back

by EwanG·9y ago·view on hn ↗
Presuming you are given free access to a USB port on the computer - and as we all know once you have physical control security is somewhat out the window anyway.
5 comments
>and as we all know once you have physical control security is somewhat out the window anyway.

No, just no. It's long, LONG past time to retire this bit of ancient lore, which came out of a completely different time and place in computing. These days for most users not always having physical control is by far the norm, not the exception. And there are absolutely ways to make to mitigate security issues from physical access, that is after all the entire point of technologies like full disk encryption. FDE is completely pointless if physical security can be taken for granted, it exists entirely because physical security cannot be taken for granted. I presume you don't spend your days advocating nobody bother "because it's pointless anyway."

Technologies like specific CPU/SoC/chipset level hardware security zones, HSMs, use of IOMMUs and the like to prevent DMA from ports, etc. are all there in part to help prevent or mitigate certain physical attacks. For that matter, simple locks and/or sealing of computer units aids with both making attacks more difficult, slower (another key part of threat mitigation) and, just as importantly, making them noticeable. The final fallback of a good security system is to at least try to let the owner know that it broke if all else fails. There is a certain amount of disgruntlement amongst some tech people at highly sealed devices, but they do make it significantly more challenging to perform certain physical attacks quickly or undetectably.

So yes, anything which unexpected speeds up physical attacks, renders them less/unnoticeable, or both, is a legitimate issue. Normal users of portable systems should be able to expect that, under normal circumstances, they can warm lock it (screen lock, put it to sleep), leave for a few minutes, and have a low likelihood of a low energy persistent evil maid attack being pulled off in the mean time. Treating modern security like it only needs to consider servers stashed in a secured room/data center is wrong.

I think if the op ment if you physically can touch the device the game is almost over
This is much faster than other ways of cracking a computer though. I can see this working while someone steps away for a few minutes.

Say you go in for a job interview at a company and the interviewer leaves for a minute with their computer locked but still on their desk. Most traditional methods would require you to move to the other side of the desk or pull the computer to you which is risky, but with this you can just reach over for a few seconds.

Not to mention many traditional attacks require rebooting the computer to a bootable CD which will be suspicious if the user has an active login system and all the sudden all their apps are closed.

Or say you are at a doctor's office and there is no CD drive and rebooting the computer would be suspicious. I'm left unattended in exam rooms with computers all the time.

I also imagine it could be fairly easily modified to act like a USB hub and be inserted between the computer and a legitimate device.

Edit: Think of how less dramatic the scenes will be in Mr. Robot and the like if the "hacker" doesn't have to rush to get back to their seat just in-time for the target to get back to their desk.

Imagine this built into a USB-C power adapter you could loan to a coworker, "leave behind" or install into a co-working space or coffee shop. Don't even need physical access in that case, just need to be a "Good Samaritan".
I believe USB-C can tunnel the PCI bus. If your computer is doing that... a network adapter will be the least of your problems.
As a user, it'd be nice to assume that if I'm not logged in new USB devices won't be installed though.
What about a keyboard? How are you going to log in if your computer won't accept the keyboard that you are trying to plug in?
To expand on that, you could just allow keyboards and not enable other devices but then how do you log in if your login is a network based... now you have to allow network cards. And now this hack is just as effective.
Beyond that, you could disguise non-keyboard hardware as a keyboard.
But then it doesn't get registered as an ethernet device, bypassing this particular problem.
It does if you make a keyboard that registers as a hub with both a keyboard and network adapter installed
I'm cool with HIDs being installed, but an Ethernet device that hijacks my entire network and then quietly disappears? Uh...

I'd notice a new usb plugged in, but I wouldn't easily notice this.

I believe there is a proof of concept evil USB device that looks like a USB key, but actually emulates a keyboard and enters all sorts of damaging keystrokes when plugged in. So allowing keyboards is dangerous anyway (although having the screen locked should help).

This is the reason why keyboard/mouse connectors should look different to USB connectors, so we can tell the difference.

Screen locking would fix the keyboard attack. It has no input coming back from the computer so it works by blind-spraying keypresses in and hoping.
The numlock and capslock indicators can be used as confirmation signals coming back so it knows if it is working.
Not really. By the time you make those signals provide feedback about your task rather than just whether Caps Lock is on, you'll have already accomplished your task and be into the part of the process where you're trying to download or compile some hack to use code to send something useful along Caps Lock signals. It's not a useful feedback mechanism when getting the feedback is an order of magnitude or two harder than the task you're trying to perform in the first place.
Could restrict it to HID class USB devices.
What if you're not logged in on the console, but have an SSH session open over the network? Does that count as 'logged in' or not? Imagine a server under a desk with no monitor attached. Or, a thin-client situation, where I am logged in to a virtual console over VNC or RDP or X, but have no access to the actual machine's USB ports?
> and as we all know once you have physical control security is somewhat out the window anyway.

This is such a defeatist attitude, and it has also proven to be (mostly) false by Apple and its iPhones. If we stopped saying that every time there is a hack like this, perhaps companies would actually give a damn to make sure it doesn't happen anymore, or not nearly as easily.

It's one thing to pay from tens of thousands of dollars to a million for modification of a chip in a factory or with highly-advanced equipment, and it's quite another to just insert a USB stick into a random PC and hack it.

> it has also proven to be (mostly) false by Apple and its iPhones

Has it?

https://www.washingtonpost.com/world/national-security/fbi-p...

That was an iPhone 5C. These didn't have Secure Enclave inside them, and it still wasn't an easy feat to access the device - they probably had to disassemble it and copy the flash storage straight from the chip to do it, unless they've used an unreleased 0day. If it were an iPhone 5S (3 years old) or newer, they wouldn't be able to access the data on the device at all.
A one-off hack against old hardware and software that probably cost a ton of money fits with "mostly false" I'd say.