4 ms·

If you are getting powned by running random executables found on usb drives, passkeys aren’t going to save you. Same if the social engineering is going to get y

If you are getting powned by running random executables found on usb drives, passkeys aren’t going to save you. Same if the social engineering is going to get you to install random executables.

akerl_ 1y ago
Sure; the fix for that is blocking unexpected USB devices on corporate devices.
tialaramex 1y ago
If you're getting pwned a physical Security Key still means bad guys don't have the actual credential (there's no way to get that), and they have to work relatively hard to even create a situation where maybe you to let them use the credential you do have (inside the Security Key) while they're in position to exploit you. These devices want a physical interaction (this is called "User present") for most operations, typically signified by having a push button or contact sensor, so the attacker needs to have a proof of identity ready to sign, send that over - then persuade the user to push the button or whatever. It's not that difficult but it's one more step and if that doesn't work you wasted your shot.
- amenghra 1y ago
  Malicious binary steals browser cookies giving attacker access to all active sessions?
  - FreakLegion 1y ago
    It gets better. With malware on the box you own the primary refresh token, which can mint new browser tokens without needing passwords or MFA. Definitely use FIDO2, but understand that it's not foolproof. Malware, OAuth phishing, XSS, DNS hijacking, etc. will still pwn you.
- mr_mitm 1y ago
  All your 2FA apps, token, security keys, certificates and what not only protect the authentication (and in the case of online banking, a few other actions like transferring money). After that, a single bearer token authenticates each request. If your endpoint is compromised, the attackers will simply steal the bearer token after you authenticate.
  - tialaramex 1y ago
    That's true, but in terms of system design you definitely should ask to see the proof of identity again during unusual transactions and not just that bearer token - for example attempts to add or remove 2FA should need that extra step, as well as say high value financial transactions or irreversible system changes.
bee_rider 1y ago
I don’t disagree. But, haven’t there been bugs where operating systems will auto run some executable as soon as the USB is plugged in? So, just to be paranoid, I’d classify just plugging the thing in as “running random executables.” At least as a non-security guy. I wonder if anyone has tried going to a local staples or bestbuy something, and slipping the person at the register a bribe… “if anyone from so-and-so corp buys a flash drive here, put this one in their bag instead.” Anyway, best to just put glue in the USB ports I guess.
- throwaway173738 1y ago
  Good luck doing hardware development without USB ports, as the IT team at my employer recently found out.
  - vhcr 1y ago
    Second best option is to whitelist USB's PID and VID.
- tsimionescu 1y ago
  Even if the OS doesn't have any bad security practices and doesn't do this, there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal. As long as the computer is unlocked, this will work, and will easily get full local user access, even defeating UAT or similar measures. It can then make itself persistent by "typing in" a malicious script, and going further from there.
  - lmm 1y ago
    > there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal Good systems these days won't accept such a "keyboard" until it's approved by the user.
    - tsimionescu 1y ago
rm445 1y ago
I think the claim is that plugging in the USB device is enough. If people needed to try running an executable from the device, some devices would still be compromised, but with lower frequency. I don't know exactly what happens. Automatically-triggered 'driver' install that is actually malware? Presenting as a keyboard and typing commands? Low-level cracks in the OS USB stack? It feels to me more like OSes ought to be more secure. But USB devices are extremely convenient.
- scq 1y ago
  Usually presents as a keyboard that types commands, yeah. Win-R -> powershell -> execute whatever you want. E.g. https://shop.hak5.org/products/usb-rubber-ducky https://shop.hak5.org/products/usb-rubber-ducky
  - yencabulator 1y ago
    Still fits "It feels to me more like OSes ought to be more secure." New USB-HID keyboard? Ask it to input a sequence shown on screen to gain trust. Though USB could be better too; having unique gadget serial numbers would help a lot. Matching by vendor:product at least means the duplicate-gadget attack would need to be targeted.
windward 1y ago
USB devices can be USB HIDs

If you are getting powned by running random executables found on usb drives, passkeys aren’t going to save you. Same if the social engineering is going to get you to install random executables.

akerl_ 1y ago

Sure; the fix for that is blocking unexpected USB devices on corporate devices.

tialaramex 1y ago

If you're getting pwned a physical Security Key still means bad guys don't have the actual credential (there's no way to get that), and they have to work relatively hard to even create a situation where maybe you to let them use the credential you do have (inside the Security Key) while they're in position to exploit you. These devices want a physical interaction (this is called "User present") for most operations, typically signified by having a push button or contact sensor, so the attacker needs to have a proof of identity ready to sign, send that over - then persuade the user to push the button or whatever. It's not that difficult but it's one more step and if that doesn't work you wasted your shot.

amenghra 1y ago
Malicious binary steals browser cookies giving attacker access to all active sessions?
- FreakLegion 1y ago
  It gets better. With malware on the box you own the primary refresh token, which can mint new browser tokens without needing passwords or MFA. Definitely use FIDO2, but understand that it's not foolproof. Malware, OAuth phishing, XSS, DNS hijacking, etc. will still pwn you.
mr_mitm 1y ago
All your 2FA apps, token, security keys, certificates and what not only protect the authentication (and in the case of online banking, a few other actions like transferring money). After that, a single bearer token authenticates each request. If your endpoint is compromised, the attackers will simply steal the bearer token after you authenticate.
- tialaramex 1y ago
  That's true, but in terms of system design you definitely should ask to see the proof of identity again during unusual transactions and not just that bearer token - for example attempts to add or remove 2FA should need that extra step, as well as say high value financial transactions or irreversible system changes.

bee_rider 1y ago

I don’t disagree. But, haven’t there been bugs where operating systems will auto run some executable as soon as the USB is plugged in? So, just to be paranoid, I’d classify just plugging the thing in as “running random executables.” At least as a non-security guy. I wonder if anyone has tried going to a local staples or bestbuy something, and slipping the person at the register a bribe… “if anyone from so-and-so corp buys a flash drive here, put this one in their bag instead.” Anyway, best to just put glue in the USB ports I guess.

throwaway173738 1y ago
Good luck doing hardware development without USB ports, as the IT team at my employer recently found out.
- vhcr 1y ago
  Second best option is to whitelist USB's PID and VID.
tsimionescu 1y ago
Even if the OS doesn't have any bad security practices and doesn't do this, there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal. As long as the computer is unlocked, this will work, and will easily get full local user access, even defeating UAT or similar measures. It can then make itself persistent by "typing in" a malicious script, and going further from there.
- lmm 1y ago
  > there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal Good systems these days won't accept such a "keyboard" until it's approved by the user.
  - tsimionescu 1y ago

rm445 1y ago

I think the claim is that plugging in the USB device is enough. If people needed to try running an executable from the device, some devices would still be compromised, but with lower frequency. I don't know exactly what happens. Automatically-triggered 'driver' install that is actually malware? Presenting as a keyboard and typing commands? Low-level cracks in the OS USB stack? It feels to me more like OSes ought to be more secure. But USB devices are extremely convenient.

scq 1y ago
Usually presents as a keyboard that types commands, yeah. Win-R -> powershell -> execute whatever you want. E.g. https://shop.hak5.org/products/usb-rubber-ducky https://shop.hak5.org/products/usb-rubber-ducky
- yencabulator 1y ago
  Still fits "It feels to me more like OSes ought to be more secure." New USB-HID keyboard? Ask it to input a sequence shown on screen to gain trust. Though USB could be better too; having unique gadget serial numbers would help a lot. Matching by vendor:product at least means the duplicate-gadget attack would need to be targeted.

windward 1y ago

USB devices can be USB HIDs