4 ms·

I doubt it. Or I doubt that you understood the idea. How can I put a autorun file on my USB mouse? it's the same idea. If the device is not a USB storage device

by ccozan 13y ago

I doubt it. Or I doubt that you understood the idea. How can I put a autorun file on my USB mouse? it's the same idea. If the device is not a USB storage device, how it can serve files? Or why do you imagine that the intelligent house ( and not my laptop - where did you get that? ) would run, hello?, Windows ( the horror ) ? I think, if something like that would be developed, the base would be 100% on linux. You can plug to my Linux machine any USB device, can't think that you can own it. ( unless you link to some clever exploit ).

nucleardog 13y ago
How do you know the other end of that cable is a mouse unless you dissect the mouse first? How do you know the other end isn't flash storage? How do you know it isn't a USB hub with a flash device also connected so you'll never notice the mouse doesn't work? What if the mouse is set up to present flash storage with auto run only after it has been connected and left idle for at least a few hours? USB is not often exploited... but that just means we currently have few defenses and little for security in place which becomes a concern if we start connecting our homes with it. And to other homes. And businesses.
pjc50 13y ago
Just because a device looks like a mouse doesn't mean it can't contain multiple USB endpoints, one of which is a mass storage device. Example Linux USB exploit: http://charlescurley.com/blog/archives/2011/03/13/linux_usb_vulnerability/ http://charlescurley.com/blog/archives/2011/03/13/linux_usb_...
VLM 13y ago
"How can I put a autorun file on my USB mouse?" LOL its really easy. You've got an empty box of mostly air, so you open it up, solder four wires in parallel, done. All you need is for the victim to plug it in once for a few seconds. Yes this is why its dumb for windows admins not to disable autorun. "can't think that you can own it." The flash contains linux_installation.sh with: #!/bin/bash clear echo Run this file as root to install the closed echo source USB mouse driver for your echo new "whatever" brand USB mouse. (insert lots of stuff most folks won't understand which owns the machine and certainly didn't come from any mouse mfgr) I think you could have hilarious fun on air-gapped networks plugging in wifi dongles and bluetooth dongles mounted inside a USB gadget. How your system responds to gaining a keylogger or another extra HID device or another extra network device would be interesting to watch. Just a COTS keylogger could be interesting.
- ccozan 13y ago
  just cute. Poor soul, has no idea how USB mice works on linux shakes head. ( appollogizes in advance for the unavoidable ad-hominem comment ).
- Smegger 13y ago
  if your linux install is autoruning every bash script you have a very serious problem
pornel 13y ago
> How can I put a autorun file on my USB mouse? You make the mouse identify itself as a USB HUB with a mouse, keyboard and a flashdrive. You make it simulate keypresses of Win+R, `F:\exploit.exe`, Enter (or Cmd+space, Terminal, `open /Volumes/pretendmouse/exploit`, etc.) Anything you plug into USB can own your machine, and autorun is not even necessary.
- ccozan 13y ago
  I think you missunderstood the idea. A smart house system will be invariably an embedded system, and not a generic multi purpouse PC, which you all reply-ers immediatelly implied. There is no need for USB mass storage drivers. It will probably have an own class ( USB-home-automation ) that can only do/read/write some sort of data. This kind of closes any type of attack vector based on making the system execute arbitrary code. So I don't see the fuss with autoruns, or some obscure USB sound card buffer overrun - which was fixed the next day : this will not happen.
  - trafficlight 13y ago
    I think you are vastly underestimating how clever would-be attackers can be.

by ccozan 13y ago

nucleardog 13y ago

How do you know the other end of that cable is a mouse unless you dissect the mouse first? How do you know the other end isn't flash storage? How do you know it isn't a USB hub with a flash device also connected so you'll never notice the mouse doesn't work? What if the mouse is set up to present flash storage with auto run only after it has been connected and left idle for at least a few hours? USB is not often exploited... but that just means we currently have few defenses and little for security in place which becomes a concern if we start connecting our homes with it. And to other homes. And businesses.

pjc50 13y ago

Just because a device looks like a mouse doesn't mean it can't contain multiple USB endpoints, one of which is a mass storage device. Example Linux USB exploit: http://charlescurley.com/blog/archives/2011/03/13/linux_usb_vulnerability/ http://charlescurley.com/blog/archives/2011/03/13/linux_usb_...

VLM 13y ago

"How can I put a autorun file on my USB mouse?" LOL its really easy. You've got an empty box of mostly air, so you open it up, solder four wires in parallel, done. All you need is for the victim to plug it in once for a few seconds. Yes this is why its dumb for windows admins not to disable autorun. "can't think that you can own it." The flash contains linux_installation.sh with: #!/bin/bash clear echo Run this file as root to install the closed echo source USB mouse driver for your echo new "whatever" brand USB mouse. (insert lots of stuff most folks won't understand which owns the machine and certainly didn't come from any mouse mfgr) I think you could have hilarious fun on air-gapped networks plugging in wifi dongles and bluetooth dongles mounted inside a USB gadget. How your system responds to gaining a keylogger or another extra HID device or another extra network device would be interesting to watch. Just a COTS keylogger could be interesting.

ccozan 13y ago
just cute. Poor soul, has no idea how USB mice works on linux shakes head. ( appollogizes in advance for the unavoidable ad-hominem comment ).
Smegger 13y ago
if your linux install is autoruning every bash script you have a very serious problem

pornel 13y ago

> How can I put a autorun file on my USB mouse? You make the mouse identify itself as a USB HUB with a mouse, keyboard and a flashdrive. You make it simulate keypresses of Win+R, `F:\exploit.exe`, Enter (or Cmd+space, Terminal, `open /Volumes/pretendmouse/exploit`, etc.) Anything you plug into USB can own your machine, and autorun is not even necessary.

ccozan 13y ago
I think you missunderstood the idea. A smart house system will be invariably an embedded system, and not a generic multi purpouse PC, which you all reply-ers immediatelly implied. There is no need for USB mass storage drivers. It will probably have an own class ( USB-home-automation ) that can only do/read/write some sort of data. This kind of closes any type of attack vector based on making the system execute arbitrary code. So I don't see the fuss with autoruns, or some obscure USB sound card buffer overrun - which was fixed the next day : this will not happen.
- trafficlight 13y ago
  I think you are vastly underestimating how clever would-be attackers can be.