4 ms·

The maintainer of left-justify receives his YubiKey from yubikey-official-store.net. It is a $4 USB drive containing a README that says “lol.” Got me seriously

The maintainer of left-justify receives his YubiKey from yubikey-official-store.net. It is a $4 USB drive containing a README that says “lol.” Got me seriously laughing... Such a troll.

sdenton4 5mo ago
Yeah that's great. I love that plugging in the USB device from the phishing site is, itself, another attack vector...
- walrus01 5mo ago
  I actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one. I know we're not in the era when a windows pc will happily run any autorun.inf and .EXE file found on an inserted flash drive or DVD anymore. But even so. What if it didn't even have any malicious data payload but somebody was shipping USB-A interface capacitor based usb killers? https://www.slashgear.com/1819672/usb-killer-explained-kill-stick-how-works-what-damage-cause/ https://www.slashgear.com/1819672/usb-killer-explained-kill-... What if it did have data on it and came with a slick color brochure walking people through how to run the binary, or in a linux or developer specific audience, how to 'sudo' the ELF binary that lives on its filesystem?
  - shakna 5mo ago
    A USB that was both storage and a keyboard, that executed the keystrokes to download malware, was demo'd at a DefCon a few years back.
    - menno-sh 5mo ago
      Even worse than a rubber ducky: the O.MG cable does the same thing, but looks like a regular USB cable. Their Apple Lightning-dupe [0] is my favorite. The creator was on Darknet Diaries a while ago, too. [1] [0] https://shop.hak5.org/products/omg-cable https://shop.hak5.org/products/omg-cable [1] https://darknetdiaries.com/episode/161/ https://darknetdiaries.com/episode/161/
    - crumpled 5mo ago
      BadUSB, Blackhat 2014. That's almost 12 years now. A novice can now get ATmega32 USB devices Prime delivered. Not a cutting edge theoretical attack anymore but a basic tool in a every pen tester's toolbox now.
smsm42 5mo ago
I mean, this is way more than you would usually get from a fishing site - a functioning USB drive!

The maintainer of left-justify receives his YubiKey from yubikey-official-store.net. It is a $4 USB drive containing a README that says “lol.” Got me seriously laughing... Such a troll.

sdenton4 5mo ago

Yeah that's great. I love that plugging in the USB device from the phishing site is, itself, another attack vector...

walrus01 5mo ago
I actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one. I know we're not in the era when a windows pc will happily run any autorun.inf and .EXE file found on an inserted flash drive or DVD anymore. But even so. What if it didn't even have any malicious data payload but somebody was shipping USB-A interface capacitor based usb killers? https://www.slashgear.com/1819672/usb-killer-explained-kill-stick-how-works-what-damage-cause/ https://www.slashgear.com/1819672/usb-killer-explained-kill-... What if it did have data on it and came with a slick color brochure walking people through how to run the binary, or in a linux or developer specific audience, how to 'sudo' the ELF binary that lives on its filesystem?
- shakna 5mo ago
  A USB that was both storage and a keyboard, that executed the keystrokes to download malware, was demo'd at a DefCon a few years back.
  - menno-sh 5mo ago
    Even worse than a rubber ducky: the O.MG cable does the same thing, but looks like a regular USB cable. Their Apple Lightning-dupe [0] is my favorite. The creator was on Darknet Diaries a while ago, too. [1] [0] https://shop.hak5.org/products/omg-cable https://shop.hak5.org/products/omg-cable [1] https://darknetdiaries.com/episode/161/ https://darknetdiaries.com/episode/161/
  - crumpled 5mo ago
    BadUSB, Blackhat 2014. That's almost 12 years now. A novice can now get ATmega32 USB devices Prime delivered. Not a cutting edge theoretical attack anymore but a basic tool in a every pen tester's toolbox now.

smsm42 5mo ago

I mean, this is way more than you would usually get from a fishing site - a functioning USB drive!