Slashdot Mirror
USB Autorun Attacks Against Linux
Orome1 writes "Many people think that Linux is immune to the type of Autorun attacks that have plagued Windows systems with malware over the years. However, there have been many advances in the usability of Linux as a desktop OS — including the addition of features that can allow Autorun attacks. This Shmoocon presentation by Jon Larimer from IBM X-Force starts off with a definition of autorun vulnerabilities and some examples from Windows, then jumps straight into the Linux side of things. Larimer explains how attackers can abuse these features to gain access to a live system by using a USB flash drive. He also shows how USB as an exploitation platform can allow for easy bypass of protection mechanisms like ASLR and how these attacks can provide a level of access that other physical attack methods do not." I've attached the video if you are curious. Skip the first 2 minutes if you don't care where the lost and found is.
I always knew that when they made *nix idiot-proof all hell would break loose security-wise. Android has proven that really thoroughly. It's too bad, really. I had high hopes for it once. Maybe they'll get it together yet though.
Caveat Utilitor
Autorun as a concept just sucks.
Copying whatever Windows does, warts and all, into Linux, just sucks.
When is this insanity going to end?
Any system is vulnerable when it automatically opens or executes email attachments, automatically executes arbitrary commands delivered on a removable volume, and hides file name extensions to fool users into executing things that looked like something harmless.
Any software vendor who thinks about adding such features should receive a savage thrashing. If they actually enable such features by default, they should be shot with prejudice.
--Udo.
Anybody want to post a quick-fix to avoid turn off AutoRun in Ubuntu?
I'm not a lawyer, but I play one on the Internet. Blog
Comment removed based on user account deletion
Auto-run is convenient and all but systems should NOT automatically execute content from devices unless the user has specifically told them it's okay.
A recommendation for out-of-the-box "autorun" experience:
Query the type of the media, but do so without running any code of any type on the media.
Authenticate the data used to determine the type of the media AND any "auto run" code typically associated with that type of media OR decide you can't authenticate it.
Present a box to the user for "trusted" content:
This disk claims that it contains [a program | music | video | files | whatever ]. This claim is sign by [company] and its chain-of-authentication includes [highest-level signer], a company trusted by [operating system vendor | you]. To see more details click [here].
What do you want to do? [list of choices, including "do nothing," "open as a folder," "run the disk" (aka autorun), "play music," "play video," etc.]
[ X ] Do the same for other media of this type signed by this signer.
[ _ ] Do the same for other media of this type signed by any trusted signer.
[ _ ] Do the same for other media of this type even if it is not signed.
Present a box to the user for signed content that cannot be authenticated:
WARNING: This disk claims that it contains [a program | music | video | files | whatever ]. This claim is sign by [company] but this signature cannot be authenticated. To see more details click [here].
What do you want to do? [list of choices, including "do nothing," "open as a folder," "run the disk" (aka autorun), "play music," "play video," etc.]
[ _ ] Trust this signer in the future.
[ _ ] Do the same for other media of this type signed by this signer.
[ _ ] Do the same for other media of this type signed by any trusted signer.
[ _ ] Do the same for other media of this type even if it is not signed.
Present a box to the user for unsigned content, which would typically be "unlabeled" content that the computer has to figure out for itself:
This disk appears to contain [a program | music | video | files | whatever ].
What do you want to do? [list of choices, including "do nothing," "open as a folder," "run the disk" (aka autorun), "play music," "play video," etc.]
[ _ ] Do the same for other media of this type [bold]NOT recommended[/bold]
Almost all media would be "unsigned" until a standardized method of signing is developed. Signing would typically only authenticate the type of media the disk claimed to as well as the executable code of any autoexec.exe-type program that runs if the user "runs the disk" or any media-type-specific on-disk code that runs if the user "plays the media," not the entire disk.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Linux servers, that run on command line don't have these issues. I know this is shocking to some people, but 99.99% of the world doesn't really give a shit about what you have on your home pc's hard drive. Security is good, but paranoia isn't. Anyone that actually cares about safeguarding their data won't be running a server with a GUI on it anyway. Even the Apache Foundation had to learn this the hard way.
Has there really ever been anyone responsible for Linux making claims of "the year of Linux"? Or has it just been some random users that once made a reference?
You can lead a man with reason but you can't make him think.
It appears to me that Linux may have started thinking about focusing all it's efforts on being a more stable, secure OS, but to gain acceptance in a more mass market, they need to do things that, while they reduce security, increase their general user base. Sure, it's Linux, so you can strip it down to near nothing and have a rock-solid, dependable, secure system designed for a specific hardware setup, but if they want to stay alive, they may need to realize that they need less secure measures that allow the typical end-user to use their OS behind the scenes without any extra effort on their part. TLDR:To (Probably most) people, ease of use is more important than security, and some software developers working around Linux may be seeing that. However, being Linux, the hardcore can always build their system to be the fort Knox of data. If anything, this is a good thing IMO. Keep the security-conscious aware of issues, but let the average end-user go about their business as they will.
Doesn't depend on platform. Autorun is always a huge security risk. It was invented for lazy users that do not want to know how to use their computer properly. At this time (and for the foreseeable future) this kind of laziness comes at a price and that is vulnerability to rather simple to execute attacks.
The real benefit of Linux here is that, unlike Windows, you can get distributions that would not dream of implementing something as stupid as autorun. On others, you can reliably turn it off reliably without a cryptic adventure through the mess called the "registry". But implementing insecure features will of course make Linux insecure. Nobody sane debates that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
this is why i disable it. autorun is the worst thing to happen to windows
MS *tried* to fight it (in part) by effectively adding a GUI sudo prompt into Windows Vista. A million people -- including Linux users posting on Slashdot -- immediately flew into fits of nerd rage about how annoying it was to have a GUI sudo prompt. (I never saw an issue with it myself, actually. Seemed no more irritating than going sudo on Linux or OSX's own authentication prompt. Unlike many, I actually really quite liked Vista, although I use OSX most of the time.) MS listened to their users and allowed them to scale it back in Windows 7, creating a million new security holes and causing a million people -- including Linux users posting on Slashdot, although not necessarily the same ones -- to complain about security flaws in Windows.
MS have made many stupid mistakes over their history and not least due to the ancient and creaking XP (and, even worse, the immediately-owned ME) have a history of shit security. Thing is they tried to patch it up in an easy way and people bitched and puled enough that they had to make it less secure again.
That, of course, ignores the other few million security flaws riddling the kernel. I'm just talking about the UAC here.
I think people think he's referring to autorun when I believe what he's talking about is more the "hot-plugging" ability of usb. I.e. I plug in a USB device and some linux kernel device code gets run. These are standard hardware vulnerabilities, it's just that most hardware can't be plugged into a computer as easily as usb.
You can't claim that Linux > Windows and then suggest it remove features Windows has had for years.
Linux has traditionally been better than Windows precisely because it didn't have features like 'autopwn' that Windows has had for years.
Linux still has the antiquated "user, group, everyone" security model from the 1970s. By now, we know that outside data can't be given all the privileges of the user. But Linux's legacy security model is so deeply embedded in the UNIX/Linux world that it's almost impossible to get beyond that.
Yes, there's SELinux. But there isn't a whole distribution with a full range of applications which can run under a mandatory security model.
> But as you make Linux more user friendly, feature rich, easier to use, it becomes easier to attack.
Of course you can point us to the inevitable viruses, worms and trojans that now afflict MacOS?
If not then your entire rant is just thoughtless jibber jabber.
You get system vulnerabilities from bad engineering practices, not a consumer focused mindset.
Sure I can have it both ways. Just don't do obviously stupid stuff. Don't do things that were proven wrongful in the 80s before any of the current malware innovations were developed.
A Pirate and a Puritan look the same on a balance sheet.
A smart distro would disable auto-run entirely and make you go through hoops to install it.
A Pirate and a Puritan look the same on a balance sheet.
Maybe OT, but here's MS's information for controlling this "feature" in Windows.
There've been various sets of instructions and registry hacks floating around, but this appears to be from the horse's mouth, relatively recently updated, and addresses some of the shortcomings of previous fixes.
Article ID: 967715 - Last Review: September 9, 2010 - Revision: 6.2
How to disable the Autorun functionality in Windows
http://support.microsoft.com/kb/967715
(I'm posting this due to the confusion all the various instructions / search results can create, and because this article addresses Autoruns and so I expect a number of Windows users will be having a look out of curiosity.)
It doesn't even recognise my thumb drive, so I don't have to worry about security
It was quite popular about 8-10 years ago for various media outlets to declare the "year of the Linux Desktop". I can't be arsed to look up specific examples, but they definitely existed. The irony being that Linux has improved dramatically as a desktop OS since most of those claims were widely circulated, yet no one expects it anymore. As far as I can tell, three things have ended the hype:
1) Probably most important: People have realized that what most desktop users want is something Linux will probably never give them. Hand holding and a person to call when things break. Windows' monopoly created a huge pool of reasonably skilled amateur technicians; as well as an ecosystem of professionals ranging from the guy with fliers on the apartment bulletin board, to Best Buy's Geek Squad, to highly skilled consultants and everything in between. Apple answered that with their Genius Bar and highly rated customer service. Linux has answers to it as well, but people don't like searching web sites and such. Red Hat and a few others actually have excellent customer service and tech support, but buying from them (in small volumes, they're way cheaper than MS for high volume sales) makes Linux as expensive as Windows.
2) A credible alternative to Windows on the Desktop emerged in OSX. Sure the hardware is kinda premium, but Apple released an easy to use Unix based OS on fairly affordable hardware. They also tied this with the launch of their retail stores and Genius Bars which provided the kind of hand holding and quick fix solutions that people are used to on Windows.
3) Software and hardware vendors never saw value in cooperating. Next to to the lack of hand holding, this is probably the biggest issue. No thanks to the vendors, the hardware situation is much better than it used to be, but software remains a major hurdle. There are analogs and replacements for a lot of stuff, but they're rarely quite as good, always require a learning curve (on top of learning the new OS), and often times have file conversion issues. Apple got around this because they've always been Microsoft's "see, we're not a really a monopoly" hitching post so a lot of vendors (including MS themselves) have always maintained a MacOS version. Apple's recent success just means that they're making money on it.
So now the Linux vendors concentrate on the server space (which has always been their strength), while producing steadily more polished Desktop OSes that don't get nearly the hype they used to. Meanwhile increasing numbers of tablets, smartphones, and PDAs may make the whole thing irrelevant in ten years. Not that desktop or laptop computers are going anywhere, but portable platforms will probably overtake them in usefulness for non-technical people at some point in the next decade.
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
Anyone care to post a demo of this Linux autorun vulnerability, one that will compromise my system by inserting a USB device, and with no user confirmation required, and doesn't prompt for the root password ..
Is anybody else annoyed by the "There is a CD with a software update in the drive" or some such when you leave the installation CD in?
Can you please turn that off Canonical? This just begs for an exploit.
thegodmovie.com - watch it
"Linux still has the antiquated "user, group, everyone" security model from the 1970s"
Apple OS X is based on Unix and uses the same antiquated security model as Linux :)
Both Slashdot and the presenter should have been more accurate in the title of the presentation. ( I mean you by CmdrTaco )
I actually watched this presentation live, and it is definitely worth checking out. Although this is a good presentation, it's not exactly the hack of the century. The guy still hasn't actually found a way around AppArmor yet so this doesn't work with machines with it enabled. Furthermore, the exploit requires local access to the machine AND have a user account already logged in.
I'm sure 99% of you already know how to do this, but if anyone is interested in protecting themselves from this type of attack regardless simply:
1. Open a Nautilus window.
2. Edit -> Preferences. Go to the Media tab.
3. Uncheck the box that is labeled "Browse media when inserted".
I feel like they're follow Windows' tail lights over a cliff.
This sort of mentality is ruining Linux distributions.
If I wanted a dumbed-down buggy system, I'd use Windows.
Competition Good, Monopoly Bad.
Autorun plagues windows? Do people still move files from computer to computer via disc? By default this feature is either turned off or there's a popup asking if you want to run whatever it is that's trying to run. The last time I got a virus from autorun was probably on windows 98, maybe even 95.
Almost every comment here is concentrating on "Autorun" i.e. automatic execution of scripts/executables on media and ignoring the main focus of the talk, which is about exploiting bugs in the way the file-manager handles previews of image, PDF, DVI files etc. situated on the media. More generally he talks about the possibilities of exploiting vulnerabilities in every layer involved when automatically handling inserted media, from device discovery, device drivers, file-system drivers, up to and including the file-manager.
Unless we're all conflating "autorun" with "automount & show the media in a file-manager" now?
While he talks about the possibility of driver vulnerabilities and means to exploit them (e.g. a USB device which claims to be a member of a class for which you have found an exploitable driver, but sends corrupt data as an exploit and payload), the exploit demonstrated works by:
-GNOME's stupid default of auto-mounting (KDE just shows you that a device has been plugged in, you have to click it to have it mounted), even when the screensaver is locked
-Opening a nautilus window on the mounted filesystem (again, even when the screensaver is locked)
-Vulnerabilities in a file parser (in this case for dvi files) specific to the PDF viewer
-The ability to kill the screensaver process quite trivially
The thumbnailer was protected by AppArmor, and while he disabled AppArmor for the demo, reckons he could have got around AppArmor with a bit more time.
I use KDE, because the extra "usability" of saving one click is not worth the risk imposed by auto-previewing files without me having the option to say no.
Linux still has the antiquated "user, group, everyone" security model from the 1970s.
Yes, there's SELinux. But there isn't a whole distribution with a full range of applications which can run under a mandatory security model.
Actually, the Unix model is so ingrained in all Unix platforms, that getting users who expect broken Unix off it (on Linux) is difficult, and they want the insecurity and convenience of Mac OS X.
And, for the demo, the speaker actually had disabled AppArmor, because with it enabled, his exploit didn't work. He said he would have been able to get around AppArmor (due to one or two controls that we not enforced on the thumbnailer) with sufficient time.
If you look into how modern distros control device permissions (e.g. on /dev/snd/pcmC0D0p ) you may find they make use of ACLs to allow lists of users access to things (without resorting to groups). However this gets complicated fast.
Additionally, a number of Linux security modules (SELinux, Apparmor, TOMOYO) alloow the use of common apps under a MAC model. Fedora really does run out of the box under SELinux after all.
However, I feel that what is needed is the ability to disclaim privileges even when running as a normal user. There is experimental user namespace work on Linux that w allow unprivileged users to create namespaces which may in the future provide such an ability.
4) Games.
That's all I use my PC for that requires Windows. E-mail, web, I can get by with almost anything... The only reason I upgraded to Vista was games... I was perfectly happy with win2k as a desktop PC. I don't need, nor care about a polished UI, I just want it functional.
I bought my current PC with the intention of dual booting Linux. However, I went with a fakeraid stripe setup (which resulted in Vista booting to usable in 15 seconds from bootmenu, I kept my old win2k partition), and at that time none of the Linux distros supported it without lots of tinkering. I've not got round to installing it since, since I don't need it (though I have bought another HD for it).
Ahh ok. I really hate videos as conveyors of information. I was just flipping around and found his bit about using a usb device with the kernel exploit.
It's still more inline with the kernel driver exploit than with the way Windows autorun used to be exploitable.
Well that's the nice thing about Linux though. No one is forcing you to use those features.
I think this problem, and the reason why we still have auto run, is that it's assumed that having physical access to a machine is an endgame situation. With that assumed to be true, the thinking goes, why not make content open themselves for the convenience of the user? That's why auto run and other services should be disabled during deployment in a business setting.
People run linux because of retarded shit like that on Windows. Don't replicate the problem.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I'm not so sure I trust BSD code to be secure.
^^vv<><>BA
Can anyone good with linux, tell me if
a) you can disabe the autorun options by default...
b) can anyone tell me if you can have something like tripwire tell you when a side OS is runnning trying to mess with your setup?
thank you..
Here's a better one: http://windowssecrets.com/2007/11/08/02-One-quick-trick-prevents-Autorun-attacks
Thanks to whomever originally posted this.
This isn't a Linux vulnerability, it's a shitty distribution vulnerability. Don't use distros designed for idiots, and you won't have a problem with this.
You said "large collection". Thumbnailing that is too damn slow. (and always will be, because images get bigger) I want a responsive UI.
This is a great reason to NOT have a auto mount enabled. Don't get me wrong I do enjoy auto-mount but at the same time it has a good deal of risk with it because you can't unintentionally mount a FS you didn't mean to.