5 ms·

USB keys will end you and how to protect yourself

17 points by FounderSec 6y ago

runamok 6y ago
Are there any good ways to protect yourself on mac, windows, linux, etc. from random USB keys? Perhaps have a raspberry pi off the network since linux in of itself would greatly diminish the attack surface? An "evil maid" can always swipe your own USB key and install malware so I'd prefer a belt and suspenders strategy. Likewise someone walking by your workstation could do a drive-by plugin too. I guess it would have to be some OS level intervention that would say "you plugged in an HID/file mount/etc., what do you want to do?"
- T3OU-736 6y ago
  A recent discussion covering this: https://news.ycombinator.com/item?id=20744590 https://news.ycombinator.com/item?id=20744590 There may well have been developments and chances, too. But, a start.
  - FounderSec 6y ago
    Great discussion there. That USBguard tool seems interesting. I'll take a look, but the tricky thing with these USB Drop Attacks is the range of forms they can take and the levels of complexity. That USBguard mentions it blocks them from userspace, and without having looked at the code I imagine there's still negotiation that happens at the firmware level, which still leaves quite a lot of room for bad things to happen. For example you could make the perfect whitelist of your devices, but someone could still easily plug in the $60 USB Kill stick and it would fry your system. They could also take advantage of firmware level USB exploits such as a DFU (device firmware update) attack to inject malicious malware at the firmware level of your system. Off top of my head, I would guess USBguard wouldn't be able to stop that lower level of exploitation, so that's why I stick with not plugging anything in that isn't mine and in more sensitive IT departments, they can disable USB ports completely from BIOS.
- FounderSec 6y ago
  I mentioned in the other reply to T3OU-736 that the real issue is how wide the spectrum of attacks are. There are things that are on the userspace level (assuming you'll run a file with malware hidden in it), to the hardware level (device emulation to pretend like it's a keyboard or ethernet adapter) and even down to the firmware/USB specification level (device firmware upgrade attacks or the USB Kill stick). That's why generally the best advice is to never trust a USB device that isn't yours, otherwise you're going to get involved in layers upon layers of mitigations, and often the more layers of mitigation layers you add can actually end up increasing your attack surface if you don't properly maintain them or fully understand them. You could have a kind of air-gapped system that is running a non-persistent OS like Tails, plug in USB keys into that to check them for basic things, but again, the risk/reward tradeoff seems quite heavily leaning towards risk. Evil maid could definitely do that, but that comes to your threat model. If evil maids are in your threat model, then you should never leave your computer (let alone your USB devices) unattended. Regardless of the USB devices, evil maid would probably just go in for your computer or power supply first. Most threat models that involve evil maid attacks would also mitigate those by having fully separated sets of hardware just for travel that are always treated as being potentially compromised. For the drive-by plugin, that's a very real threat to some orgs, which is why a lot of orgs with sensitive data will just shut off USB ports in the system BIOS, so that nothing can ever be plugged in anyways, or they use some more sneaker-net tactics and put tape or other coverings on exposed USB ports. You could have an OS level intervention, but again, a lot of attacks are closer to the metal than the OS, which is why it's such a mess :( Best strategy is still only use your own devices that you own. I don't even really accept USB devices from others. If they need to send me some files, I get them to use Dropbox or similar. QubesOS does have an interesting way of handling USB device management and protection locally, but getting into using Qubes can be quite tricky for normal people, so it might actually just create a larger attack surface if you use it incorrectly.

17 points by FounderSec 6y ago

Are there any good ways to protect yourself on mac, windows, linux, etc. from random USB keys? Perhaps have a raspberry pi off the network since linux in of itself would greatly diminish the attack surface? An "evil maid" can always swipe your own USB key and install malware so I'd prefer a belt and suspenders strategy. Likewise someone walking by your workstation could do a drive-by plugin too. I guess it would have to be some OS level intervention that would say "you plugged in an HID/file mount/etc., what do you want to do?"

T3OU-736 6y ago
A recent discussion covering this: https://news.ycombinator.com/item?id=20744590 https://news.ycombinator.com/item?id=20744590 There may well have been developments and chances, too. But, a start.
- FounderSec 6y ago
  Great discussion there. That USBguard tool seems interesting. I'll take a look, but the tricky thing with these USB Drop Attacks is the range of forms they can take and the levels of complexity. That USBguard mentions it blocks them from userspace, and without having looked at the code I imagine there's still negotiation that happens at the firmware level, which still leaves quite a lot of room for bad things to happen. For example you could make the perfect whitelist of your devices, but someone could still easily plug in the $60 USB Kill stick and it would fry your system. They could also take advantage of firmware level USB exploits such as a DFU (device firmware update) attack to inject malicious malware at the firmware level of your system. Off top of my head, I would guess USBguard wouldn't be able to stop that lower level of exploitation, so that's why I stick with not plugging anything in that isn't mine and in more sensitive IT departments, they can disable USB ports completely from BIOS.
FounderSec 6y ago
I mentioned in the other reply to T3OU-736 that the real issue is how wide the spectrum of attacks are. There are things that are on the userspace level (assuming you'll run a file with malware hidden in it), to the hardware level (device emulation to pretend like it's a keyboard or ethernet adapter) and even down to the firmware/USB specification level (device firmware upgrade attacks or the USB Kill stick). That's why generally the best advice is to never trust a USB device that isn't yours, otherwise you're going to get involved in layers upon layers of mitigations, and often the more layers of mitigation layers you add can actually end up increasing your attack surface if you don't properly maintain them or fully understand them. You could have a kind of air-gapped system that is running a non-persistent OS like Tails, plug in USB keys into that to check them for basic things, but again, the risk/reward tradeoff seems quite heavily leaning towards risk. Evil maid could definitely do that, but that comes to your threat model. If evil maids are in your threat model, then you should never leave your computer (let alone your USB devices) unattended. Regardless of the USB devices, evil maid would probably just go in for your computer or power supply first. Most threat models that involve evil maid attacks would also mitigate those by having fully separated sets of hardware just for travel that are always treated as being potentially compromised. For the drive-by plugin, that's a very real threat to some orgs, which is why a lot of orgs with sensitive data will just shut off USB ports in the system BIOS, so that nothing can ever be plugged in anyways, or they use some more sneaker-net tactics and put tape or other coverings on exposed USB ports. You could have an OS level intervention, but again, a lot of attacks are closer to the metal than the OS, which is why it's such a mess :( Best strategy is still only use your own devices that you own. I don't even really accept USB devices from others. If they need to send me some files, I get them to use Dropbox or similar. QubesOS does have an interesting way of handling USB device management and protection locally, but getting into using Qubes can be quite tricky for normal people, so it might actually just create a larger attack surface if you use it incorrectly.