4 ms·

"I plugged my flash drive into the printer station and all I got was my financial documents uploaded to a Russian server and 4 viruses written to the boot secto

"I plugged my flash drive into the printer station and all I got was my financial documents uploaded to a Russian server and 4 viruses written to the boot sector." -- my paranoid assumptions about public print stations with USB ports.

chii 5y ago
it'd be interesting to see if this flash drive transport for documents evolves into an email address you send via your phone instead (so no hardware on your end needed).
- singron 5y ago
  You can also print documents at staples that you email to an address. They reply with a 24 hour code that you can type into the printer. I'd love a service that would mail you the documents back in an envelope and was still as cheap ($0.15/page).
  - fxtentacle 5y ago
    We use clicksend.
- deleted 5y ago
  [deleted]
gruez 5y ago
1. obviously you don't put sensitive docs on that usb drive 2. autoruns haven't worked on USB drives since windows XP SP3. The risk of getting a virus in this case is minimal.
- eurleif 5y ago
  https://null-byte.wonderhowto.com/how-to/make-your-own-bad-usb-0165419/ https://null-byte.wonderhowto.com/how-to/make-your-own-bad-u...
  - gruez 5y ago
    I appreciate the correction, but the risk still seems minimal. 1. The attack is very situational. There are hundreds of usb flash drive controllers out there (see: https://www.usbdev.ru/files/ https://www.usbdev.ru/files/). The chance that your flash drive a) can be re-programmed b) the malware author bothered making a payload for c) copier is infected are all very small. 2. The attack is very visible, since the user would notice the computer randomly opening command prompts and typing commands. It's also very easy to interrupt. Stray mouse/keyboard inputs would foil the attack, as will unplugging the USB drive. 3. Despite how visible the attack is (see above), the lack of empirical reports probably suggests it's not a real attack that's being carried out
    - manwe150 5y ago
      That assume it presents as a HID, and not another device profile with more direct attack surface in the hardware or kernel. Windows isolates the USB drivers to thwart such attacks, but perhaps it could manage to attack memory directly through the PCI bus before the kernel’s involvement? I am not sure of the details, but agree that seems like a rather large amount of hacker effort, when they can currently attack over the internet and demand instant bitcoin payment.
      - gruez 5y ago
        > Windows isolates the USB drivers to thwart such attacks, but perhaps it could manage to attack memory directly through the PCI bus before the kernel’s involvement? AFAIK how these attacks essentially work is by imputing key sequences to execute malicious code (eg. typing curl ... | bash into the terminal). There's no driver or pcie/DMA attacks going on.
- dexterdog 5y ago
  He's talking about the Staples print kiosk being hacked so they can steal a copy of everything that is printed.
  - gruez 5y ago
    He is? Who needs to print "financial documents" in color? Also, the part about "4 viruses written to the boot sector" suggests the kiosk is also dropping malware onto the USB.
    - coldtea 5y ago
      >He is? Who needs to print "financial documents" in color? Nobody. Some still do out of ignorance. The same thing can happen when you print them in black and white from a similar kiosk. And the financial documents could be in the same usb next to documents you did want to print in color. >Also, the part about "4 viruses written to the boot sector" suggests the kiosk is also dropping malware onto the USB. He's trying to make a point, even if that wasn't the case in that particular instance, it's something that can very easily happen too. There's a lot of losing the forrest ("people sticking usbs to commercial kiosks to print is bad security") for some less significant detail trees in those questions...

chii 5y ago

it'd be interesting to see if this flash drive transport for documents evolves into an email address you send via your phone instead (so no hardware on your end needed).

singron 5y ago
You can also print documents at staples that you email to an address. They reply with a 24 hour code that you can type into the printer. I'd love a service that would mail you the documents back in an envelope and was still as cheap ($0.15/page).
- fxtentacle 5y ago
  We use clicksend.
deleted 5y ago
[deleted]

gruez 5y ago

1. obviously you don't put sensitive docs on that usb drive 2. autoruns haven't worked on USB drives since windows XP SP3. The risk of getting a virus in this case is minimal.

eurleif 5y ago
https://null-byte.wonderhowto.com/how-to/make-your-own-bad-usb-0165419/ https://null-byte.wonderhowto.com/how-to/make-your-own-bad-u...
- gruez 5y ago
  I appreciate the correction, but the risk still seems minimal. 1. The attack is very situational. There are hundreds of usb flash drive controllers out there (see: https://www.usbdev.ru/files/ https://www.usbdev.ru/files/). The chance that your flash drive a) can be re-programmed b) the malware author bothered making a payload for c) copier is infected are all very small. 2. The attack is very visible, since the user would notice the computer randomly opening command prompts and typing commands. It's also very easy to interrupt. Stray mouse/keyboard inputs would foil the attack, as will unplugging the USB drive. 3. Despite how visible the attack is (see above), the lack of empirical reports probably suggests it's not a real attack that's being carried out
  - manwe150 5y ago
    That assume it presents as a HID, and not another device profile with more direct attack surface in the hardware or kernel. Windows isolates the USB drivers to thwart such attacks, but perhaps it could manage to attack memory directly through the PCI bus before the kernel’s involvement? I am not sure of the details, but agree that seems like a rather large amount of hacker effort, when they can currently attack over the internet and demand instant bitcoin payment.
    - gruez 5y ago
      > Windows isolates the USB drivers to thwart such attacks, but perhaps it could manage to attack memory directly through the PCI bus before the kernel’s involvement? AFAIK how these attacks essentially work is by imputing key sequences to execute malicious code (eg. typing curl ... | bash into the terminal). There's no driver or pcie/DMA attacks going on.
dexterdog 5y ago
He's talking about the Staples print kiosk being hacked so they can steal a copy of everything that is printed.
- gruez 5y ago
  He is? Who needs to print "financial documents" in color? Also, the part about "4 viruses written to the boot sector" suggests the kiosk is also dropping malware onto the USB.
  - coldtea 5y ago
    >He is? Who needs to print "financial documents" in color? Nobody. Some still do out of ignorance. The same thing can happen when you print them in black and white from a similar kiosk. And the financial documents could be in the same usb next to documents you did want to print in color. >Also, the part about "4 viruses written to the boot sector" suggests the kiosk is also dropping malware onto the USB. He's trying to make a point, even if that wasn't the case in that particular instance, it's something that can very easily happen too. There's a lot of losing the forrest ("people sticking usbs to commercial kiosks to print is bad security") for some less significant detail trees in those questions...