9 ms·
The threat on your desk: Building an evil USB-C dock
- seanherron 4y agoThe author is right that USB-C docks can be used to hide malicious devices - but the same is true of any USB device. You could hide a Pi Zero in a mouse, keyboard, memory stick, or anything else that you can open up and access the USB headers. Scary - but also requires a higher level of physical access than other vectors such as phishing.
- snow_mac 4y agoOr they could pre-make a bunch of docks and swap them out at a cowering space or target office building. Easy enough to gain physical access to most offices. You could get a job with the cleaning crew
- micromacrofoot 4y agoI imagine this is how a lot of basic espionage already happens?
- tedivm 4y agoThey could order a bunch from amazon or newegg and then return them. It wouldn't be as targeted but it would still get some interesting results.
- LanceH 4y agoSlap the companies logo on it and mail 100 of them to the office.
- npteljes 4y agoThey also bundle a separate CPU inside the real CPU, and gave it full access over the system. https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...
- metadat 4y agoDo ARM processors have a similar mechanism? Edit: Yes, it's called TrustZone. https://en.wikipedia.org/wiki/ARM_architecture_family#Security_extensions https://en.wikipedia.org/wiki/ARM_architecture_family#Securi...
- dmitrygr 4y agonot the same at all. Trustzone is a special mode of the very same main CPU (more like intel's SMM), whereas PSP and ME are a separate core
- elromulous 4y agoMore specifically, trustzone is the arm equivalent of Intel's (mostly deprecated) sgx. https://en.m.wikipedia.org/wiki/Software_Guard_Extensions https://en.m.wikipedia.org/wiki/Software_Guard_Extensions
- qbasic_forever 4y agoARM doesn't have a concept of anything like the management engine, but remember it's just an ISA and actual SoC implementations like from Qualcomm, Samsung, Apple, Amazon, etc. are free to add their own logic and side controllers.
- ace2358 4y agoWhich I feel like Apple does do? When I turn my iPhone off, it says it’ll still be able to be found using find my phone…
- concinds 4y agoThat's different. It's a feature where Apple deliberately keeps some components running after shutdown, in a very low-power way, and provides an option to turn that off. Those components (the Bluetooth chip, for example) are all strictly separated from each other by IOMMUs. Intel Management Engine is very different. It's basically another CPU within your real CPU, running its own software with no visibility to the main OS, and it has (AFAIK) full access to other components. If it's compromised, or has a factory backdoor, you're 0wned. The closest thing to Intel IME that the iPhone has, is the baseband, which can run its own code. But if I'm reading marcan correctly (https://news.ycombinator.com/item?id=30393283 https://news.ycombinator.com/item?id=30393283), modern iPhones/Android phones all use IOMMUs to isolate that (with the exception of a few so-called "free/libre" phones). The IOMMUs can be easily inspected from the OS to make sure they're correct, so it's just not a concern, unlike IME.
- bobsmooth 4y agoDo co-working spaces usually have shared peripherals besides docks?
- dotancohen 4y agoI've seen monitors, keyboards, mice, network printers, wifi access.
- Cthulhu_ 4y agoEven a simple charging cable can contain e.g. a HID chip while still working as a charging cable. I saw an unattended cable on a table at work once, I'm sure someone who needs one would've used it without second thought. But our employer is also sending fake phishing emails to make people aware, I wouldn't be surprised if they also plant devices like that. ...and if they don't I should propose it, sounds like a fun project. Leave a random cable or USB stick that just shows a warning that it could have been malicious. Or something that just opens up https://nyan.cat https://nyan.cat and sets the volume to max :D.
- panarky 4y agoLet's say I buy a USB-C dock made by Sabrent or Anker. Are there good reasons to believe they're safe, that the brands are trustworthy? Are there good reasons to believe that the brand name that's printed on the case means it's actually made by that company? How could anyone determine if it contains a keylogger, or an HDMI screen grabber, or a network sniffer, or a reverse shell, or a rootkit installer?
- npteljes 4y agoI don't think you can determine much, without looking into the actual device somehow, and being also knowledgeable to make sense of what you see. Even with trusted brands, a malicious actor can attack the vendor. For example, one could order devices, tamper with them, and then send them back via returns. The vendor likely tests it a bit, and then repackages it and sells it as refurbished, or maybe even as a new one. The fun thing is that the same is true with software. Looking at a source code is hard enough, even for experienced programmers, and then how do you verify a piece of software that you don't even have the source code to? And if you have the code, how do you verify that the software is made out of that code? People basically just operate on trust, you can't verify much of the stuff. Just try to stick to entities with reputation, and hope for the best.
- xen2xen1 4y agoGo pick a random one from the store?
- zabzonk 4y agowell, on this basis, you can't trust your actual pc, laptop or phone either, never mind a hub. if you don't want to spend your entire life living in a faraday cage, there must be some level of trust.
- PenguinCoder 4y agoRichard Stallman was right.
- leetrout 4y agoI thought it was odd that Google distributed security keys as swag at All Thing Open. I tossed mine in the trash. Odds that is was legit? 99.99%? But just seemed like a major oversight to just toss out usb devices en masse
- triactual 4y agoMaybe I’m missing something but these USB attacks require interaction with kernel drivers so if you plug in a dock that then presents mysterious storage or HID functions, you’re going to know.
- j5155 4y agoDoes anything on your PC notify you about plugging in a keyboard? I know mine doesn’t, and it definitely doesn’t prompt me about whether to use it either. You could check what devices you have connected but I doubt many people would do that every single time they come to work.
- triactual 4y agoYeah, this is more of a UI problem that could be solved with a little effort. I would be concerned about a device that replaced the hub itself rather than simply adding a function. The core issue is that a system can always notify the user of newly connected devices (Windows seems to about half the time). But a malicious MCU emulating a hub and compromising or stealing data at the USB protocol level could appear exactly as expected. It could key log, inject, etc., undetected because it doesn’t have to interact with kernel drivers as anything other than the expected hub.
- pabs3 4y agoOn Linux, GNOME has some USB protections when USBGuard is installed.
- kalleboo 4y agoMacs warn you and require approval for any new USB device, including a keyboard, starting with macOS Venture.
- cristiioan 4y agoIsn't that only when using lockdown mode?
- 4y ago
- userbinator 4y agoRealistically, you would have to open the device to determine whether or not it has been tampered with. ...or you could use something invented a century ago, called an X-ray machine.
- bobsmooth 4y agoLemme pull out my pocket x-ray machine an examine every dock I plug my computer into. We all have one, right?
- throwaway742 4y agoI bought a pair of x-ray spectacles from a comic book for $1.50. I use them to inspect all my computer accessories.
- userbinator 4y agoI was referring to companies who do this to hardware that crosses their trust boundaries, and I can safely say that those who care enough about this stuff will definitely do that.
- cristiioan 4y agoBetter is to have all your devices in a trusted place(or multiple) or with you all the time(in a backpack).
- stacktrust 4y agoUse the simplest USB dock with the least amount of ports for your specific use case. Simpler docks have less physical room and lower baseline power to hide malicious mods. e.g. this StarTech dock costs 50% less than one with ethernet. It can be used with a USB-ethernet adapter, which allows both the dock and ethernet adapter to be evaluated separately, https://www.amazon.com/gp/product/B09DGRJMYK/ https://www.amazon.com/gp/product/B09DGRJMYK/ We need crowdsourced behavioral fingerprints and open-source test suites for peripherals which may be subject to supply chain or shipment interdiction. Measure power consumption and response latency baselines, when idle and with reference workloads. Fingerprint units of the same model procured via multiple supply chains: brick & mortar, online, different couriers, new/used. More generally, there is ongoing work for integrity verification of devices, including PCIe device authentication [1][2], USB device authentication [3] and SPDM for remote attestation between DICE-RoT and system firmware, before allowing a device to communicate with the system. [1] PCIe component auth, https://pcisig.com/pcie®-component-authentication https://pcisig.com/pcie®-component-authentication [2] Intel PCI Express Device Security, https://www.intel.com/content/dam/www/public/us/en/documents/reference-guides/pcie-device-security-enhancements.pdf https://www.intel.com/content/dam/www/public/us/en/documents... [3] https://www.zdnet.com/article/usb-type-c-gets-authentication-to-protect-against-malicious-devices/ https://www.zdnet.com/article/usb-type-c-gets-authentication... USB data blocker with transparent case for physical inspection: https://portablepowersupplies.co.uk/product/pure-usb-data-blocker https://portablepowersupplies.co.uk/product/pure-usb-data-bl.... Do we need transparent docks?
- Cthulhu_ 4y agoUse your own dock, not someone else's if at all possible. I don't think transparent docks would work because a serious enough actor can make it look and work like the real thing.
- rkagerer 4y agoFloppy disks were just that - they couldn't be keyboards and dataloggers with transmitters, masquerading as disks.
- amelius 4y agoAnd no autorun.exe
- cristiioan 4y agoThis is why I keep all the hardware I use at home or in my backpack. If I have to go to the bathroom, I will take my backpack with me when I'm not at home.
- stonegray 4y agoWith all that space inside it would be interesting to try adding a mmwave presence detector. It could be extremely hard to detect if it only connects to the machine when nobody's nearby.
- izacus 4y agoHas anyone ever been convicted and sent to jail (or at least fined) for creating a device that attacks other devices?
- deleted 4y ago[deleted]
- donatj 4y agoI bought one of these cheap no name USB-C cables that shows the current charging PD wattage on a tiny built in LCD. I have been using it for months to charge my Android phone and MacBook. I recently bought a little used Yoga Thinkpad, I’m not really a Windows guy. On plugging just the cable into a USB port with nothing on the other end Windows made its little “device plugged in” ba-da-doop sound that Windows makes. I didn’t see anything interesting in my quick scan of device manager but that single ba-da-doop stopped me from using my favorite cable cold turkey. I should investigate it further.
- tenebrisalietum 4y agoI bet it added a serial port (under Ports) that software can use to read the wattage.
- csdvrx 4y agoThat'd be wonderful and practical! Op, do you have a reference for your USB-C cable?
- bartvk 4y agoI use iStat Menus on macOS, and configure it such that it displays the MacBook power draw. It only works on Intel-based laptops; on the new ARM-based M1 MacBooks, that sensor no longer available. Probably a security thing (rowhammer?). Such a cable would be very useful but your comment makes me think twice...
- divingdragon 4y agoOn Linux you can use `lsusb` to get a cleaner list of all connected USB devices.