4 ms·

While not congress, so I can't say for sure, I have been around government and other enterprise systems. Some measures they had in place: - Disabled USB Ports

While not congress, so I can't say for sure, I have been around government and other enterprise systems. Some measures they had in place: - Disabled USB Ports (except whitelisted peripherals) - User accounts don't have permission to install anything at all - If you plug a deceive with a different mac address than expected into an ethernet port the port locks down until a sysadmin verifies it and manually unlocks it - Remote imaging of systems, including remote system verification - No wifi on actual network While its all a pain in the ass to deal with. Hopefully at least some of that is in place and reduces the likelihood of many of those issues.

dmurray 6y ago
> If you plug a deceive with a different mac address than expected into an ethernet port the port locks down until a sysadmin verifies it and manually unlocks it Reckon they'd immediately block this laptop's MAC address after it gets reported stolen? If not, that's reason enough to steal it - clone the MAC address and plug in your own device which is now whitelisted. Of course this isn't enough on its own and you likely need some compromised credentials too.
- Bedon292 6y ago
  Probably would remove it as soon as its reported yes. Even if they didn't you would still have to take the device back in the building to that same exact port to connect.
jjkaczor 6y ago
Probably (let's hope - but, if I have seen anything in the last 4-years, it has been a constant, non-stop erosion of competency in the US government) - and, most likely the insurgents just didn't plan anything "long-term" or tricky. Question though... Don't hardware-based keyloggers present as a "keyboard", and isn't that a generic device which would probably be whitelisted?
- pkrznaric 6y ago
  At my old job, even if you plugged a generic keyboard that you'd already been using with the computer into the wrong USB port it wouldn't work. I believe you can set this stuff all up to be looking for very specific pieces of hardware on specific USB ports.
- Bedon292 6y ago
  Definitely possible, nothing is perfect. Just Lots of things that make it harder, but not impossible, to do bad stuff. Some places still use PS/2 devices for those peripherals as well, though that's much less common these days. Was curious, looks like there are a lot of pass through USB keyloggers that probably show up like the original whitelisted device. So definitely a risk there. I know I would want every single device there manually looked over, but I don't know how long that would take with a likely pretty limited staff.
  - nine_k 6y ago
    I'm afraid that simply discarding all these devices and replacing them with new devices instead of inspection will be not just safer, but also cheaper.

dmurray 6y ago

> If you plug a deceive with a different mac address than expected into an ethernet port the port locks down until a sysadmin verifies it and manually unlocks it Reckon they'd immediately block this laptop's MAC address after it gets reported stolen? If not, that's reason enough to steal it - clone the MAC address and plug in your own device which is now whitelisted. Of course this isn't enough on its own and you likely need some compromised credentials too.

Bedon292 6y ago
Probably would remove it as soon as its reported yes. Even if they didn't you would still have to take the device back in the building to that same exact port to connect.

jjkaczor 6y ago

Probably (let's hope - but, if I have seen anything in the last 4-years, it has been a constant, non-stop erosion of competency in the US government) - and, most likely the insurgents just didn't plan anything "long-term" or tricky. Question though... Don't hardware-based keyloggers present as a "keyboard", and isn't that a generic device which would probably be whitelisted?

pkrznaric 6y ago
At my old job, even if you plugged a generic keyboard that you'd already been using with the computer into the wrong USB port it wouldn't work. I believe you can set this stuff all up to be looking for very specific pieces of hardware on specific USB ports.
Bedon292 6y ago
Definitely possible, nothing is perfect. Just Lots of things that make it harder, but not impossible, to do bad stuff. Some places still use PS/2 devices for those peripherals as well, though that's much less common these days. Was curious, looks like there are a lot of pass through USB keyloggers that probably show up like the original whitelisted device. So definitely a risk there. I know I would want every single device there manually looked over, but I don't know how long that would take with a likely pretty limited staff.
- nine_k 6y ago
  I'm afraid that simply discarding all these devices and replacing them with new devices instead of inspection will be not just safer, but also cheaper.