3 ms·

If I were paranoid, I might be concerned that the USB device would detect when it's plugged in to a small device like a Raspberry Pi and only launch its attack

If I were paranoid, I might be concerned that the USB device would detect when it's plugged in to a small device like a Raspberry Pi and only launch its attack when it's plugged in to a more valuable target. Is there some way to mitigate that?

bpye 3y ago
Different operating systems also have subtle differences in enumeration - I don’t think there is a great way to mitigate that.
lcnPylGDnU4H9OF 3y ago
> then you have the power of Linux to interrogate the device with and spot suspicious behavior Ideally, you’d find the malicious payload. It’s probably not hidden so well that it can’t be found by a security researcher.
- JohnFen 3y ago
  True, if I care. I use the R-Pi as a screening method, not really as the means to dig into something malicious and analyze it in detail. I have other tools for that. My reasoning for using the R-Pi is that it's disposable, so if the USB device turns out to be an electrical USB-killer, it doesn't kill any hardware that really matters to me.
JohnFen 3y ago
> Is there some way to mitigate that? Against a very sophisticated attacker? Maybe not, but it doesn't matter for my purposes. My concern is the most likely kinds of attacks, which are not terribly sophisticated. It's really more of a sanity check than a comprehensive security audit. No security can ever be 100% effective. Like all security measures, this is just one layer intended to cover attacks I am most likely to be exposed to. In other words, if I'm protecting against governments and other well-funded entities or skilled and determined hackers, I wouldn't be using this alone. I'd be using it in conjunction with other security processes, such as not attaching unknown USB devices to my systems at all, or at least not to ones that matter or aren't permanently isolated from my other machines.

3 ms·

If I were paranoid, I might be concerned that the USB device would detect when it's plugged in to a small device like a Raspberry Pi and only launch its attack

by hathawsh 3y ago

bpye 3y ago
Different operating systems also have subtle differences in enumeration - I don’t think there is a great way to mitigate that.
lcnPylGDnU4H9OF 3y ago
> then you have the power of Linux to interrogate the device with and spot suspicious behavior Ideally, you’d find the malicious payload. It’s probably not hidden so well that it can’t be found by a security researcher.
- JohnFen 3y ago
  True, if I care. I use the R-Pi as a screening method, not really as the means to dig into something malicious and analyze it in detail. I have other tools for that. My reasoning for using the R-Pi is that it's disposable, so if the USB device turns out to be an electrical USB-killer, it doesn't kill any hardware that really matters to me.
JohnFen 3y ago
> Is there some way to mitigate that? Against a very sophisticated attacker? Maybe not, but it doesn't matter for my purposes. My concern is the most likely kinds of attacks, which are not terribly sophisticated. It's really more of a sanity check than a comprehensive security audit. No security can ever be 100% effective. Like all security measures, this is just one layer intended to cover attacks I am most likely to be exposed to. In other words, if I'm protecting against governments and other well-funded entities or skilled and determined hackers, I wouldn't be using this alone. I'd be using it in conjunction with other security processes, such as not attaching unknown USB devices to my systems at all, or at least not to ones that matter or aren't permanently isolated from my other machines.