NSA refused Clinton a secure BlackBerry like Obama, so she used her own

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by chris_wot on Thursday March 17, 2016 @10:18PM (#11309407)

The problem with this story isn't that USB drives were used and caused a vulnerability, it's that USB drives could be used to cause a vulnerability.

Let's say the Russians did the same thing dumping a bunch of USB devices whilst the USB drive ban was in place. Almost certainly someone is going to sneak in a USB drive at the risk of getting caught, just so they can do their job more effectively. There is still a good chance that this USB drive hack might have worked, just not as likely.

I really feel that your friend wasn't looking at things from the right perspective. The reason that USB drives were the vector that allowed the Russian hack to work was because they allow the execution of arbitrary code once the drive is mounted. If you prevent the execution of that code, then the issue would largely have gone away.

Instead of only banning USB drives, why not investigate ways of preventing code execution on drive insertion from occurring in the first place? Then you could have the policy of no USB drives, but if someone did sneak one in then it would have removed the vulnerability completely.

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by fabulist on Thursday March 17, 2016 @11:18PM (#11309632)

A small point of information, it is also problematic (in a highly sensitive enviornment) to let people arbitrarily decide to take gigabytes of information out the door with them.

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by chris_wot on Friday March 18, 2016 @12:03AM (#11309796)

Indeed. Allowing workstations to connect USB storage should be prevented, even if they actually connect the drive into the USB slot.

Actually, I'm not even sure if Windows allows a way of preventing this.

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by fabulist on Friday March 18, 2016 @03:37AM (#11310417)

I've definitely spoken to people who've told me that, when they plug a USB drive in at their place of work, Windows pops up a dialog for an administrator's password in order to mount it. I believe this is some sort of group policy, but I'm afraid I only use GNU/Linux.

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by yompers888 on Friday March 18, 2016 @03:17PM (#11314159)

I've also seen ones that don't offer even that; they just block it outright.

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by chris_wot on Friday March 18, 2016 @08:51PM (#11316563)

Funny story: a particular Australian Federal government department I did consulting work for just couldn't figure out how to prevent auto mounting of USB storage and - I kid you not - they superglued all the USB ports on all workstations that had access to their secure servers!

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by yompers888 on Friday March 18, 2016 @03:21PM (#11314190)

Based on the fact that the policy held for the duration of my classmate's stay, I'm guessing that he did implement a policy forcibly preventing flash drive use. But the whole time he was a thorn in everyone's side, maybe because he didn't try to explain himself adequately (or maybe because the military is too burnt out on mandatory training to pay attention). So after he left they probably "fixed" the systems to allow flash drives again.

[ Parent | on HN ]