3 ms·

Are there any kind of restrictions or requirements that would ensure that a random embedded USB flash drive in the side of a wall in a dark alley would not cont

Are there any kind of restrictions or requirements that would ensure that a random embedded USB flash drive in the side of a wall in a dark alley would not contain BadUSB exploits, keyloggers, etc.? I kinda assumed initially that this was an extension of the creator's original art project, but it seems like people are actually using these--the security concerns far outweigh the novelty, in my mind.

ajford 12y ago
Came here to say the same thing. With BadUSB and other such exploits, what a way to get pwned.
deleted 12y ago
[deleted]
jzelinskie 12y ago
There are "USB condoms"[0] that let you only use the power pins of USB, but sadly that is not applicable to this concept. [0]: http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms
pavel_lishin 12y ago
I'm going to assume that there's no way for the creator to enforce this, anyway - but is there any way to access one of these without endangering your machine? I'd rather not use a burner-laptop every time I try to see what's on these guys.
- x1798DE 12y ago
  I'd say it's pretty risky either way, but you could insulate yourself from risk somewhat by using a raspberry pi with a fresh image on the SD card each time. Also, if it's possible to run a raspberry pi from a write-protected SD card (and assuming that SD-card write-protection hardware switches are actual hardware disables not something that just sets a flag that the software can ignore), then you may not need to clean the SD card every time either.
- baddox 12y ago
  I would assume that it's possible, especially with a Linux laptop, to prepare a USB port to simply mount a drive and not do any of the other magic (like installing human interface devices, or whatever) that leads to vulnerabilities.
admax88q 12y ago
Assuming you could get a secure USB controller. It should be possible to tell the OS to only allow a USB Mass Storage device to connect on a particular bus for a particular period of time.

ajford 12y ago

Came here to say the same thing. With BadUSB and other such exploits, what a way to get pwned.

deleted 12y ago

[deleted]

jzelinskie 12y ago

There are "USB condoms"[0] that let you only use the power pins of USB, but sadly that is not applicable to this concept. [0]: http://int3.cc/products/usbcondoms http://int3.cc/products/usbcondoms

pavel_lishin 12y ago

I'm going to assume that there's no way for the creator to enforce this, anyway - but is there any way to access one of these without endangering your machine? I'd rather not use a burner-laptop every time I try to see what's on these guys.

x1798DE 12y ago
I'd say it's pretty risky either way, but you could insulate yourself from risk somewhat by using a raspberry pi with a fresh image on the SD card each time. Also, if it's possible to run a raspberry pi from a write-protected SD card (and assuming that SD-card write-protection hardware switches are actual hardware disables not something that just sets a flag that the software can ignore), then you may not need to clean the SD card every time either.
baddox 12y ago
I would assume that it's possible, especially with a Linux laptop, to prepare a USB port to simply mount a drive and not do any of the other magic (like installing human interface devices, or whatever) that leads to vulnerabilities.

admax88q 12y ago

Assuming you could get a secure USB controller. It should be possible to tell the OS to only allow a USB Mass Storage device to connect on a particular bus for a particular period of time.