6 ms·

Federal agency destroyed computers, keyboards, mice over virus fear

53 points by wikiburner 13y ago

anujabro 13y ago
$2.7mm in damages over 6 malware infected parts. That escalated quickly. Where do they get the rationale for the Mice and Keyboards?!
- stfu 13y ago
  It is probably just because these are things that get touched by humans so there is a high risk that the virus might jump over and spread ...!
  - Groxx 13y ago
    The dreaded Trackball Mouse Flu, ready to run rampant now that all the birds caught the flu from us! Only laser mice can save us now!
- binarycrusader 13y ago
  If they were programmable keyboards / mice, or they were suspected to be counterfeit or other surreptitiously modified parts, I might understand.
  - mindcrime 13y ago
    Right, if it's a mouse that came from the OEM manufacturer and you know it is truly original, it's probably safe. But if there's any way that an outsider could have snuck a loaded mouse into your environment, then the mouse can certainly be setup to attack your system. See note above about The Glitch.
- mindcrime 13y ago
  It's low probability but a mouse can absolutely be an attack vector. See: http://www.kickstarter.com/projects/1186217328/the-glitch http://www.kickstarter.com/projects/1186217328/the-glitch
- yen223 13y ago
  A paranoid, incompetent IT team plus an opportunistic "cybersecurity" contractor.
  - patio11 13y ago
    If the brief for the contract includes "We believe we may have been compromised by a nation state. Check for us." then checking keyboards and mice is totally reasonable. Some of them incorporate user-upgradable firmware. Given this, turning the keyboard/mouse into an "advanced persistent threat" is an exercise trivially within the capability of garden-variety security consultants. (Ballpark cost: $20k if you get everything scratchbuilt the first time, assuming you've separately rooted one machine to infect the peripheral.) Nation states can be presumed to have access to garden-variety security consultants, and more elaborate tricks besides.
    - rmc 13y ago
      A lot of threat models that the USA defends against are perfectly legitimate, because the USA has used them against opponents in the past! e.g. US military and embassies always fly in new equipment from the USA, rather than buying local. Why? Because in the cold war, the Soviets got a local photocopier and local repairmen. The USA had a camera in it and the repairman was a spy. These aren't theoretical attacks to the USA.
    - mechanical_fish 13y ago
      Yes, even I fell for the "but it's only a stupid mouse!" spin on this story, and I've been shopping for embedded processors recently so you'd think I would know better. If it has a USB port, it contains a tiny computer. One which is probably more powerful than the Commodore PET I learned computing with. Not that you need that much power to log keystrokes. Those of us who were brought up in the 20th century can no longer trust our intuition about where computers might be hiding.
  - mattmanser 13y ago
    In the article it comes across like the contractor was constantly saying 'no, it's all ok'. It seems to say that he took 2 weeks to do the initial audit and then they got him to do some sort of detailed review of every machine which took months. To which he also then said there was nothing really wrong. To me it sounds like he just did his job while some crazy, incredibly incompetent CIO kept asking for more.
mifreewil 13y ago
These are the people that take the money out of your paycheck each week. Don't know whether it's gross incompetence or cronyism to buy new equipment from a contractor.
- mpyne 13y ago
  I wasn't aware that the EDA was the IRS. Learn something new every day I guess.
  - coldtea 13y ago
    He means they are paid by our taxes -- not that they collect them directly. Snark FAIL.
    - mpyne 13y ago
      I know what he meant, otherwise snark wouldn't have been necessary. He's basically saying that because there was one CIO somewhere, anywhere, in the Federal government that it's appropriate to tar every military and civil servant with that same 'idiot' brush. I mean, I'm assuming you would be offended if someone said that all computer hackers have my own personal morals, so it seems wise to only blame people for what they actually do, not their seventh-order relationships to other people.
      - yen223 13y ago
        Funny how no one points out that it was a government agency that uncovered this issue in the first place...
        dmix 13y ago
        Are we supposed to start rewarding these institutions for being capable of "uncovering" million dollar technology projects that are wasteful and pointless? The fact it happened in the first place is bad enough.
      - 13y ago
cbhl 13y ago
"Among them was the apparent assumption that a computer mouse can carry a virus." Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. But surely you could simply test the hardware with a known good installation (say, off a Live CD) to figure out if that was the case?
- mindcrime 13y ago
  Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. It's not hypothetical. A friend of mine has created an USB based pen-test tool based on this very idea. The early prototype idea was to open up a mouse, splice a USB hub into the USB connection, then attach an "Arduino like" Teensy[1] to it such that, when the mouse was connected, in addition to the mouse being detected and registered by the host machine, it would also detect and install a new keyboard. The Teensy could then dump it's payload as anything that could be typed on a physical keyboard (subject to the memory limitations of the board). He's now doing a Kickstarter campaign to manufacture and sell the things, which he calls The Glitch[2]. You can see pictures on the Kickstarter page, of the Glitch embedded in a generic mouse. [1]: http://www.pjrc.com/teensy/ http://www.pjrc.com/teensy/ [2]: http://www.kickstarter.com/projects/1186217328/the-glitch http://www.kickstarter.com/projects/1186217328/the-glitch
  - dmix 13y ago
    Fascinating. How hard would this part be? > But surely you could simply test the hardware Scanning system devices would reveal it pretty quickly if it's just an additional USB device.
    - mindcrime 13y ago
      Yes, if you took the time to connect each mouse to a machine and see what devices it detects, it would be readily apparent that a mouse loaded with a Glitch was doing something funny. And, as far as that goes, a really observant user might notice something weird going on when it's first connected. But most users aren't terribly observant, or at least that's the assumption.
aidos 13y ago
Is this for real? Man, $823,000 + $688,000 for a cybersecurity contractor to do 6 months work. I'm in the wrong industry. The report: http://www.oig.doc.gov/OIGPublications/OIG-13-027-A.pdf http://www.oig.doc.gov/OIGPublications/OIG-13-027-A.pdf
- phaus 13y ago
  That's astronomical compared to a typical cyber-security salary, even at the higher levels.
- VladRussian2 13y ago
  such numbers make me wonder - is it just idiocy of bureaucrats or we're talking kickbacks here. For example, in Russia government contracts have 75% kickback, so that explains it there. What is the explanation here in the US? >I'm in the wrong industry. it is not about industry. In any industry you can have government as a client.
  - wikiburner 13y ago
    We don't have kickbacks in the U.S. Only sales commissions and lobbyist fees.
badmadrad 13y ago
This doesn't surprise me. Government agencies tend to hire people based primarily on the fact the individual has a top secret clearance. This drastically cuts the talent pool and allows people that have gamed the system to get the job. Sometimes legitimate experience is cast aside for the mere fact a person has a clearance. I know so many people that because they have a clearance have a cushy 6 figure job with a great title. I've talked to people that are System Admins and Analysts and I can tell they have no idea what they are doing. They got the job because they knew somebody, embellished their resume, and have a clearance.
banachtarski 13y ago
It's like when Egypt killed herds of pigs to mitigate the "swine flu"
paulrademacher 13y ago
I keep a can of Raid on my desk in case I find a bug in the software.

53 points by wikiburner 13y ago

$2.7mm in damages over 6 malware infected parts. That escalated quickly. Where do they get the rationale for the Mice and Keyboards?!

stfu 13y ago
It is probably just because these are things that get touched by humans so there is a high risk that the virus might jump over and spread ...!
- Groxx 13y ago
  The dreaded Trackball Mouse Flu, ready to run rampant now that all the birds caught the flu from us! Only laser mice can save us now!
binarycrusader 13y ago
If they were programmable keyboards / mice, or they were suspected to be counterfeit or other surreptitiously modified parts, I might understand.
- mindcrime 13y ago
  Right, if it's a mouse that came from the OEM manufacturer and you know it is truly original, it's probably safe. But if there's any way that an outsider could have snuck a loaded mouse into your environment, then the mouse can certainly be setup to attack your system. See note above about The Glitch.
mindcrime 13y ago
It's low probability but a mouse can absolutely be an attack vector. See: http://www.kickstarter.com/projects/1186217328/the-glitch http://www.kickstarter.com/projects/1186217328/the-glitch
yen223 13y ago
A paranoid, incompetent IT team plus an opportunistic "cybersecurity" contractor.
- patio11 13y ago
  If the brief for the contract includes "We believe we may have been compromised by a nation state. Check for us." then checking keyboards and mice is totally reasonable. Some of them incorporate user-upgradable firmware. Given this, turning the keyboard/mouse into an "advanced persistent threat" is an exercise trivially within the capability of garden-variety security consultants. (Ballpark cost: $20k if you get everything scratchbuilt the first time, assuming you've separately rooted one machine to infect the peripheral.) Nation states can be presumed to have access to garden-variety security consultants, and more elaborate tricks besides.
  - rmc 13y ago
    A lot of threat models that the USA defends against are perfectly legitimate, because the USA has used them against opponents in the past! e.g. US military and embassies always fly in new equipment from the USA, rather than buying local. Why? Because in the cold war, the Soviets got a local photocopier and local repairmen. The USA had a camera in it and the repairman was a spy. These aren't theoretical attacks to the USA.
  - mechanical_fish 13y ago
    Yes, even I fell for the "but it's only a stupid mouse!" spin on this story, and I've been shopping for embedded processors recently so you'd think I would know better. If it has a USB port, it contains a tiny computer. One which is probably more powerful than the Commodore PET I learned computing with. Not that you need that much power to log keystrokes. Those of us who were brought up in the 20th century can no longer trust our intuition about where computers might be hiding.
- mattmanser 13y ago
  In the article it comes across like the contractor was constantly saying 'no, it's all ok'. It seems to say that he took 2 weeks to do the initial audit and then they got him to do some sort of detailed review of every machine which took months. To which he also then said there was nothing really wrong. To me it sounds like he just did his job while some crazy, incredibly incompetent CIO kept asking for more.

mifreewil 13y ago

These are the people that take the money out of your paycheck each week. Don't know whether it's gross incompetence or cronyism to buy new equipment from a contractor.

mpyne 13y ago
I wasn't aware that the EDA was the IRS. Learn something new every day I guess.
- coldtea 13y ago
  He means they are paid by our taxes -- not that they collect them directly. Snark FAIL.
  - mpyne 13y ago
    I know what he meant, otherwise snark wouldn't have been necessary. He's basically saying that because there was one CIO somewhere, anywhere, in the Federal government that it's appropriate to tar every military and civil servant with that same 'idiot' brush. I mean, I'm assuming you would be offended if someone said that all computer hackers have my own personal morals, so it seems wise to only blame people for what they actually do, not their seventh-order relationships to other people.
    - yen223 13y ago
      Funny how no one points out that it was a government agency that uncovered this issue in the first place...
      - dmix 13y ago
        Are we supposed to start rewarding these institutions for being capable of "uncovering" million dollar technology projects that are wasteful and pointless? The fact it happened in the first place is bad enough.
    - 13y ago

cbhl 13y ago

"Among them was the apparent assumption that a computer mouse can carry a virus." Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. But surely you could simply test the hardware with a known good installation (say, off a Live CD) to figure out if that was the case?

mindcrime 13y ago
Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. It's not hypothetical. A friend of mine has created an USB based pen-test tool based on this very idea. The early prototype idea was to open up a mouse, splice a USB hub into the USB connection, then attach an "Arduino like" Teensy[1] to it such that, when the mouse was connected, in addition to the mouse being detected and registered by the host machine, it would also detect and install a new keyboard. The Teensy could then dump it's payload as anything that could be typed on a physical keyboard (subject to the memory limitations of the board). He's now doing a Kickstarter campaign to manufacture and sell the things, which he calls The Glitch[2]. You can see pictures on the Kickstarter page, of the Glitch embedded in a generic mouse. [1]: http://www.pjrc.com/teensy/ http://www.pjrc.com/teensy/ [2]: http://www.kickstarter.com/projects/1186217328/the-glitch http://www.kickstarter.com/projects/1186217328/the-glitch
- dmix 13y ago
  Fascinating. How hard would this part be? > But surely you could simply test the hardware Scanning system devices would reveal it pretty quickly if it's just an additional USB device.
  - mindcrime 13y ago
    Yes, if you took the time to connect each mouse to a machine and see what devices it detects, it would be readily apparent that a mouse loaded with a Glitch was doing something funny. And, as far as that goes, a really observant user might notice something weird going on when it's first connected. But most users aren't terribly observant, or at least that's the assumption.

aidos 13y ago

Is this for real? Man, $823,000 + $688,000 for a cybersecurity contractor to do 6 months work. I'm in the wrong industry. The report: http://www.oig.doc.gov/OIGPublications/OIG-13-027-A.pdf http://www.oig.doc.gov/OIGPublications/OIG-13-027-A.pdf

phaus 13y ago
That's astronomical compared to a typical cyber-security salary, even at the higher levels.
VladRussian2 13y ago
such numbers make me wonder - is it just idiocy of bureaucrats or we're talking kickbacks here. For example, in Russia government contracts have 75% kickback, so that explains it there. What is the explanation here in the US? >I'm in the wrong industry. it is not about industry. In any industry you can have government as a client.
- wikiburner 13y ago
  We don't have kickbacks in the U.S. Only sales commissions and lobbyist fees.

badmadrad 13y ago

This doesn't surprise me. Government agencies tend to hire people based primarily on the fact the individual has a top secret clearance. This drastically cuts the talent pool and allows people that have gamed the system to get the job. Sometimes legitimate experience is cast aside for the mere fact a person has a clearance. I know so many people that because they have a clearance have a cushy 6 figure job with a great title. I've talked to people that are System Admins and Analysts and I can tell they have no idea what they are doing. They got the job because they knew somebody, embellished their resume, and have a clearance.

banachtarski 13y ago

It's like when Egypt killed herds of pigs to mitigate the "swine flu"

paulrademacher 13y ago

I keep a can of Raid on my desk in case I find a bug in the software.