3 ms·
I don’t disagree. But, haven’t there been bugs where operating systems will auto run some executable as soon as the USB is plugged in? So, just to be paranoid,
by bee_rider 1y ago
I don’t disagree.
But, haven’t there been bugs where operating systems will auto run some executable as soon as the USB is plugged in? So, just to be paranoid, I’d classify just plugging the thing in as “running random executables.” At least as a non-security guy.
I wonder if anyone has tried going to a local staples or bestbuy something, and slipping the person at the register a bribe… “if anyone from so-and-so corp buys a flash drive here, put this one in their bag instead.”
Anyway, best to just put glue in the USB ports I guess.
- throwaway173738 1y agoGood luck doing hardware development without USB ports, as the IT team at my employer recently found out.
- vhcr 1y agoSecond best option is to whitelist USB's PID and VID.
- tsimionescu 1y agoEven if the OS doesn't have any bad security practices and doesn't do this, there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal. As long as the computer is unlocked, this will work, and will easily get full local user access, even defeating UAT or similar measures. It can then make itself persistent by "typing in" a malicious script, and going further from there.
- lmm 1y ago> there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal Good systems these days won't accept such a "keyboard" until it's approved by the user.
- tsimionescu 1y agoWhich systems ask before allowing you to use a keyboard you just plugged in over USB? Windows, Ubuntu, Fedora certainly don't, at least not by default.
- windward 1y agoI've only seen it on Macs
- tsimionescu 1y agoOut of curiosity, how does that work if this is the only input method connected? Or is this only shown if you have another keyboard (and/or mouse) already connected.
- windward 1y agoSorry, IDK, I've only used their laptops
- JdeBP 1y agoMine. Not asking whoever happens to have local physical access interactively, strictly speaking, as that just papers over one of the problems; but controlling what Human Input Devices are allowed when plugged in, by applying rules (keyable on various device parameters) set up by the administrator. Working thus far on NetBSD, FreeBSD, and Linux. OpenBSD to come when I can actually get it to successfully install on the hardware that I have. * https://jdebp.uk/Softwares/nosh/guide/user-virtual-terminal-configuration.html https://jdebp.uk/Softwares/nosh/guide/user-virtual-terminal-... In principle there's no reason that X11 servers or Wayland systems cannot similarly provide find-grained control over auto-configuration instead of a just-automatically-merge-all-input-devices approach.
- BobaFloutist 1y agoAssuming the OS isn't running on a laptop, how do you approve the first keyboard or mouse you plug in?