undefined | Better HN

0 pointsbee_rider5mo ago0 comments

I don’t disagree.

But, haven’t there been bugs where operating systems will auto run some executable as soon as the USB is plugged in? So, just to be paranoid, I’d classify just plugging the thing in as “running random executables.” At least as a non-security guy.

I wonder if anyone has tried going to a local staples or bestbuy something, and slipping the person at the register a bribe… “if anyone from so-and-so corp buys a flash drive here, put this one in their bag instead.”

Anyway, best to just put glue in the USB ports I guess.

0 comments

tsimionescu5mo ago

Even if the OS doesn't have any bad security practices and doesn't do this, there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal. As long as the computer is unlocked, this will work, and will easily get full local user access, even defeating UAT or similar measures. It can then make itself persistent by "typing in" a malicious script, and going further from there.

lmm5mo ago

> there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal

Good systems these days won't accept such a "keyboard" until it's approved by the user.

tsimionescu5mo ago

Which systems ask before allowing you to use a keyboard you just plugged in over USB? Windows, Ubuntu, Fedora certainly don't, at least not by default.

2 more replies

throwaway1737385mo ago

Good luck doing hardware development without USB ports, as the IT team at my employer recently found out.

vhcr5mo ago

Second best option is to whitelist USB's PID and VID.

j / k navigate · click thread line to collapse

0 pointsbee_rider5mo ago0 comments

I don’t disagree.

Anyway, best to just put glue in the USB ports I guess.

0 comments

tsimionescu5mo ago

lmm5mo ago

> there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal

Good systems these days won't accept such a "keyboard" until it's approved by the user.

tsimionescu5mo ago

Which systems ask before allowing you to use a keyboard you just plugged in over USB? Windows, Ubuntu, Fedora certainly don't, at least not by default.

2 more replies

throwaway1737385mo ago

Good luck doing hardware development without USB ports, as the IT team at my employer recently found out.

vhcr5mo ago

Second best option is to whitelist USB's PID and VID.

j / k navigate · click thread line to collapse