8 ms·
In a similar vein, there are USB gadgets that emulate a mouse that keeps on jiggling, to prevent the machine from locking out on user inactivity. However, ther
by huhtenberg 6y ago
In a similar vein, there are USB gadgets that emulate a mouse that keeps on jiggling, to prevent the machine from locking out on user inactivity.
However, there are anti-jigglers too that lock the machine when any new human input device is plugged in.
http://codefromthe70s.org/antijiggler.aspx http://codefromthe70s.org/antijiggler.aspx
- kawsper 6y agoThat's interesting. You could have a list of known USB device IDs you trust, and if a newly plugged in USB device wasn't on that list you could lock or power down.
- ThePadawan 6y agoThat is a policy I heard to be used in already not-extremely-secure environments like software development at a bank (completely isolated from production environment). They didn't go so far as to cause alarms on unknown device ids, but devices would just not be mounted if they were not whitelisted.
- walrus01 6y agoAbout 13-14 years ago some parts of the US DoD resorted to hot glue gun filling all the usb ports on desktop PCs, except for the two ports required for the keyboard and mouse. This was during the windows XP era when it seemed there were an endless number of security problems related to usb devices, no matter how good the group policy and registry settings pushed via active directory membership were.
- swalsh 6y agoWhat does that solve though? I don't NEED a mouse to copy data.
- jrott 6y agoIt doesn’t solve for an outsider or malicious employee getting access to a machine. What it does solve for is an employee plugging in a compromised usb device on accident since they probably won’t unplug there keyboard or mouse for it.
- dhosek 6y agoIt solves the "I found this USB stick in the parking lot—let me plug it in to see what's on it" problem.
- icedchai 6y agoSure, if they don't have a USB hub sitting around.
- muttled 6y agoIf my experience with users holds true, they'll abandon the quest at the first obstacle and the USB will harmlessly sit in a desk drawer for the rest of time.
- dhosek 6y agoThe closest thing to a USB hub I've got is one of my external drives for my Mac Mini has a built in USB hub so I can plug stuff into that as well as directly into the computer. The last time I worried about such things was back when desktop computers only had one or two USB ports. Plus, in a DoD situation, I'd imagine that having your own USB hub plugged into a DoD computer would be the kind of thing that could put your job at risk. A friend who teaches at the Naval War College often laments the unusability of DoD IT because of the level of locking down, but any "Why don't you do X?" suggestions have a response of "I'd get fired." The safeguard doesn't need to be perfect, it just has to be good enough.
- strbean 6y agoThey'll just unplug the mouse and plug in the drive to see what happens!
- 6y ago
- huhtenberg 6y agoThey could've glued ALL usb ports and simply plugged mice and keyboards into PS/2 sockets.
- 3pt14159 6y agoThat's what my alma mater, the University of Waterloo, did for some of our labs when I attended. Then at some point something must have happened and they moved all the electronics into the PC case and only the wires of the mouse, keyboard, and monitor came out of these little openings.
- kevin_thibedeau 6y agoMy company stayed on NT4 until 2008 because it didn't have USB support. Network was fully locked down and any unknown MAC would cause an immediate search by IT.
- noir_lord 6y agoDid they also remove the MAC address info off the back of everything because spoofing a MAC is fairly trivial.
- icedchai 6y agoThey probably did. The sort of IT folks that would run a decade old OS are the same kind that would resort to this sort of security theater to "lock down" their network. Capturing MAC addresses off a device is pretty simple if you don't mind a little bit of connectivity loss during the process.
- shifto 6y agoAlso, performance must have been amazing using Office '97 on current day desktops.
- sysadmindotfail 6y ago>About 13-14 years ago some parts of the US DoD resorted to hot glue gun filling all the usb ports on desktop PCs, except for the two ports required for the keyboard and mouse. Here's a current story: Someone ordered the wrong desk phones at your large company? 1.) Assemble your crew. Go to various departments and recruit non-technical people. 2.) Task them with disassembling 1000 desk phones. 3.) Hot glue USB port on phone shut. 4.) Reassemble 1000 desk phones.
- sneak 6y agoIs the disassembly and reassembly just for more billable hours? Seems to me you could fill user-accessible USB ports with hot glue without it, same as a user could fill it with an unauthorized USB device.
- sysadmindotfail 6y agoThe procedure was done to meet an audit, less about hours and more about mitigating a mistake (I guess).
- withinboredom 6y agoThere was a virus directed at DoD machines going around via USB devices. PITA to get rid of too...
- stordoff 6y agoReminds me of my school when someone booted Ophcrack to recovered cached network passwords - they removed the CD drives. Given the machines didn't support booting from USB (IIRC), it wasn't a terrible solution.
- bnastic 6y agoI have not yet seen this implemented anywhere in banks. HID devices are fine, but anything else USB (esp. storage) is locked out completely. One of those banks wouldn't even let temp staff send emails out of the bank from their work account. (Due to various disability acts they can't really do it either, as the employer must provide their staff with hardware they require, e.g. ergonomic keyboards and mice)
- ThePadawan 6y agoThat sounds really the wrong way around - the worst offenders in USB malware surely are flash drives that declare themselves as keyboards and input preprogrammed keyboard events (like the USB Rubber Ducky [0])! (For your parenthetical I should clarify - it wasn't the case that it was impossible to whitelist other devices, it just had to be done on a case-by-case basis. I.e. you would call IT and say "Jen from accounting at machine foo123 needs her new ergonomic mouse to be recognized" and they would remote in, tell Jen to unplug and replug the device and whitelist that exact USB device id on that exact machine.) [0] https://shop.hak5.org/products/usb-rubber-ducky-deluxe https://shop.hak5.org/products/usb-rubber-ducky-deluxe
- bnastic 6y agoIt may be so, but I'm talking from experience - as a keyboard geek I have, over the past ten years, taken all sorts of weird keyboards (and mice) into various big banks with not a hint of trouble. USB storage, on the other hand, qualifies for an instant termination.
- warrenm 6y agothis is a pretty common practice on many (if not all) government networked devices that...or the USB port is permanently blocked (saw that when I was at a finserv years back: all USB ports (except the one the mouse plugged into) were epoxied
- spatley 6y agoI have seen security minded IT to go so far as requiring laptops with PS2 mouses and epoxying all the USB ports.
- icedchai 6y agoSo are they keeping a stock of laptops from the 90's? Basically no modern laptops have PS2 ports.
- reaperducer 6y agoOrder enough of them, and manufacturers will give you whatever you want.
- icedchai 6y agoIf you're big enough, sure. Why not order laptops without USB ports, instead of epoxying them then?
- blibble 6y agoeasy enough to fake the device/vendor ID, then abuse bugs in the driver/implementation
- kawsper 6y agoYes, if your attacker knows which device/vendor IDs you have on your list it won't work.
- pabs3 6y agoYou can do that sort of thing on Linux using USBGuard: https://usbguard.github.io/ https://usbguard.github.io/
- ace32229 6y agoYou will be seen as active (including on comms software (at least the ones I've tried)) if you have any sort of video playing e.g. Youtube in an active tab. Quite handy.
- warrenm 6y agoThey should call it the Jiggle-No
- vangelis 6y agoThat's where the analog mouse jiggler comes in. Apparently watche faces work quite well for for optical mice.
- reaperducer 6y agoI've read that on HN before, and tried it a few months ago. It didn't work. At least not with an Apple Magic Mouse and my wife's desk clock.
- reaperducer 6y agoIf you ever come across a jiggle-and-click gadget, let me know. Some of the computer activity trackers I've seen lately require the user to click every so often, so plain jigglers are no longer effective.
- mike_d 6y agoGet a USB Rubber Ducky and script it to send something like Mouse Button 7. The click event registers but it isn't associated with an action except in super advanced CAD software.
- donpott 6y agoFor the purposes of preventing locking out, I've had some success installing Autohotkeys and sending the MouseMove event every minute or so in a loop. No need for plugging additional USB devices.