USB Hack

[HayHauler]

I know this is a bit geeky, but there has always been questions in my mind about the security of USB devices.  Well, my fears have come true, somewhat. 
I am sure SERK will chime in with more detailed facts, but any USB device, keyboard, mouse, memory stick, smart phone, etc. can have this "malware" on it.  Heck, the NSA may have manufacturers imbed this in the firmware on the production line...  hahahaha, I wouldn't put it past them.

Just google USB SECURITY FLAW and read a while.

http://www.enterprise-security-today.com/news/USB-Security-Flaw-Uncovered/story.xhtml?story_id=133004L69RW6

Now to go pull out my old PS2 keyboards and mice and resurrect my Linux boxen with no USB ports.   

Hay 
Jimmyt

[Serk]

While the threat is a real possibility, the article, to me, feels a little over the top sensationalist from someone trying to sell something (Not you Hay, referring to the authors themselves.)

Something like USB, which requires physical access to the computer in question, while a possible vector of attack, aren't nearly as attractive as simply connecting to a computer remotely, using a 0-day 'sploit and getting a root kit installed.

In other words, yes it's possible to pwn a computer by physically plugging in a compromised USB device, but it's also pretty easy to pwn one remotely using exploits and commonly available root kits (Not to mention the toys I'm sure the NSA and the stuff other countries have.) So on connected systems, which the vast majority are these days, there's not much incentive to utilize a physical attack vector like USB.

So in summary, yah, be careful, but #1. Is anything you have REALLY that interesting? And #2. Be careful, not paranoid. If "they" really want your stuff, they're going to get it, and they have much more effective means than an infected USB keyboard.

Just MHO, of course...

[HayHauler]

I just think it is interesting that they found a way to compromise the USB that is currently undetectable.  I'm sure that the USB dudes will find a way to scan them at some point.  And I wouldn't put it past the G to have the hardware producers put their little hacks into the firmware.  AND, we are waiting in lines to buy them. 

P.S.  NOTHING I have on any of my computers is very interesting to others.

Hay 
Jimmyt

[hubcapsc]

It is an old trick to put bad stuff on a usb stick and leave it
laying around (drop it in a targeted parking lot, whatever).

Someone finds it.. Cool! They pick it up and start using it, and the bad guy
has breached the network...

The new thing with this is that the bad stuff goes into the firmware on the USB
device, and our scanners only scan the data on the device, not the device's firmware...

-Mike

[Psychotic Bovine]

Ok, that does it, I'm switching back to my old Commodore 64.

[hubcapsc]

I saw this today on a security mailing list 

USB stands for "universal serial bus."  The key
words are "bus" and "universal."  It is a very powerful and fundamental
extension of the computer.  Anything attached to it, is part of the
computer.  We did not need this presentation to tell us that. Neither
should it come as a surprise that Moore's Law applies to the things that
can attach to it. When I was small, and first left the house by myself,
my mother told me never to take USBs from strangers.  When I was a
little older, my daddy told me never to put my USB in someone else's
machine.  When my sister went out, she was told never to let anyone put
their USB in her machine.  It was called "practicing safe computing" or
"good hygiene."   Fortunately for us, most, but not all, of the USB
ports and devices in the world are sterile.  This is a large fundamental
vulnerability with a relatively small threat; a low risk.

-Mike

[Oss]

its one theory as to how a certain middle eastern democracy managed to
get centrifuges in Iran to implode setting back the nuclear program

but that is just a theory right?   

[CajunRider]

Apple IIe baby... Apple IIe...

You can even get the color monitor upgrade if you wanna spend some money!!