier/safer to display a random number on-screen and then ask the user to retype it into the device. I figure numbers are less likely to run into problems when the keyboard isn't US-standard QWERTY. For more paranoia/portability, show the user a repeating rhythm-game and wait for them to hit any keys they want as long as it is close enough to the correct pattern. ("Shave and a haircut... two bits!") You could also use audio output for the user to hear, but then the attacker could embed a tiny microphone in the USB stick...

jpindar 8y ago
Then in a walk-by attack the attacker can just type the number or play the game. Hopefully they wouldn't know the user's password.
- Terr_ 8y ago
  Confirming a new device should always be separate from the dozens of unique and distinctive scenarios where a user might (or might not) need to authenticate themselves.
jimrandomh 8y ago
The reason for it to be the user's login password is that, in the common case where you plug a keyboard into a computer that's just booted or which has been unattended for awhile, you're already typing a login password, so it isn't making you do anything you weren't doing already.

deleted 8y ago

[deleted]

romanovcode 8y ago

Because then mouse, keyboard and other devices will not automatically work when you plug them in and 99% of users will hate that.

gambiting 8y ago

I'd like to point out that nearly every single USB barcode scanner shows up as a keyboard to the operating system. Your point of sale system has to have focus on the field awaiting input and then when you scan a barcode it just "types in" the scanned number. What you are suggesting would immediately brake compatibility with a huge number of devices out there.