8 ms·
Explosives replace malware as the scariest thing a USB stick may hide
- JohnFen 4y agoNope. Malware is still a lot scarier.
- formerly_proven 4y ago> believe it didn't explode because the adapter the producer used didn't have enough juice to activate it Crappy cables save lives
- lostlogin 4y agoI laughed at this bit too. Is there anything that isn’t foiled by crappy USB hubs?
- jrootabega 4y agoInteresting and scary as described. But I hope the root cause failure here is understood to be in the mail screening process, not USB hygiene. Although accepting only sd cards would probably have eliminated this threat.
- gnicholas 4y agoWhat type of screening is required to reliably detect this sort of danger? Would all newsrooms have them, or do people loan/borrow them on an as-needed basis?
- Arrath 4y agoX-rays and/or explosives sniffer devices. I can't imagine many newsrooms at all employ either, except for the biggest operations.
- Doxin 4y agoSeems to me the easiest way to prevent a LOT of grief with USB-sticks is using a dedicated USB-ingest station. Have it run a virus scan as it copies things onto a known-good USB. That obviously wouldn't directly solve the exploding USB issue, but adding a power switch to the power rails should more or less solve that: There's only so much explosive you can fit in a USB stick so containment is very doable.
- jrootabega 4y agoIn keeping with my first comment, I would say that the best way to avoid grief with anything explosive is to not allow explosives to reach their destination via the mail in the first place. It's not the easiest, but once you're living in that world, it's really the only sensible choice. My comment meant to point out that talking about how you handle USB devices would be a digression and distraction from the main precautions of screening mail for explosives. As long as that's understood, I would also point out that the physical act of joining the connectors could trigger something in the drive, regardless of external power. A small capacitor, kept charged with a small coin cell, might leave room for enough explosive material to injure someone's hand. I don't know much about explosives or electrical engineering to REALLY know how practical this is. But if your goal is to intimidate, you would probably be able to get that message across. So unless you have a good explosives screening process, you need to treat the devices as if they are general-purpose bombs -- as well as malicious USB devices -- the whole time. So the best practices for handling an untrusted USB drive, again remembering that allowing explosives of any form to reach you through the mail is the main failure here, would be: - choose an expendable computer to plug the device into - physically connect device with a motorized rig in an empty and reinforced chamber - provide as little power as possible to the device - whitelist USB drivers - extract data - disconnect device remotely - dispose of device as you would ordnance And I regretfully point out that, if this is now the necessary process for receiving information via the mail, the goal of impeding journalism is already achieved.
- golergka 4y agoThe industrial revolution's consequences have finally caught up with Moore's Law – explosive storage capacity in a compact package.
- antibasilisk 4y agoVoting by mail is so old school, now we have electronic voting!
- nehal3m 4y agoThe Unabomber Manifesto delivered on a bomb. Meta.
- Arrath 4y agoRude/counterproductive not to give the victim enough time to read the manifesto tho.
- _gmax0 4y agoTragically poetic.
- golergka 4y ago(Full disclosure: I asked GPT-4 to write a witty comment in style of HN which would reference the phrase "industrial revolution and it's consequences").
- jefftk 4y agoIn 2014 I wrote about what's the worst that could happen with a malicious USB stick [1] and the first comment was "if we're going with physical attacks, it might as well just be a bomb." Well! [1] https://www.jefftk.com/p/malicious-usb-sticks https://www.jefftk.com/p/malicious-usb-sticks
- GalenErso 4y agoWhy not a small explosive laced with a chemical weapon like VX or sarin?
- Arrath 4y agoWhile still hard to get ahold old, explosives are generally more accessible than legit chemical weapons? Barring mad scientists with chemistry sets and a grudge. And even in such a case it may be safer for said mad scientist to homebrew explosives in favor of chemical weapons.
- dogma1138 4y agoMaking TATP is fairly easy and all the precursor ingredients can be easily bought and they are often unregulated at all and untracked unless you are looking to make a bomb big enough to level a few city blocks.
- missedthecue 4y agoTATP is so unstable, that even though it is chemically speaking relatively straightforward to create, it is actually quite difficult to produce while staying alive/in one piece. It is sensitive to temperature variations, high temperatures, ANY open flame, ANY friction (rubbing your fingers together is more than enough), ANY shock, such as failing to set down a container, dish, or vial slowly enough, and having a small static charge in your body will also set it off. Because of this, TATP actually has no current industrial or military application.
- 4y ago
- snozolli 4y agoPolice determined that the drive featured explosives but believe it didn't explode because the adapter the producer used didn't have enough juice to activate it, Fundamedios said. Sounds like journalists need USB extension cables that include a current and voltage limiter. Maybe just a USB 1.0 dumbed-down interface would do it.
- anonu 4y agoWhy even risk it? Sounds like they need an explosives tester..
- Arrath 4y agoLittle robot arm in a blast enclosure to plug the drive into an extension cable. Strangely, it still takes 3 tries for the robot to correctly insert the device..
- mgdlbp 4y ago1. Plug drive into cable 2. Plug in other end of cable 3. ??? 4. !!!
- jackvalentine 4y agoOr just leave the cable end outside of the box unplugged and only plug it in once the box is closed.
- yencabulator 4y agoCue mechanical force triggered fuse. But at that point, you could just make a letter that blows up when opened.
- lostlogin 4y agoSounds like one of the journalists already had this in place. Crappy USB hubs have at least one use.
- 4y ago
- tpoacher 4y agoGreat. Another thing I wont be allowed to take on a plane now.
- localplume 4y agolikely easily identified through X-ray plus given RDX has a nitrogen group, sniffer dogs would likely detect it as well. So I wouldn't bet on it being banned.
- kneebonian 4y agoSo I'm going to ask a dump question, how much explosive power can actually be packed in a USB stick? Is it enough to kill someone, or is it about the shrapnel, or is it just some burns on the person who plugged it in?
- h2odragon 4y agoProbably enough to mess up your hand, probably not enough to completely remove it. I wouldn't want to count on it for rendering a laptop completely irrecoverable; but it'd probably do a good enough job most of the time. A "thumb drive" that's much bigger than an m80 is going to be a little suspect anyway, isn't it? some of them things can be swallerd now. Don't think any are designed to work after, alas.
- fuzzfactor 4y agoHad one of the small metal ones come through the washing machine OK.
- fwlr 4y agoThe first USB thumb drive I could find on Amazon was a Sandisk with dimensions of 7 x 41 x 17 millimetres. That gives it a total volume of just under 4.9cm3, which would be a maximum of 8.5 grams of C4, or just under 1/3 of an ounce. Here’s one ounce of C4 as a shaped charge punching a hole through a steel plate: https://youtu.be/AwyniA5ryhY&t=46 https://youtu.be/AwyniA5ryhY&t=46 Realistically you couldn’t achieve 1/3 of an ounce (that would be a thumb-drive-shaped blob of C4), it would be at most half of that, and the thumb drive would weigh 5 grams instead of half a gram which is probably noticeably odd. The problem is that a flash drive bomb is going to explode when you plug it in, i.e right when you are holding it in your hand, and holding an explosive in your hand is the best way to maximize the harm it causes. The closest real world example to a thumb drive bomb that we have data on is an M80 firecracker, we have hundreds of instances of those going off while being held in the hand just like what would happen with a thumb drive. The M80 has between 2g and 5g of flash powder, which causes a very comparable explosion (similar size and speed) to what you could practically get from a C4 thumbdrive bomb. I don’t recommend searching M80 firecracker injuries, it seems like it tends to mangle multiple fingers. So an estimate for a practical thumb drive bomb is that it could probably blow off your thumb and a finger or two.
- Khelavaster 4y agoThe Iranians will tell you after stuxnet, USBs with viruses are still worse
- vorpalhex 4y agoWhat strikes me is that this was intended to scare much more than harm. It doesn't seem much actual expertise went into the devices, just rdx wired up to 5v from the reports. No shrapnel, no boost capacitor. Wait until someone repeats the trick with an external hard drive.
- 01100011 4y agoReminds me of the old "floppy disk bomb" in the Anarchist's Cookbook(which probably doesn't actually work, like most crap in the AC).
- giomasce 4y agoReminds me of the Italian Unabomber case. https://en.m.wikipedia.org/wiki/Italian_Unabomber https://en.m.wikipedia.org/wiki/Italian_Unabomber Not related to the American one, except by newspaper sensationalism.