6 ms·

If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://tr

If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI https://trmm.net/EFI

ChuckMcM 12y ago
Well that is not reassuring :-(. Particularly the part about it copying itself to other Thunderbolt devices.
throwaway2048 12y ago
it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when it happens, possibly resulting in action being taken.
- mmaunder 12y ago
  Might be an interesting strategy to only allow one USB port to be used and if any other port is activated the machine self-wipes. Dell servers have an internal port along with the front and back externals.
  - sauere 12y ago
    Or use USB-ID white/blacklists.
    - ossreality 12y ago
      so, the very thing that are fakeable and changeable via these hacks. try agian
    - snuxoll 12y ago
      Because USB VIDs and PIDs can't be spoofed.
- cesarb 12y ago
  The computer in question is a server. If the server were configured to sleep unless the mouse is jiggled, it would already be asleep. Thus, using a "mouse jiggler" or similar is pointless, and risks detection.
  - dlgeek 12y ago
    Wouldn't surprise me if there's some standard procedure for police raids that doesn't distinguish between the two. Keep in mind it's generally not the experts who go out to the various locations.
    - Chronic30 12y ago
      The experts usually brief their soldiers about the tactical plan...
- nsajko 12y ago
  About the jiggler: would the hid driver even be loaded on a server?
  - cesarb 12y ago
    Yes, for the KVM, since not all KVMs use the older PS/2 protocol.
- sweis 12y ago
  Why do you think those USB devices are "pretty likely"? In this case, I would bet on a firmware compromise, similar to DIETYBOUNCE: https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_ant_catalog.pdf https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_... As a countermeasure, I would not fully trust TXT in this particular case. It's likely a state actor who could spoof measurements over the the LPC bus.
  - mike_hearn 12y ago
    TXT doesn't rely on the LPC bus on modern motherboards because the TPM is integrated into the Northbridge. If any government agency can break TXT it'll be the NSA and I don't know if they are in the business of handing out their best exploits to random police teams at the moment.
    - sweis 12y ago
      How "modern" is modern? I understand there are some TPM implementations out there that are on-package, but there are still new servers being sold with TPM headers that I would expect to be easy to interpose. Regardless, this whole thing turned out to be a false alarm due to a KVM device being attached.
- bashinator 12y ago
  That doesn't seem pretty likely at all. It's much more likely that the machine in question is a rack-mount server that never goes to sleep. That said, very good point wrt grsec.
- pgrote 12y ago
  I had no idea the hotplug devices existed. Thank you for posting the link. Has anyone used these in an IT support environment?
- deleted 12y ago
  [deleted]
- iyyappangovid 12y ago
  uyrururu
- iyyappangovid 12y ago
  ijghjg
- Shank 12y ago
  Pretty sure Jake Appelbaum stated at 30c3 that the Mouse Jiggler will cause the system to lock immediately if plugged into Systemd [0]. [0]: https://www.youtube.com/watch?v=vILAlhwUgIU https://www.youtube.com/watch?v=vILAlhwUgIU
  - cesarb 12y ago
    It's the udev rule added by this commit: http://cgit.freedesktop.org/systemd/systemd/commit/?id=7212a8a99ee863698f5feaa00abb4b99f3996a1a http://cgit.freedesktop.org/systemd/systemd/commit/?id=7212a... It runs "loginctl lock-sessions" whenever a USB input device with a name of "Wiebetech LLC Wiebetech" is plugged in.
- zv 12y ago
  How about disabling GPM?
- DonHopkins 12y ago
  Maybe it was a USB Emily Dickenson, or even worse, a USB Slavoj Žižek? http://www.gamespot.com/articles/gdc-panel-tackling-the-emily-dickinson-license/1100-6120167/ http://www.gamespot.com/articles/gdc-panel-tackling-the-emil... >Will Wright, the creative mastermind behind SimCity and The Sims, spoke last, charming the crowd with a fluid mix of academic design insight and brash humor. "I'm convinced that if she was alive today, she'd be an Internet addict," Wright began. Citing television show Futurama as a key influence, Wright presented his idea for an Emily Dickinson desktop agent. Wright explained that, like a mix between Tamagotchi, the Microsoft Paper Clip, and Seaman, the Dickinson agent would be moody, portable, dependent, somewhat annoying, and observant of all your computer-based actions. >Wright envisioned that the agent could be sold on USB memory sticks, in order to cleverly "backdoor" the program to unsuspecting customers. "USB Emily," as Wright dubbed the agent, would then interact with the user via IM, e-mail, and pop-up messages. USB Emily might snoop into the user's programs and documents in order to find keywords to comment upon or send poems about. Over time, the user would "slowly bootstrap a relationship with her." >Referencing some of the emotional problems from which Dickinson suffered, Wright explained, "I want to put the player in the role of her psychotherapist." In one scenario, the player might help USB Emily through her problems and eventually befriend her. But in the two "degenerate cases," USB Emily might either become romantically obsessed with the user (a reference to her often erotic poetry) or fall into a suicidal depression (in which case the program might delete itself). http://games-beta.slashdot.org/story/05/03/10/1723254/emily-dickinson---the-game http://games-beta.slashdot.org/story/05/03/10/1723254/emily-... >Will Wright's was the final design up for consideration, and was a truly inspired idea. It included such charts as the one to the left, showing the overlap between Emily Dickinson readers and GTA players. >Then he put forth his goals. He wanted to have the mood dependency and portability of a Tamagotchi, the helpful/annoyance of Clippy, and the relationship and creepy aspects of seaman. >What he came up with was USB Emily Dickinson. The game would be a small program bundled with a USB memory drive, which is now a large business and an almost impulse buy. The "Emily" program would sit on the drive, and would occasionally interact with you in order to begin to derive an emotional relationship with you. * These interactions would include Instant Messaging, email, and interruptions while writing. Over time, the program would develop a model of behavior depending on how you'd interacted with it. Will's thought was that, while you could eventually get her to a stable state it was more likely that she'd become romantically obsessed with you, or suicidally depressive. In the latter case, he said, she would have the option of deleting herself off the USB drive. >To respect the license idea, again, Wright opined that the program could be adapted for any famous figure, and to have many different USB individuals operating on the same computer. If you had enough ports you could even have them interact with each other through natural language generation. Thus, you could slot drives to view a conversation between Marx, Twain, and Homer Simpson. While all of the ideas were stellar, Wright took home the first prize for the second year in a row.

If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI https://trmm.net/EFI

ChuckMcM 12y ago

Well that is not reassuring :-(. Particularly the part about it copying itself to other Thunderbolt devices.

throwaway2048 12y ago

it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when it happens, possibly resulting in action being taken.

mmaunder 12y ago
Might be an interesting strategy to only allow one USB port to be used and if any other port is activated the machine self-wipes. Dell servers have an internal port along with the front and back externals.
- sauere 12y ago
  Or use USB-ID white/blacklists.
  - ossreality 12y ago
    so, the very thing that are fakeable and changeable via these hacks. try agian
  - snuxoll 12y ago
    Because USB VIDs and PIDs can't be spoofed.
cesarb 12y ago
The computer in question is a server. If the server were configured to sleep unless the mouse is jiggled, it would already be asleep. Thus, using a "mouse jiggler" or similar is pointless, and risks detection.
- dlgeek 12y ago
  Wouldn't surprise me if there's some standard procedure for police raids that doesn't distinguish between the two. Keep in mind it's generally not the experts who go out to the various locations.
  - Chronic30 12y ago
    The experts usually brief their soldiers about the tactical plan...
nsajko 12y ago
About the jiggler: would the hid driver even be loaded on a server?
- cesarb 12y ago
  Yes, for the KVM, since not all KVMs use the older PS/2 protocol.
sweis 12y ago
Why do you think those USB devices are "pretty likely"? In this case, I would bet on a firmware compromise, similar to DIETYBOUNCE: https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_ant_catalog.pdf https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_... As a countermeasure, I would not fully trust TXT in this particular case. It's likely a state actor who could spoof measurements over the the LPC bus.
- mike_hearn 12y ago
  TXT doesn't rely on the LPC bus on modern motherboards because the TPM is integrated into the Northbridge. If any government agency can break TXT it'll be the NSA and I don't know if they are in the business of handing out their best exploits to random police teams at the moment.
  - sweis 12y ago
    How "modern" is modern? I understand there are some TPM implementations out there that are on-package, but there are still new servers being sold with TPM headers that I would expect to be easy to interpose. Regardless, this whole thing turned out to be a false alarm due to a KVM device being attached.
bashinator 12y ago
That doesn't seem pretty likely at all. It's much more likely that the machine in question is a rack-mount server that never goes to sleep. That said, very good point wrt grsec.
pgrote 12y ago
I had no idea the hotplug devices existed. Thank you for posting the link. Has anyone used these in an IT support environment?
deleted 12y ago
[deleted]
iyyappangovid 12y ago
uyrururu
iyyappangovid 12y ago
ijghjg
Shank 12y ago
Pretty sure Jake Appelbaum stated at 30c3 that the Mouse Jiggler will cause the system to lock immediately if plugged into Systemd [0]. [0]: https://www.youtube.com/watch?v=vILAlhwUgIU https://www.youtube.com/watch?v=vILAlhwUgIU
- cesarb 12y ago
  It's the udev rule added by this commit: http://cgit.freedesktop.org/systemd/systemd/commit/?id=7212a8a99ee863698f5feaa00abb4b99f3996a1a http://cgit.freedesktop.org/systemd/systemd/commit/?id=7212a... It runs "loginctl lock-sessions" whenever a USB input device with a name of "Wiebetech LLC Wiebetech" is plugged in.
zv 12y ago
How about disabling GPM?
DonHopkins 12y ago
Maybe it was a USB Emily Dickenson, or even worse, a USB Slavoj Žižek? http://www.gamespot.com/articles/gdc-panel-tackling-the-emily-dickinson-license/1100-6120167/ http://www.gamespot.com/articles/gdc-panel-tackling-the-emil... >Will Wright, the creative mastermind behind SimCity and The Sims, spoke last, charming the crowd with a fluid mix of academic design insight and brash humor. "I'm convinced that if she was alive today, she'd be an Internet addict," Wright began. Citing television show Futurama as a key influence, Wright presented his idea for an Emily Dickinson desktop agent. Wright explained that, like a mix between Tamagotchi, the Microsoft Paper Clip, and Seaman, the Dickinson agent would be moody, portable, dependent, somewhat annoying, and observant of all your computer-based actions. >Wright envisioned that the agent could be sold on USB memory sticks, in order to cleverly "backdoor" the program to unsuspecting customers. "USB Emily," as Wright dubbed the agent, would then interact with the user via IM, e-mail, and pop-up messages. USB Emily might snoop into the user's programs and documents in order to find keywords to comment upon or send poems about. Over time, the user would "slowly bootstrap a relationship with her." >Referencing some of the emotional problems from which Dickinson suffered, Wright explained, "I want to put the player in the role of her psychotherapist." In one scenario, the player might help USB Emily through her problems and eventually befriend her. But in the two "degenerate cases," USB Emily might either become romantically obsessed with the user (a reference to her often erotic poetry) or fall into a suicidal depression (in which case the program might delete itself). http://games-beta.slashdot.org/story/05/03/10/1723254/emily-dickinson---the-game http://games-beta.slashdot.org/story/05/03/10/1723254/emily-... >Will Wright's was the final design up for consideration, and was a truly inspired idea. It included such charts as the one to the left, showing the overlap between Emily Dickinson readers and GTA players. >Then he put forth his goals. He wanted to have the mood dependency and portability of a Tamagotchi, the helpful/annoyance of Clippy, and the relationship and creepy aspects of seaman. >What he came up with was USB Emily Dickinson. The game would be a small program bundled with a USB memory drive, which is now a large business and an almost impulse buy. The "Emily" program would sit on the drive, and would occasionally interact with you in order to begin to derive an emotional relationship with you. * These interactions would include Instant Messaging, email, and interruptions while writing. Over time, the program would develop a model of behavior depending on how you'd interacted with it. Will's thought was that, while you could eventually get her to a stable state it was more likely that she'd become romantically obsessed with you, or suicidally depressive. In the latter case, he said, she would have the option of deleting herself off the USB drive. >To respect the license idea, again, Wright opined that the program could be adapted for any famous figure, and to have many different USB individuals operating on the same computer. If you had enough ports you could even have them interact with each other through natural language generation. Thus, you could slot drives to view a conversation between Marx, Twain, and Homer Simpson. While all of the ideas were stellar, Wright took home the first prize for the second year in a row.