6 ms·

Dead Drops

29 points by zhte415 12y ago

Practicality 12y ago
This seems like a great way to share viruses.
- leohutson 12y ago
  Yes, it seems like the computing equivalent of a glory hole.
exelius 12y ago
Seeing as this project is 5 years old, I'm curious how many of these are still functioning? None, I would guess, since it seems like more of an art project... but still, I'm a little curious. Is anyone close to any of these that could test them out?
- pavel_lishin 12y ago
  I'll try to find some of the ones in New York. It would be nice if there was a "confirm" button, to confirm that the drop was still present. (Maybe just clicking "submit" while the dropdown says "working" does it? Don't want to test this.)
- hamitron 12y ago
  I embedded one into a wall in my neighborhood. It lasted about two weeks before it completely oxidized.
  - exelius 12y ago
    That's about what I had thought would happen.
AdmiralAsshat 12y ago
Are there any kind of restrictions or requirements that would ensure that a random embedded USB flash drive in the side of a wall in a dark alley would not contain BadUSB exploits, keyloggers, etc.? I kinda assumed initially that this was an extension of the creator's original art project, but it seems like people are actually using these--the security concerns far outweigh the novelty, in my mind.
- ajford 12y ago
  Came here to say the same thing. With BadUSB and other such exploits, what a way to get pwned.
- deleted 12y ago
  [deleted]
- jzelinskie 12y ago
  There are "USB condoms"[0] that let you only use the power pins of USB, but sadly that is not applicable to this concept. [0]: http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms
- pavel_lishin 12y ago
  I'm going to assume that there's no way for the creator to enforce this, anyway - but is there any way to access one of these without endangering your machine? I'd rather not use a burner-laptop every time I try to see what's on these guys.
  - x1798DE 12y ago
    I'd say it's pretty risky either way, but you could insulate yourself from risk somewhat by using a raspberry pi with a fresh image on the SD card each time. Also, if it's possible to run a raspberry pi from a write-protected SD card (and assuming that SD-card write-protection hardware switches are actual hardware disables not something that just sets a flag that the software can ignore), then you may not need to clean the SD card every time either.
  - baddox 12y ago
    I would assume that it's possible, especially with a Linux laptop, to prepare a USB port to simply mount a drive and not do any of the other magic (like installing human interface devices, or whatever) that leads to vulnerabilities.
- admax88q 12y ago
  Assuming you could get a secure USB controller. It should be possible to tell the OS to only allow a USB Mass Storage device to connect on a particular bus for a particular period of time.
pavel_lishin 12y ago
The map search doesn't seem to work at all - "New York City, NY" decodes to 0.00, 0.00, apparently. Also, the full-size image for the Union Square Dead Drop[1] is ... not very full-size: https://deaddrops.com/db/images/fullsize/32/935838.jpg https://deaddrops.com/db/images/fullsize/32/935838.jpg [1] https://deaddrops.com/db/?page=view&id=32 https://deaddrops.com/db/?page=view&id=32
fiatjaf 12y ago
For a more interesting project that resembles a "anonymous, offline, peer to peer file-sharing network in public space" -- but is in fact much more useful, see Edgenet: proposal: http://cultureandempire.com/html/edgenet.html http://cultureandempire.com/html/edgenet.html slides: http://cultureandempire.com/edgenet.html#/2/1 http://cultureandempire.com/edgenet.html#/2/1 (funded) indiegogo project: https://www.indiegogo.com/projects/edgenet https://www.indiegogo.com/projects/edgenet
- nosuchthing 12y ago
  • LibraryBox [1] is an open source, portable digital file distribution tool based on inexpensive hardware that enables delivery of educational, healthcare, and other vital information to individuals off the grid. [1]http://librarybox.us/ http://librarybox.us/ • PirateBox [2] is a DIY anonymous offline file-sharing and communications system built with free software and inexpensive off-the-shelf hardware. [2] http://piratebox.cc/ http://piratebox.cc/
hamitron 12y ago
the piratebox project is much better http://piratebox.cc http://piratebox.cc
api 12y ago
This has been around for a while, and given the vulnerabilities in USB stacks and OSes is somewhat dangerous. When it appeared over at Reddit someone called it a "USB glory hole." Same thing applies to chargers in public places. You never know whether it's just a charger.
- baddox 12y ago
  Do the "charge-only" USB cables fix this vulnerability? e.g. http://www.amazon.com/PortaPow-Micro-USB-Cable-Charging/dp/B0088HTYUE http://www.amazon.com/PortaPow-Micro-USB-Cable-Charging/dp/B...
  - detaro 12y ago
    For chargers, yes. For getting data of a "dead drop", obviously not, and also not if someone connects high voltage or something crazy like that. Or someone manages to exploit the power management system by turning power on and off in just the right way, but that seems far-fetched.
- devindotcom 12y ago
  These 'USB condoms' seemed like a novelty at first but now I'm thinking they're going to be standard travel gear. http://syncstop.com/ http://syncstop.com/ formerly http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms
ripter 12y ago
Every one I've tried in SF doesn't exist anymore.
joefiddy 12y ago
Why not use a burner running Linux?

Dead Drops

29 points by zhte415 12y ago

Practicality 12y ago

This seems like a great way to share viruses.

leohutson 12y ago
Yes, it seems like the computing equivalent of a glory hole.

exelius 12y ago

Seeing as this project is 5 years old, I'm curious how many of these are still functioning? None, I would guess, since it seems like more of an art project... but still, I'm a little curious. Is anyone close to any of these that could test them out?

pavel_lishin 12y ago
I'll try to find some of the ones in New York. It would be nice if there was a "confirm" button, to confirm that the drop was still present. (Maybe just clicking "submit" while the dropdown says "working" does it? Don't want to test this.)
hamitron 12y ago
I embedded one into a wall in my neighborhood. It lasted about two weeks before it completely oxidized.
- exelius 12y ago
  That's about what I had thought would happen.

AdmiralAsshat 12y ago

Are there any kind of restrictions or requirements that would ensure that a random embedded USB flash drive in the side of a wall in a dark alley would not contain BadUSB exploits, keyloggers, etc.? I kinda assumed initially that this was an extension of the creator's original art project, but it seems like people are actually using these--the security concerns far outweigh the novelty, in my mind.

ajford 12y ago
Came here to say the same thing. With BadUSB and other such exploits, what a way to get pwned.
deleted 12y ago
[deleted]
jzelinskie 12y ago
There are "USB condoms"[0] that let you only use the power pins of USB, but sadly that is not applicable to this concept. [0]: http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms
pavel_lishin 12y ago
I'm going to assume that there's no way for the creator to enforce this, anyway - but is there any way to access one of these without endangering your machine? I'd rather not use a burner-laptop every time I try to see what's on these guys.
- x1798DE 12y ago
  I'd say it's pretty risky either way, but you could insulate yourself from risk somewhat by using a raspberry pi with a fresh image on the SD card each time. Also, if it's possible to run a raspberry pi from a write-protected SD card (and assuming that SD-card write-protection hardware switches are actual hardware disables not something that just sets a flag that the software can ignore), then you may not need to clean the SD card every time either.
- baddox 12y ago
  I would assume that it's possible, especially with a Linux laptop, to prepare a USB port to simply mount a drive and not do any of the other magic (like installing human interface devices, or whatever) that leads to vulnerabilities.
admax88q 12y ago
Assuming you could get a secure USB controller. It should be possible to tell the OS to only allow a USB Mass Storage device to connect on a particular bus for a particular period of time.

pavel_lishin 12y ago

The map search doesn't seem to work at all - "New York City, NY" decodes to 0.00, 0.00, apparently. Also, the full-size image for the Union Square Dead Drop[1] is ... not very full-size: https://deaddrops.com/db/images/fullsize/32/935838.jpg https://deaddrops.com/db/images/fullsize/32/935838.jpg [1] https://deaddrops.com/db/?page=view&id=32 https://deaddrops.com/db/?page=view&id=32

fiatjaf 12y ago

For a more interesting project that resembles a "anonymous, offline, peer to peer file-sharing network in public space" -- but is in fact much more useful, see Edgenet: proposal: http://cultureandempire.com/html/edgenet.html http://cultureandempire.com/html/edgenet.html slides: http://cultureandempire.com/edgenet.html#/2/1 http://cultureandempire.com/edgenet.html#/2/1 (funded) indiegogo project: https://www.indiegogo.com/projects/edgenet https://www.indiegogo.com/projects/edgenet

nosuchthing 12y ago
• LibraryBox [1] is an open source, portable digital file distribution tool based on inexpensive hardware that enables delivery of educational, healthcare, and other vital information to individuals off the grid. [1]http://librarybox.us/ http://librarybox.us/ • PirateBox [2] is a DIY anonymous offline file-sharing and communications system built with free software and inexpensive off-the-shelf hardware. [2] http://piratebox.cc/ http://piratebox.cc/

hamitron 12y ago

the piratebox project is much better http://piratebox.cc http://piratebox.cc

api 12y ago

This has been around for a while, and given the vulnerabilities in USB stacks and OSes is somewhat dangerous. When it appeared over at Reddit someone called it a "USB glory hole." Same thing applies to chargers in public places. You never know whether it's just a charger.

baddox 12y ago
Do the "charge-only" USB cables fix this vulnerability? e.g. http://www.amazon.com/PortaPow-Micro-USB-Cable-Charging/dp/B0088HTYUE http://www.amazon.com/PortaPow-Micro-USB-Cable-Charging/dp/B...
- detaro 12y ago
  For chargers, yes. For getting data of a "dead drop", obviously not, and also not if someone connects high voltage or something crazy like that. Or someone manages to exploit the power management system by turning power on and off in just the right way, but that seems far-fetched.
devindotcom 12y ago
These 'USB condoms' seemed like a novelty at first but now I'm thinking they're going to be standard travel gear. http://syncstop.com/ http://syncstop.com/ formerly http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms

ripter 12y ago

Every one I've tried in SF doesn't exist anymore.

joefiddy 12y ago

Why not use a burner running Linux?