Slashdot Mirror
USB Autorun Attacks Against Linux
Orome1 writes "Many people think that Linux is immune to the type of Autorun attacks that have plagued Windows systems with malware over the years. However, there have been many advances in the usability of Linux as a desktop OS — including the addition of features that can allow Autorun attacks. This Shmoocon presentation by Jon Larimer from IBM X-Force starts off with a definition of autorun vulnerabilities and some examples from Windows, then jumps straight into the Linux side of things. Larimer explains how attackers can abuse these features to gain access to a live system by using a USB flash drive. He also shows how USB as an exploitation platform can allow for easy bypass of protection mechanisms like ASLR and how these attacks can provide a level of access that other physical attack methods do not." I've attached the video if you are curious. Skip the first 2 minutes if you don't care where the lost and found is.
I always knew that when they made *nix idiot-proof all hell would break loose security-wise. Android has proven that really thoroughly. It's too bad, really. I had high hopes for it once. Maybe they'll get it together yet though.
Caveat Utilitor
Autorun as a concept just sucks.
Copying whatever Windows does, warts and all, into Linux, just sucks.
When is this insanity going to end?
Any system is vulnerable when it automatically opens or executes email attachments, automatically executes arbitrary commands delivered on a removable volume, and hides file name extensions to fool users into executing things that looked like something harmless.
Any software vendor who thinks about adding such features should receive a savage thrashing. If they actually enable such features by default, they should be shot with prejudice.
--Udo.
Anybody want to post a quick-fix to avoid turn off AutoRun in Ubuntu?
I'm not a lawyer, but I play one on the Internet. Blog
Hip-hip-horray !!
Hip-hip-horray !!
Hip-hip-horray !!
We are movin' on up, to the east side
To the deluxe apartment in the skyyyy
MoooVin' on up, yeah !!
Comment removed based on user account deletion
Auto-run is convenient and all but systems should NOT automatically execute content from devices unless the user has specifically told them it's okay.
A recommendation for out-of-the-box "autorun" experience:
Query the type of the media, but do so without running any code of any type on the media.
Authenticate the data used to determine the type of the media AND any "auto run" code typically associated with that type of media OR decide you can't authenticate it.
Present a box to the user for "trusted" content:
This disk claims that it contains [a program | music | video | files | whatever ]. This claim is sign by [company] and its chain-of-authentication includes [highest-level signer], a company trusted by [operating system vendor | you]. To see more details click [here].
What do you want to do? [list of choices, including "do nothing," "open as a folder," "run the disk" (aka autorun), "play music," "play video," etc.]
[ X ] Do the same for other media of this type signed by this signer.
[ _ ] Do the same for other media of this type signed by any trusted signer.
[ _ ] Do the same for other media of this type even if it is not signed.
Present a box to the user for signed content that cannot be authenticated:
WARNING: This disk claims that it contains [a program | music | video | files | whatever ]. This claim is sign by [company] but this signature cannot be authenticated. To see more details click [here].
What do you want to do? [list of choices, including "do nothing," "open as a folder," "run the disk" (aka autorun), "play music," "play video," etc.]
[ _ ] Trust this signer in the future.
[ _ ] Do the same for other media of this type signed by this signer.
[ _ ] Do the same for other media of this type signed by any trusted signer.
[ _ ] Do the same for other media of this type even if it is not signed.
Present a box to the user for unsigned content, which would typically be "unlabeled" content that the computer has to figure out for itself:
This disk appears to contain [a program | music | video | files | whatever ].
What do you want to do? [list of choices, including "do nothing," "open as a folder," "run the disk" (aka autorun), "play music," "play video," etc.]
[ _ ] Do the same for other media of this type [bold]NOT recommended[/bold]
Almost all media would be "unsigned" until a standardized method of signing is developed. Signing would typically only authenticate the type of media the disk claimed to as well as the executable code of any autoexec.exe-type program that runs if the user "runs the disk" or any media-type-specific on-disk code that runs if the user "plays the media," not the entire disk.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Linux servers, that run on command line don't have these issues. I know this is shocking to some people, but 99.99% of the world doesn't really give a shit about what you have on your home pc's hard drive. Security is good, but paranoia isn't. Anyone that actually cares about safeguarding their data won't be running a server with a GUI on it anyway. Even the Apache Foundation had to learn this the hard way.
No tool will ever be safe in the hands of somone who does not know how to use it, let alone what it actually does. I am not saying computers should be made deliberatly archane, but to much effort is put into concealing what they do and removing the need to learn anything about how to operate one. The more we enable the ignorate the poorer the outcome will be. Case in point identity theft and data leaks are a growing problem not a shrinking one dispite awareness of the risk. I would say the likely cause of that is more people are doing more with computerized information without an understanding of the conseqences.
Has there really ever been anyone responsible for Linux making claims of "the year of Linux"? Or has it just been some random users that once made a reference?
You can lead a man with reason but you can't make him think.
It appears to me that Linux may have started thinking about focusing all it's efforts on being a more stable, secure OS, but to gain acceptance in a more mass market, they need to do things that, while they reduce security, increase their general user base. Sure, it's Linux, so you can strip it down to near nothing and have a rock-solid, dependable, secure system designed for a specific hardware setup, but if they want to stay alive, they may need to realize that they need less secure measures that allow the typical end-user to use their OS behind the scenes without any extra effort on their part. TLDR:To (Probably most) people, ease of use is more important than security, and some software developers working around Linux may be seeing that. However, being Linux, the hardcore can always build their system to be the fort Knox of data. If anything, this is a good thing IMO. Keep the security-conscious aware of issues, but let the average end-user go about their business as they will.
Doesn't depend on platform. Autorun is always a huge security risk. It was invented for lazy users that do not want to know how to use their computer properly. At this time (and for the foreseeable future) this kind of laziness comes at a price and that is vulnerability to rather simple to execute attacks.
The real benefit of Linux here is that, unlike Windows, you can get distributions that would not dream of implementing something as stupid as autorun. On others, you can reliably turn it off reliably without a cryptic adventure through the mess called the "registry". But implementing insecure features will of course make Linux insecure. Nobody sane debates that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Remember it?
Step 1. Insert target drive to be backed up.
Step 2. Format wrong target
Step 3. Backup wrong Drive
Step 4. Realize something is wrong
4a try to recover for 24 hours
4b realize something is whacked bad
Step 5. Freak out and start removing the wrong drive
Step 6. Insert Wrong Drives again because of losing track
Step 7. Backup Wrong Size Drive to Wrong Drive
Step 8. Realize all original drives have been formatted several times
Step 9. Invite friend with computers over
Step 10. Offer a drink and tell your story while setting up
Step 11. Format his own drive and mistakenly think you have an old backup which fails to boot
Step 12. Get a sharpie marker and Start marking the drives up
Step 13. Invite more friends to assist
Step 14. Look for even more people with boot stick repair experience
Step 15. Try a Linux Demo
Step 16. Everyone tries and goes home with data loss and different linuxs
Step 17. Profit at every other step.
this is why i disable it. autorun is the worst thing to happen to windows
I never liked the "linux is more secure" sentimentality.
When Linux was small, streamlined, highly optimized for specific purposes, its hard to attack.
But as you make Linux more user friendly, feature rich, easier to use, it becomes easier to attack.
The Linux/Open Source community just doesn't understand this. Making something with 10 features makes it easier to secure and overall more stable and better performing. Adding 100 features makes it prone to security and stability issues. About the hardest thing to do in software design is to make software "idiot" proof. I firmly believe there is a correlation between software ease of use and software complexity. As you make software easier to use, the code complexity grows exponentially. The amount of effort required to protect people from themselves is incredible. I think most Open Source projects are starting to realize that as you try to match long entrenched retail software feature for feature, you can't keep claiming you are better then the rest, eventually you become just like the rest.
We have seen this as FireFox has evolved. Initially a small, streamlined browser, now becoming slow and bloated and prone to security issues the more features and content they add.
Of course everybody complained about how insecure and poor performing Windows has been, but few realized that Windows is the easiest to use OS in use today and so is more feature rich and prone to problems then something like Linux, which traditionally has been a difficult OS to use by the average computer user. As companies like Ubuntu try to make Linux "nice" they are running into the same issue as Microsoft has had over the years.
Sorry, not to start a flame war or anything, but the reality is that so many people underestimate the effort required to make something like Windows which, for better or worse, outnumbers all other OS installations on the order of thousands to 1. The world runs on Windows and I think it is short sighted and narrow-minded to assume that Linux is a 1:1 replacement to Windows. Its not. And as Linux evolves it will hit the same growing pains as Microsoft has had, people might come to realize the effort required to produce something like Windows.
And don't suggest that features like this need to be removed, or the OS "smartened" up so it requires more intelligence to use. Realize that the single biggest reason why no other OS is actually gaining market share on Windows is just that no other OS has reached Windows on ease of use. Sure, I know, some of you are going on about how many years you used Linux or OS X, but these operating systems are, for the uninitiated, a pain in the ass to use compared to Windows.
Bottom line is, if you want your favourite OS to stay at 5%, then suggest to remove these features. If you ever want Linux to surpass Windows then it going to have to be used by the masses, idiots and all, but you can't have it both ways. There is no way to maintain an OS as something for elite users while also making it safe and secure and easy to use for everyone else. You can't claim that Linux > Windows and then suggest it remove features Windows has had for years.
MS *tried* to fight it (in part) by effectively adding a GUI sudo prompt into Windows Vista. A million people -- including Linux users posting on Slashdot -- immediately flew into fits of nerd rage about how annoying it was to have a GUI sudo prompt. (I never saw an issue with it myself, actually. Seemed no more irritating than going sudo on Linux or OSX's own authentication prompt. Unlike many, I actually really quite liked Vista, although I use OSX most of the time.) MS listened to their users and allowed them to scale it back in Windows 7, creating a million new security holes and causing a million people -- including Linux users posting on Slashdot, although not necessarily the same ones -- to complain about security flaws in Windows.
MS have made many stupid mistakes over their history and not least due to the ancient and creaking XP (and, even worse, the immediately-owned ME) have a history of shit security. Thing is they tried to patch it up in an easy way and people bitched and puled enough that they had to make it less secure again.
That, of course, ignores the other few million security flaws riddling the kernel. I'm just talking about the UAC here.
Smart distros default auto-run settings to disabled.
I think people think he's referring to autorun when I believe what he's talking about is more the "hot-plugging" ability of usb. I.e. I plug in a USB device and some linux kernel device code gets run. These are standard hardware vulnerabilities, it's just that most hardware can't be plugged into a computer as easily as usb.
Linux still has the antiquated "user, group, everyone" security model from the 1970s. By now, we know that outside data can't be given all the privileges of the user. But Linux's legacy security model is so deeply embedded in the UNIX/Linux world that it's almost impossible to get beyond that.
Yes, there's SELinux. But there isn't a whole distribution with a full range of applications which can run under a mandatory security model.
Then your machine is not secure. It's really that simple.
Maybe OT, but here's MS's information for controlling this "feature" in Windows.
There've been various sets of instructions and registry hacks floating around, but this appears to be from the horse's mouth, relatively recently updated, and addresses some of the shortcomings of previous fixes.
Article ID: 967715 - Last Review: September 9, 2010 - Revision: 6.2
How to disable the Autorun functionality in Windows
http://support.microsoft.com/kb/967715
(I'm posting this due to the confusion all the various instructions / search results can create, and because this article addresses Autoruns and so I expect a number of Windows users will be having a look out of curiosity.)
It doesn't even recognise my thumb drive, so I don't have to worry about security
I didn't watch the video but on my system to make any significant changes such as install something a program superuser access is required. Without me entering my password for a program to do something the most it can do it mess around with pretty trivial stuff.
I care not for your karma and your mod points.
It was quite popular about 8-10 years ago for various media outlets to declare the "year of the Linux Desktop". I can't be arsed to look up specific examples, but they definitely existed. The irony being that Linux has improved dramatically as a desktop OS since most of those claims were widely circulated, yet no one expects it anymore. As far as I can tell, three things have ended the hype:
1) Probably most important: People have realized that what most desktop users want is something Linux will probably never give them. Hand holding and a person to call when things break. Windows' monopoly created a huge pool of reasonably skilled amateur technicians; as well as an ecosystem of professionals ranging from the guy with fliers on the apartment bulletin board, to Best Buy's Geek Squad, to highly skilled consultants and everything in between. Apple answered that with their Genius Bar and highly rated customer service. Linux has answers to it as well, but people don't like searching web sites and such. Red Hat and a few others actually have excellent customer service and tech support, but buying from them (in small volumes, they're way cheaper than MS for high volume sales) makes Linux as expensive as Windows.
2) A credible alternative to Windows on the Desktop emerged in OSX. Sure the hardware is kinda premium, but Apple released an easy to use Unix based OS on fairly affordable hardware. They also tied this with the launch of their retail stores and Genius Bars which provided the kind of hand holding and quick fix solutions that people are used to on Windows.
3) Software and hardware vendors never saw value in cooperating. Next to to the lack of hand holding, this is probably the biggest issue. No thanks to the vendors, the hardware situation is much better than it used to be, but software remains a major hurdle. There are analogs and replacements for a lot of stuff, but they're rarely quite as good, always require a learning curve (on top of learning the new OS), and often times have file conversion issues. Apple got around this because they've always been Microsoft's "see, we're not a really a monopoly" hitching post so a lot of vendors (including MS themselves) have always maintained a MacOS version. Apple's recent success just means that they're making money on it.
So now the Linux vendors concentrate on the server space (which has always been their strength), while producing steadily more polished Desktop OSes that don't get nearly the hype they used to. Meanwhile increasing numbers of tablets, smartphones, and PDAs may make the whole thing irrelevant in ten years. Not that desktop or laptop computers are going anywhere, but portable platforms will probably overtake them in usefulness for non-technical people at some point in the next decade.
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
Anyone care to post a demo of this Linux autorun vulnerability, one that will compromise my system by inserting a USB device, and with no user confirmation required, and doesn't prompt for the root password ..
Is anybody else annoyed by the "There is a CD with a software update in the drive" or some such when you leave the installation CD in?
Can you please turn that off Canonical? This just begs for an exploit.
thegodmovie.com - watch it
"Linux still has the antiquated "user, group, everyone" security model from the 1970s"
Apple OS X is based on Unix and uses the same antiquated security model as Linux :)
Both Slashdot and the presenter should have been more accurate in the title of the presentation. ( I mean you by CmdrTaco )
Since the search results mostly go to the video, here's a blog which includes link to the slides and some discussion http://blogs.iss.net/archive/Shmoocon2011.html
I actually watched this presentation live, and it is definitely worth checking out. Although this is a good presentation, it's not exactly the hack of the century. The guy still hasn't actually found a way around AppArmor yet so this doesn't work with machines with it enabled. Furthermore, the exploit requires local access to the machine AND have a user account already logged in.
I'm sure 99% of you already know how to do this, but if anyone is interested in protecting themselves from this type of attack regardless simply:
1. Open a Nautilus window.
2. Edit -> Preferences. Go to the Media tab.
3. Uncheck the box that is labeled "Browse media when inserted".
I feel like they're follow Windows' tail lights over a cliff.
This sort of mentality is ruining Linux distributions.
If I wanted a dumbed-down buggy system, I'd use Windows.
Competition Good, Monopoly Bad.
Autorun plagues windows? Do people still move files from computer to computer via disc? By default this feature is either turned off or there's a popup asking if you want to run whatever it is that's trying to run. The last time I got a virus from autorun was probably on windows 98, maybe even 95.
Almost every comment here is concentrating on "Autorun" i.e. automatic execution of scripts/executables on media and ignoring the main focus of the talk, which is about exploiting bugs in the way the file-manager handles previews of image, PDF, DVI files etc. situated on the media. More generally he talks about the possibilities of exploiting vulnerabilities in every layer involved when automatically handling inserted media, from device discovery, device drivers, file-system drivers, up to and including the file-manager.
Unless we're all conflating "autorun" with "automount & show the media in a file-manager" now?
While he talks about the possibility of driver vulnerabilities and means to exploit them (e.g. a USB device which claims to be a member of a class for which you have found an exploitable driver, but sends corrupt data as an exploit and payload), the exploit demonstrated works by:
-GNOME's stupid default of auto-mounting (KDE just shows you that a device has been plugged in, you have to click it to have it mounted), even when the screensaver is locked
-Opening a nautilus window on the mounted filesystem (again, even when the screensaver is locked)
-Vulnerabilities in a file parser (in this case for dvi files) specific to the PDF viewer
-The ability to kill the screensaver process quite trivially
The thumbnailer was protected by AppArmor, and while he disabled AppArmor for the demo, reckons he could have got around AppArmor with a bit more time.
I use KDE, because the extra "usability" of saving one click is not worth the risk imposed by auto-previewing files without me having the option to say no.
Linux still has the antiquated "user, group, everyone" security model from the 1970s.
Yes, there's SELinux. But there isn't a whole distribution with a full range of applications which can run under a mandatory security model.
Actually, the Unix model is so ingrained in all Unix platforms, that getting users who expect broken Unix off it (on Linux) is difficult, and they want the insecurity and convenience of Mac OS X.
And, for the demo, the speaker actually had disabled AppArmor, because with it enabled, his exploit didn't work. He said he would have been able to get around AppArmor (due to one or two controls that we not enforced on the thumbnailer) with sufficient time.
If you look into how modern distros control device permissions (e.g. on /dev/snd/pcmC0D0p ) you may find they make use of ACLs to allow lists of users access to things (without resorting to groups). However this gets complicated fast.
Additionally, a number of Linux security modules (SELinux, Apparmor, TOMOYO) alloow the use of common apps under a MAC model. Fedora really does run out of the box under SELinux after all.
However, I feel that what is needed is the ability to disclaim privileges even when running as a normal user. There is experimental user namespace work on Linux that w allow unprivileged users to create namespaces which may in the future provide such an ability.
4) Games.
That's all I use my PC for that requires Windows. E-mail, web, I can get by with almost anything... The only reason I upgraded to Vista was games... I was perfectly happy with win2k as a desktop PC. I don't need, nor care about a polished UI, I just want it functional.
I bought my current PC with the intention of dual booting Linux. However, I went with a fakeraid stripe setup (which resulted in Vista booting to usable in 15 seconds from bootmenu, I kept my old win2k partition), and at that time none of the Linux distros supported it without lots of tinkering. I've not got round to installing it since, since I don't need it (though I have bought another HD for it).
Ahh ok. I really hate videos as conveyors of information. I was just flipping around and found his bit about using a usb device with the kernel exploit.
It's still more inline with the kernel driver exploit than with the way Windows autorun used to be exploitable.
um - they have obviously never seen average user responding the program prompts - when they don't expect one they read it, when they do expect one they just press yes - sometimes you are even lucky and they understand what the unexpected prompt means
Well that's the nice thing about Linux though. No one is forcing you to use those features.
"many advances ... including the addition of features that can allow Autorun attacks"
This sounds like a bug, not an advance. Unless you work at Microsoft.
I think this problem, and the reason why we still have auto run, is that it's assumed that having physical access to a machine is an endgame situation. With that assumed to be true, the thinking goes, why not make content open themselves for the convenience of the user? That's why auto run and other services should be disabled during deployment in a business setting.
....comments, the simple truth is that autorun was a dumb idea, period.
Also, it can only get user-space access, thats the whole point.
People run linux because of retarded shit like that on Windows. Don't replicate the problem.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I'm not so sure I trust BSD code to be secure.
^^vv<><>BA
But haven't we, on Slashdot and elsewhere, long since held that when somebody has physical access to their target machine, it's game over, anyway?
This seems to be a socially-engineered version of physical access: the attacker herself may not have direct physical access to the target machine, but they've used social engineering on someone who does to do what they want.
Why is it surprising that this can indeed lead to a machine being compromised?
Data isn't given the privs of the user. It's given the permissions of the file and the APPLICATON has the privileges of the user.
I.e. Read permission means that it can be read by the user.
It's worse for Windows since that doesn't have UGO permissions. And getting beyond the DOS permissions is almost impossible, since that permissions paradigm of DOS is deeply embedded in the Windows/PC world.
By the way, in what way is UGO busted? The Wheel is antiquated, but it doesn't mean the wheel is useless.
Can anyone good with linux, tell me if
a) you can disabe the autorun options by default...
b) can anyone tell me if you can have something like tripwire tell you when a side OS is runnning trying to mess with your setup?
thank you..
Here's a better one: http://windowssecrets.com/2007/11/08/02-One-quick-trick-prevents-Autorun-attacks
Thanks to whomever originally posted this.
This isn't a Linux vulnerability, it's a shitty distribution vulnerability. Don't use distros designed for idiots, and you won't have a problem with this.
You said "large collection". Thumbnailing that is too damn slow. (and always will be, because images get bigger) I want a responsive UI.
Many of the comments are just flaming ubuntu for this, but Larimer states this is a GNOME issue. He used ubuntu because it was one of the most popular distributions.
When these bugs get fixed upstream "we'll be all right"
This is a great reason to NOT have a auto mount enabled. Don't get me wrong I do enjoy auto-mount but at the same time it has a good deal of risk with it because you can't unintentionally mount a FS you didn't mean to.