6 ms·

Yet Another "People Plug in Strange USB Sticks" Story

110 points by diogenescynic 15y ago

extension 15y ago
My laptop has a built-in keyboard and trackpad, so why doesn't it just ask my permission to use any USB device I plug in? I don't know if there's a way to uniquely fingerprint a USB device, but if there is then I could tell the OS to always trust particular devices to make it more convenient.
- younata 15y ago
  Each USB device has it's own unique ID, so yeah, it should be possible.
  - jbri 15y ago
    When you're dealing with a malicious attacker, you can't assume that they're playing by the rules. All an attacker would have to do is find the ID of a device that you have used in the past.
    - extension 15y ago
      If an attacker can get the USB ID of a device physically attached to your computer then he probably already has access to your computer.
- eridius 15y ago
  Why would it ask? If you didn't want the computer to access the drive, then why did you plug it in? The mere act of plugging in a drive is a signal to the computer that you want the drive to be made available. Note, however, that this is NOT a signal that you want the computer to start running arbitrary software on the drive.
  - jbri 15y ago
    And what if you've plugged in a USB keyboard at the same time as that drive? And that USB keyboard has said "hey yes I want to run the software on this drive"?
    - eridius 15y ago
      And how does the USB Keyboard have the permission to go ahead and launch software on the user's behalf? It's precisely the same issue as autorun on a thumb drive.
  - burgerbrain 15y ago
    This is assuming the hardware is as presents itself.
  - ordinary 15y ago
    There are plenty of times in which what the computer is told to do (and consequently does, as is their wont) is not the same as what the user might WANT it to do. Compare the computer: "The user runs this program, the program tells me to wipe the hard drive, I wipe the hard drive", and the user: "I just downloaded Medal of Honor and I want to play it". Another example: the computer: "The user entered 'rm -rf doc', I delete ./doc/", and the user: "I want to get rid of 'Documents/' for the 23rd time today and execute 'rm -rf doc<tab>'". The discrepancy between "do what I say" and "do what I mean" is part of where security lives. In the above cases, that would be a virus scanner and your favourite *nix command line trash utility, respectively. Other examples can easily be imagined. Just because a user tells you to do something doesn't mean they want you to do it.
derleth 15y ago
From the article: > Quit blaming the victim. Where do we draw the line between blaming the victim and chiding people for doing stupid things? For example, a drunk driver is not a 'victim' in any sense, even if the only one injured in the wreck is the driver. OTOH, we have all those little topics that make people go insane. Can we even debate this concept without turning this into a flamewar?
- Groxx 15y ago
  You have a valid point, but the problem is also that you cannot safely check the contents of a USB stick on e.g. Windows by default. That is the system's fault, not the user's. That they plugged it into a corporate network prior to checking elsewhere first is, yes, stupid. And people need to be taught better about things like that - Stuxnet wouldn't have been half the threat if people didn't plug things into business computers without taking precautions. That they plugged it into a computer is not.
- sliverstorm 15y ago
  A drunk driver has not been the target of an attack. Whether or not we blame the victim in this case we can debate, but as the target of an attack I believe it is safe to refer to them as the victim.
- tptacek 15y ago
  I think you missed the whole point of the blog post, which is that it isn't "stupid" to plug in a USB stick; it's "stupid" that the OS makes this unsafe.
  - palish 15y ago
    Is this unsafe even on OS X or Linux?
    - cmelbye 15y ago
      I believe the main issue is that the stick can be configured so that Windows will automatically run an executable on the USB stick when it's plugged in, so OS X and Linux wouldn't be affected by that.
jberryman 15y ago
Schneier seems to be mostly imagining an attack in which a USB disk is loaded with some malware, but the USB stick could be just about anything: http://hackaday.com/2010/10/29/tiny-usb-business-card/ http://hackaday.com/2010/10/29/tiny-usb-business-card/
- pavel_lishin 15y ago
  If you work for a place where security matters, your default assumption should be, "it's unsafe".
  - RyanKearney 15y ago
    If you work at a place where security matters, then mounting external volumes is disabled in the group policy along with auto run, installing software, and 99% of Windows tasks that aren't directly related to your job.
- InclinedPlane 15y ago
  As he said, he blames the people who designed a system where plugging in a usb stick is unsafe, since the logical thing to do with media is to see what's on it. But for now that problem exists and people should be exceptionally cautious about such things.
- khafra 15y ago
  It could be even worse things: http://pentest.snosoft.com/2011/06/24/netragards-hacker-interface-device-hid/ http://pentest.snosoft.com/2011/06/24/netragards-hacker-inte...
Sandman 15y ago
So the point of this article is that it's not stupid to plug in random USB sticks you find on the street? That's what USB sticks are for? What if you found a big slice of your favorite type of cake on a park bench, would you eat it? You wouldn't? Why not, hell, that's what cakes are for. Picking up random USB sticks and sticking them into your computer is the equivalent of having sex with random people you meet on the street. The only thing you can hope for if you do that is that whatever you're having as protection is going to save you from catching something nasty. But by the time you find out if your protection actually protected you or not, it might already be too late. I agree that it would be great if our systems could save us from anything and everything malware writers can come up with. But unfortunately, they can't, so our first line of defense should just be plain old common sense.
- jrockway 15y ago
  Humans have a lot of machinery dedicated to determining whether or not to eat a given piece of food. Bad food has been around as long as humans, so those without any equipment for detecting tainted food have long since died off. Hence, most people would not eat that cake on the park bench, because they have a lot of senses (physical and emotional) that tell them not to. USB drives, on the other hand, have not been around for very long. When you plug in an evil USB stick, nothing bad happens. Maybe in a few years someone buys some shit with your credit card, and your bank has to send you a new one. That's about it, though, and that negative consequence isn't enough to override the curiosity intrinsic in humanity. So people find USB drives and plug them in, just because they are curious for a glimpse into other peoples' lives. See also: tabloids.
  - BasDirks 15y ago
    "(physical and emotional)" It's rationality that stops one from not eating the cake. One's physical and emotional "sense" wil tell one to eat the damn thing (if it looks good!). Similarly, unknown USB sticks should be used rationally.
- mikeash 15y ago
  I believe the point of this article is that if your system assumes that humans aren't stupid, then your system will fail. Blaming the humans for being stupid is no more useful than blaming rain for being wet. Shaking your head and saying that the system is fine because it was only defeated by people being stupid ends up missing the point.
johngalt 15y ago
You can't blame people for shooting other people, that's what guns are for! Shooting people are guns intended purpose. It's the clothing manufactures fault for not making all shirts out of Kevlar. They should make it safer to be shot.
- kbutler 15y ago
  Feeding the troll... Guns have uses besides shooting people. USB sticks have no use besides being plugged into a USB port, and USB ports have no use besides having things plugged in to them, hence it should be safe to plug things into them.
  - jbri 15y ago
    Incidentally, I could make a very effective denial-of-service attack by putting a high-voltage battery inside what appears to be a USB stick. And no software is going to protect you from the results of massively overvolting sensitive electronics.
  - johngalt 15y ago
    We are surrounded by devices that will break or do us harm if used unsafely. Articles like this one seem to point out the obvious "why not just make it impossible to be unsafe?" Yet this is not the case (or even a stated goal) in any other type of system. Why is it that once computers are involved people expect to abdicate responsibility? Since you didn't like my analogy there are plenty of others. Would you put any random tire on your car and expect it to transport you safely? If I put diesel instead of gas in my car is it the station's fault because the connectors are the same?
groby_b 15y ago
While USB sticks are made to be plugged in, the fact remains that a machine cannot be kept secure when an attacker gains physical access to it. (Remember that old and outlandish notion of an "air gap" for secure machines?) If you can plug untrusted hardware into your machine, your machine cannot be trusted. It's not just autorun that's an issue - you've exposed your machine to unknown forces once you plugged in an item. Corollary: If you need to be secure, don't provide IO ports.
- pavel_lishin 15y ago
  Or keyboards! Or monitors! Or hard-disks! Or processors!
  - groby_b 15y ago
    I realize you're being facetious, but for arguments sake: * Keyboards do not have enough bandwidth to allow an attack unless your physical security is incredibly lax. * Monitors make a really bad attack vector, since they're not really an input device :) They are, to some extent, a possible route of filtering data out, so make sure access is indeed limited. (I.e. don't put them in front of windows :) * HDDs are presumably (if you really care about security) inside the case only, and the case is locked. Also, hopefully hard-erased before installation. * Even though processors make for a decent attack vector (read "Trusting Trust" by Ken Thompson, if you haven't yet), enforcing the air gap makes it very hard to actually communicate that data to the outside world. Of course, all this depends on what level of security you want/need. Sealing of IO ports for your home machine is fairly silly. (And if autorun is disabled, you're probably safe plugging items in - you're most likely not a high enough value target). But if you indeed do have items that MUST be kept secret on your machine, batten down the (IO) hatches.
    - zachrose 15y ago
      > Keyboards do not have enough bandwidth to allow an attack unless your physical security is incredibly lax. What does this mean? What's to stop someone from building a fake keyboard with an internal USB hub that connects the original keyboards USB connection and a thumbdrive to a normal-looking outgoing USB cable?
s00pcan 15y ago
If I found a random USB drive on the ground I would probably format it with a device that any malicious software isn't targeting, such as a game console.
dhughes 15y ago
I couldn't help thinking of Family Guy skit about James Woods going "Ooo a piece of candy!"
planb 15y ago
While I think he's right that the OS should not automatically launch programs of an USB stick - how many people that are curious enough to plug in the stick would not double click "secret_documents.doc.exe"?

110 points by diogenescynic 15y ago

My laptop has a built-in keyboard and trackpad, so why doesn't it just ask my permission to use any USB device I plug in? I don't know if there's a way to uniquely fingerprint a USB device, but if there is then I could tell the OS to always trust particular devices to make it more convenient.

younata 15y ago
Each USB device has it's own unique ID, so yeah, it should be possible.
- jbri 15y ago
  When you're dealing with a malicious attacker, you can't assume that they're playing by the rules. All an attacker would have to do is find the ID of a device that you have used in the past.
  - extension 15y ago
    If an attacker can get the USB ID of a device physically attached to your computer then he probably already has access to your computer.
eridius 15y ago
Why would it ask? If you didn't want the computer to access the drive, then why did you plug it in? The mere act of plugging in a drive is a signal to the computer that you want the drive to be made available. Note, however, that this is NOT a signal that you want the computer to start running arbitrary software on the drive.
- jbri 15y ago
  And what if you've plugged in a USB keyboard at the same time as that drive? And that USB keyboard has said "hey yes I want to run the software on this drive"?
  - eridius 15y ago
    And how does the USB Keyboard have the permission to go ahead and launch software on the user's behalf? It's precisely the same issue as autorun on a thumb drive.
- burgerbrain 15y ago
  This is assuming the hardware is as presents itself.
- ordinary 15y ago
  There are plenty of times in which what the computer is told to do (and consequently does, as is their wont) is not the same as what the user might WANT it to do. Compare the computer: "The user runs this program, the program tells me to wipe the hard drive, I wipe the hard drive", and the user: "I just downloaded Medal of Honor and I want to play it". Another example: the computer: "The user entered 'rm -rf doc', I delete ./doc/", and the user: "I want to get rid of 'Documents/' for the 23rd time today and execute 'rm -rf doc<tab>'". The discrepancy between "do what I say" and "do what I mean" is part of where security lives. In the above cases, that would be a virus scanner and your favourite *nix command line trash utility, respectively. Other examples can easily be imagined. Just because a user tells you to do something doesn't mean they want you to do it.

derleth 15y ago

From the article: > Quit blaming the victim. Where do we draw the line between blaming the victim and chiding people for doing stupid things? For example, a drunk driver is not a 'victim' in any sense, even if the only one injured in the wreck is the driver. OTOH, we have all those little topics that make people go insane. Can we even debate this concept without turning this into a flamewar?

Groxx 15y ago
You have a valid point, but the problem is also that you cannot safely check the contents of a USB stick on e.g. Windows by default. That is the system's fault, not the user's. That they plugged it into a corporate network prior to checking elsewhere first is, yes, stupid. And people need to be taught better about things like that - Stuxnet wouldn't have been half the threat if people didn't plug things into business computers without taking precautions. That they plugged it into a computer is not.
sliverstorm 15y ago
A drunk driver has not been the target of an attack. Whether or not we blame the victim in this case we can debate, but as the target of an attack I believe it is safe to refer to them as the victim.
tptacek 15y ago
I think you missed the whole point of the blog post, which is that it isn't "stupid" to plug in a USB stick; it's "stupid" that the OS makes this unsafe.
- palish 15y ago
  Is this unsafe even on OS X or Linux?
  - cmelbye 15y ago
    I believe the main issue is that the stick can be configured so that Windows will automatically run an executable on the USB stick when it's plugged in, so OS X and Linux wouldn't be affected by that.

jberryman 15y ago

Schneier seems to be mostly imagining an attack in which a USB disk is loaded with some malware, but the USB stick could be just about anything: http://hackaday.com/2010/10/29/tiny-usb-business-card/ http://hackaday.com/2010/10/29/tiny-usb-business-card/

pavel_lishin 15y ago
If you work for a place where security matters, your default assumption should be, "it's unsafe".
- RyanKearney 15y ago
  If you work at a place where security matters, then mounting external volumes is disabled in the group policy along with auto run, installing software, and 99% of Windows tasks that aren't directly related to your job.
InclinedPlane 15y ago
As he said, he blames the people who designed a system where plugging in a usb stick is unsafe, since the logical thing to do with media is to see what's on it. But for now that problem exists and people should be exceptionally cautious about such things.
khafra 15y ago
It could be even worse things: http://pentest.snosoft.com/2011/06/24/netragards-hacker-interface-device-hid/ http://pentest.snosoft.com/2011/06/24/netragards-hacker-inte...

Sandman 15y ago

So the point of this article is that it's not stupid to plug in random USB sticks you find on the street? That's what USB sticks are for? What if you found a big slice of your favorite type of cake on a park bench, would you eat it? You wouldn't? Why not, hell, that's what cakes are for. Picking up random USB sticks and sticking them into your computer is the equivalent of having sex with random people you meet on the street. The only thing you can hope for if you do that is that whatever you're having as protection is going to save you from catching something nasty. But by the time you find out if your protection actually protected you or not, it might already be too late. I agree that it would be great if our systems could save us from anything and everything malware writers can come up with. But unfortunately, they can't, so our first line of defense should just be plain old common sense.

jrockway 15y ago
Humans have a lot of machinery dedicated to determining whether or not to eat a given piece of food. Bad food has been around as long as humans, so those without any equipment for detecting tainted food have long since died off. Hence, most people would not eat that cake on the park bench, because they have a lot of senses (physical and emotional) that tell them not to. USB drives, on the other hand, have not been around for very long. When you plug in an evil USB stick, nothing bad happens. Maybe in a few years someone buys some shit with your credit card, and your bank has to send you a new one. That's about it, though, and that negative consequence isn't enough to override the curiosity intrinsic in humanity. So people find USB drives and plug them in, just because they are curious for a glimpse into other peoples' lives. See also: tabloids.
- BasDirks 15y ago
  "(physical and emotional)" It's rationality that stops one from not eating the cake. One's physical and emotional "sense" wil tell one to eat the damn thing (if it looks good!). Similarly, unknown USB sticks should be used rationally.
mikeash 15y ago
I believe the point of this article is that if your system assumes that humans aren't stupid, then your system will fail. Blaming the humans for being stupid is no more useful than blaming rain for being wet. Shaking your head and saying that the system is fine because it was only defeated by people being stupid ends up missing the point.

johngalt 15y ago

You can't blame people for shooting other people, that's what guns are for! Shooting people are guns intended purpose. It's the clothing manufactures fault for not making all shirts out of Kevlar. They should make it safer to be shot.

kbutler 15y ago
Feeding the troll... Guns have uses besides shooting people. USB sticks have no use besides being plugged into a USB port, and USB ports have no use besides having things plugged in to them, hence it should be safe to plug things into them.
- jbri 15y ago
  Incidentally, I could make a very effective denial-of-service attack by putting a high-voltage battery inside what appears to be a USB stick. And no software is going to protect you from the results of massively overvolting sensitive electronics.
- johngalt 15y ago
  We are surrounded by devices that will break or do us harm if used unsafely. Articles like this one seem to point out the obvious "why not just make it impossible to be unsafe?" Yet this is not the case (or even a stated goal) in any other type of system. Why is it that once computers are involved people expect to abdicate responsibility? Since you didn't like my analogy there are plenty of others. Would you put any random tire on your car and expect it to transport you safely? If I put diesel instead of gas in my car is it the station's fault because the connectors are the same?

groby_b 15y ago

While USB sticks are made to be plugged in, the fact remains that a machine cannot be kept secure when an attacker gains physical access to it. (Remember that old and outlandish notion of an "air gap" for secure machines?) If you can plug untrusted hardware into your machine, your machine cannot be trusted. It's not just autorun that's an issue - you've exposed your machine to unknown forces once you plugged in an item. Corollary: If you need to be secure, don't provide IO ports.

pavel_lishin 15y ago
Or keyboards! Or monitors! Or hard-disks! Or processors!
- groby_b 15y ago
  I realize you're being facetious, but for arguments sake: * Keyboards do not have enough bandwidth to allow an attack unless your physical security is incredibly lax. * Monitors make a really bad attack vector, since they're not really an input device :) They are, to some extent, a possible route of filtering data out, so make sure access is indeed limited. (I.e. don't put them in front of windows :) * HDDs are presumably (if you really care about security) inside the case only, and the case is locked. Also, hopefully hard-erased before installation. * Even though processors make for a decent attack vector (read "Trusting Trust" by Ken Thompson, if you haven't yet), enforcing the air gap makes it very hard to actually communicate that data to the outside world. Of course, all this depends on what level of security you want/need. Sealing of IO ports for your home machine is fairly silly. (And if autorun is disabled, you're probably safe plugging items in - you're most likely not a high enough value target). But if you indeed do have items that MUST be kept secret on your machine, batten down the (IO) hatches.
  - zachrose 15y ago
    > Keyboards do not have enough bandwidth to allow an attack unless your physical security is incredibly lax. What does this mean? What's to stop someone from building a fake keyboard with an internal USB hub that connects the original keyboards USB connection and a thumbdrive to a normal-looking outgoing USB cable?

s00pcan 15y ago

If I found a random USB drive on the ground I would probably format it with a device that any malicious software isn't targeting, such as a game console.

dhughes 15y ago

I couldn't help thinking of Family Guy skit about James Woods going "Ooo a piece of candy!"

planb 15y ago

While I think he's right that the OS should not automatically launch programs of an USB stick - how many people that are curious enough to plug in the stick would not double click "secret_documents.doc.exe"?