13 ms·
From the article: > Quit blaming the victim. Where do we draw the line between blaming the victim and chiding people for doing stupid things? For example, a
by derleth 15y ago
From the article:
> Quit blaming the victim.
Where do we draw the line between blaming the victim and chiding people for doing stupid things?
For example, a drunk driver is not a 'victim' in any sense, even if the only one injured in the wreck is the driver.
OTOH, we have all those little topics that make people go insane.
Can we even debate this concept without turning this into a flamewar?
- Groxx 15y agoYou have a valid point, but the problem is also that you cannot safely check the contents of a USB stick on e.g. Windows by default. That is the system's fault, not the user's. That they plugged it into a corporate network prior to checking elsewhere first is, yes, stupid. And people need to be taught better about things like that - Stuxnet wouldn't have been half the threat if people didn't plug things into business computers without taking precautions. That they plugged it into a computer is not.
- sliverstorm 15y agoA drunk driver has not been the target of an attack. Whether or not we blame the victim in this case we can debate, but as the target of an attack I believe it is safe to refer to them as the victim.
- tptacek 15y agoI think you missed the whole point of the blog post, which is that it isn't "stupid" to plug in a USB stick; it's "stupid" that the OS makes this unsafe.
- palish 15y agoIs this unsafe even on OS X or Linux?
- cmelbye 15y agoI believe the main issue is that the stick can be configured so that Windows will automatically run an executable on the USB stick when it's plugged in, so OS X and Linux wouldn't be affected by that.
- palish 15y agoSorry, to be clear, I was asking whether Linux or OS X also have the same silly idea of "Let's execute an arbitrary program on the USB stick whenever it's plugged in!" I don't know the answer because I don't use Linux for day-to-day work (I work in gamedev, whose primary platform is Windows) and I'm too poor too afford a Macbook.
- technomancy 15y agoThis is only half the problem, and it is trivial to defeat. What we should really be worried about is malware that acts as a USB keyboard, since that's much harder to protect against. It's also much harder to reliably launch an attack from, but in the case of a targeted attack where the OS is known it wouldn't be too difficult to come up with something that could sneak some nasties in with a low chance of detection.
- starwed 15y agoHuh, never thought about that --- pretty neat.
- amalcon 15y agoProbably. The exact vulnerability used here (autorun) is closed up on Linux, but that only protects against the one attack. Do we think there are no vulnerabilities in the USB code, the drivers for any particular USB device, filesystems, or any other pieces of code a USB device can invoke? I am very doubtful.
- RomP 15y agoIt's not the OS. It's the hardware. While USB devices are somewhat more difficult to use for exploits like this, any FireWire or PCMCIA device has full access to the RAM through DMA channel (1) Worth repeating: they can read ANY page in RAM. Including those which contain user key hashes, session hashes and any password which happens to be stored in clear in memory. While OS can protect process' memory from all other processes, the DMA is one level closer to the metal. No matter what OS you're running, plugging random devices to your system means the game is over. (1) HW virtualization mitigates some of these risks: I'm not familiar with the details of it. But since most of the machines are running without the HW virtualization still, they are still vulnerable. edited for formatting
- tptacek 15y agoWe're not talking about Firewire, we're talking about USB. I don't even think we need to get into IOMMU mitigations for Firewire security. There are vectors beyond "autorun" for attacking machines with USB devices (for instance, automatically mounting filesystems exposes the filesystem to malicious block inputs) but these are squarely in the OS's bailiwick.
- thaumaturgy 15y agoTaken directly from Bruce's article: > The problem is that the OS trusts random USB sticks. The problem is that the OS will automatically run a program that can install malware from a USB stick. The problem is that it isn't safe to plug a USB stick into a computer. The entire point is that it shouldn't be considered "stupid" to plug in a USB drive. As he says more than once: that's what they're for.
- orborde 15y agoIn this particular case, you can think what you want of the people plugging in strange USB sticks, but no amount of calling them idiots will ever solve the problem.
- raldi 15y ago> Where do we draw the line? 50% is a start.