5 ms·
Quote: "You plug the USB drive into your PC and it immediately tells you that you have a virus, and you need to call “Microsoft Support.”" Well, that's a badly
by unnouinceput 4y ago
Quote: "You plug the USB drive into your PC and it immediately tells you that you have a virus, and you need to call “Microsoft Support.”"
Well, that's a badly configured PC then. Stop having AutoPlay enabled and this won't happen. Then next step is to format that USB drive and voila!, free thumb drive.
- banana_giraffe 4y agoI am curious what's on that USB stick. Is it a flash drive/HID thing like a rubber ducky that types something in to run a payload? Or, just bad phrasing on the article?
- iforgotpassword 4y agoAutorun.inf plus some html file or simple app displaying a msgbox.
- banana_giraffe 4y agoI thought Autorun was no longer a thing since Vista or so.
- pyuser583 4y agoI thought plugging a thumb drive in can deliver malware without opening files. Something about full memory access before block level … or is that PCIe?
- josephg 4y agoUSB doesn't have implicit DMA (Direct Memory Access), so it can't install malware on your computer without getting past your operating system. (Though just enabling autoplay will do the trick - and I have no idea whether thats turned on by default these days.) Firewire used to have DMA access via how the port was physically wired, but afaik it was fixed before being phased out. Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there. As others have mentioned, USB devices can also do physical damage to your computer if they want to, by charging a capacitor over a few seconds then discharging it all at once. Its generally a bad idea to plug mystery USB devices into your computer.
- blep_ 4y ago> Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there. There is support for having the user authorize the device before logically connecting it to the rest of the system; see e.g. https://wiki.archlinux.org/title/Thunderbolt#User_device_authorization https://wiki.archlinux.org/title/Thunderbolt#User_device_aut... It would not surprise me if this does nothing, because firmware implements it poorly, and/or because users click OK on everything.
- vetinari 4y agoDevice authorization for PCIe tunnels is TB3+ feature, older versions are out of luck. The situation with firmware is not that bad, though. There are exactly two of them, Intel and Apple. Apple devices have the Apple implementation and the rest of the world Intels. On capable hardware, IOMMU is also used (for all security levels).
- Tepix 4y agoYou haven't heard of BadUSB? Don't plug in untrusted USB devices.
- Thorrez 4y agoOr USB Killer... Although there's generally no financial incentive for an attacker to mail you a USB Killer.
- GekkePrutser 4y agoLike with most DoS style attacks it's mainly vandalism. Though an online DoS could be used for market manipulation at the right time, it usually isn't.
- unnouinceput 4y agoYeah, I heard. Still the case of a badly configured device. Remember kids, it's a software driver configuration. Show me that BadUSB that works on the dumb DOS operating system. No? Yeah, didn't think so. Only "clever" OS'es are pwned by this, and if you dumb them down then nothing gets to run automatically.
- Tepix 4y agoAny DOS is susceptible to Bad USB emulating a keyboard if the BIOS supports USB keyboards.
- toast0 4y agoBadUSB or similar could be setup to work on DOS if the system firmware does USB keyboard mapping. You can do copy con foo.exe or something with debug, and then stream the executable you want to run, then run it. A bit more work, and there's no standard networking and all that, but it's doable if you really want it done; but you'd need a target to make it worthwhile.
- unnouinceput 4y agoSooo... we go back to my initial point of a "badly configured system"?
- netsharc 4y agoHonestly, if the victim thinks it's legitimate and they've plugged it in, autoplay being disabled is no big deal to the attacker, chances are, they're going to double-click the setup.exe/install.exe anyway...
- paranoidrobot 4y agoI think you missed the point of the scam. If someone thinks they just got a free copy of Office, and is willing to plug the USB drive in, then they're also willing to run the 'Setup.exe' on it, too.