4 ms·

Recently, it comes to light that those handling the Snowden files are using air-gapped computers and passing encrypted data to the outside world via ... USB sti

Recently, it comes to light that those handling the Snowden files are using air-gapped computers and passing encrypted data to the outside world via ... USB sticks. Can't USB sticks execute arbitrary code? Couldn't an attacker infiltrate the publically accessible computers that these people use and put a data-stealing trojan onto USB sticks used to bridge the air-gap? Do other media that most computers accept these days e.g. sd cards support arbitrary code execution too? How can you get around this? EDIT: it was DMA attacks that I was thinking off, and USB seems free of them at least. I guess, if you trust the robustness of your USB stack against exploit, that USB is a fairly safe bet. As these very people are reading the NSA secrets, one wonders what'd happen if they discovered some hint that that NSA could do precisely that - exploit via USB plugging in.

kirab 13y ago
It was an old Windows problem that it automatically executed code on mounted media devices. But I hope this was fixed on Windows in the meantime and other OS don’t have this problem.
- guard-of-terra 13y ago
  It's deeper than that. You're plugging a device into your system's bus, the attack surface is huge for that device to steal or modify your data. USB device is a very different beast than CD.
maggit 13y ago
A USB stick could be anything, but if it is simply a proper USB mass storage device, it, by itself, can not execute code on the host machine. To execute code on the host machine, either the host machine has to be stupid (like many Windows versions that try to automatically execute code from plugged-in devices without user interaction) or the device has to be malicious, trying to exploit weaknesses in the host machine. ---- Now, for the files being put on these sticks, there are probably many opportunities to inject a trojan.
nodata 13y ago
Your "usb stick" could be a usb keyboard which changes your password and sets a new one, even sending the data over a 3g connection to an adversary.
- deckiedan 13y ago
  Most applications & the OS require you to type in your old password correctly at the time before allowing you to change it. I don't see how a usb-stick which pretends to be a keyboard could do that.
Kliment 13y ago
It's an OS issue, not a medium issue. That is, any storage medium is a risk. USB is particularly interesting because a single USB device can turn into a hub or a completely different device at runtime. So you can have a USB flash drive suddenly become say a keyboard and start typing stuff in.
rbanffy 13y ago
It's possible, but I'm not sure how likely. The USB stick would have to exploit some vulnerability in the handshake process to run attack code on the host. In order to prevent that, you'd need a "USB sanitizer" that proxies the communications over the data lines and prevents any traffic that it deems unsafe. This device, off course, can also be the target of an attack.
bigiain 13y ago
For some idea of what it's possible to do when you plug something into a USB port, watch this: http://www.youtube.com/watch?v=D8Im0_KUEf8 http://www.youtube.com/watch?v=D8Im0_KUEf8 (Travis Goodspeed's "Writing a thumb drive from scratch" presentation. It's got some fascinating and potentially _very_ scarey ideas…)
- revelation 13y ago
  Can very much recommend this talk. Spoiler: you can differentiate an operating system booting from e.g. a forensic device doing a backup, by looking at the access patterns. Also note that the USB spec is rather complex, and some parts of it will be invariably implemented in software. Often in very high-privileged C code. As such, it is likely to contain critical errors. Heres one for the PlayStation 3 that emulates some garbage on a USB port to get fully privileged code execution: https://github.com/psgroove/psgroove/blob/master/psgroove.c https://github.com/psgroove/psgroove/blob/master/psgroove.c
tlrobinson 13y ago
IIRC Stuxnet relied on USB sticks to cross over to air gapped hosts. But I think it only works on certain OSs that have "autorun" or whatever enabled. Or perhaps a vulnerability in the USB stack. Thunderbolt, on the other hand, has much more low level access to hardware and can apparently read raw memory/devices.

kirab 13y ago

It was an old Windows problem that it automatically executed code on mounted media devices. But I hope this was fixed on Windows in the meantime and other OS don’t have this problem.

guard-of-terra 13y ago
It's deeper than that. You're plugging a device into your system's bus, the attack surface is huge for that device to steal or modify your data. USB device is a very different beast than CD.

maggit 13y ago

A USB stick could be anything, but if it is simply a proper USB mass storage device, it, by itself, can not execute code on the host machine. To execute code on the host machine, either the host machine has to be stupid (like many Windows versions that try to automatically execute code from plugged-in devices without user interaction) or the device has to be malicious, trying to exploit weaknesses in the host machine. ---- Now, for the files being put on these sticks, there are probably many opportunities to inject a trojan.

nodata 13y ago

Your "usb stick" could be a usb keyboard which changes your password and sets a new one, even sending the data over a 3g connection to an adversary.

deckiedan 13y ago
Most applications & the OS require you to type in your old password correctly at the time before allowing you to change it. I don't see how a usb-stick which pretends to be a keyboard could do that.

Kliment 13y ago

It's an OS issue, not a medium issue. That is, any storage medium is a risk. USB is particularly interesting because a single USB device can turn into a hub or a completely different device at runtime. So you can have a USB flash drive suddenly become say a keyboard and start typing stuff in.

rbanffy 13y ago

It's possible, but I'm not sure how likely. The USB stick would have to exploit some vulnerability in the handshake process to run attack code on the host. In order to prevent that, you'd need a "USB sanitizer" that proxies the communications over the data lines and prevents any traffic that it deems unsafe. This device, off course, can also be the target of an attack.

bigiain 13y ago

For some idea of what it's possible to do when you plug something into a USB port, watch this: http://www.youtube.com/watch?v=D8Im0_KUEf8 http://www.youtube.com/watch?v=D8Im0_KUEf8 (Travis Goodspeed's "Writing a thumb drive from scratch" presentation. It's got some fascinating and potentially _very_ scarey ideas…)

revelation 13y ago
Can very much recommend this talk. Spoiler: you can differentiate an operating system booting from e.g. a forensic device doing a backup, by looking at the access patterns. Also note that the USB spec is rather complex, and some parts of it will be invariably implemented in software. Often in very high-privileged C code. As such, it is likely to contain critical errors. Heres one for the PlayStation 3 that emulates some garbage on a USB port to get fully privileged code execution: https://github.com/psgroove/psgroove/blob/master/psgroove.c https://github.com/psgroove/psgroove/blob/master/psgroove.c

tlrobinson 13y ago

IIRC Stuxnet relied on USB sticks to cross over to air gapped hosts. But I think it only works on certain OSs that have "autorun" or whatever enabled. Or perhaps a vulnerability in the USB stack. Thunderbolt, on the other hand, has much more low level access to hardware and can apparently read raw memory/devices.