Researchers crack open malware that hid for 5 years

Re:Researchers crack open malware that hid for 5 years by drzaiusapelord on Tuesday August 09, 2016 @05:02PM (#12257680)

Why not just unplug the USB header if you want a physical solution? The idea that you're shoving glue in there is incredibly ridiculous. You can chip that off easily with your finger or a key. I seriously doubt this is a real story because it flies in the face of published STIGS and basic common sense. Nor would it stop a remotely determined attacker/idiot.

That said, I could see glueing a panel to block them as a visual to remind people that those ports are off, but not as a primary blocking device. More than likely its done via security policy.

[ Parent | on HN ]

Re:Researchers crack open malware that hid for 5 years by ms013 on Tuesday August 09, 2016 @05:52PM (#12257971)

They epoxied the USB ports on my secure machine when I worked at one of the national labs about 12 years ago. One day I came in and the admin had gone through everyone's office the evening before with a bunch of JB weld to fill the USB ports.

So, whether or not you believe that it is a useful solution, it certainly did happen. As for alternatives to gluing, I assume that was time related: filling in a port is certainly faster than opening thousands of machines to give them a physical port-ectomy.

[ Parent | on HN ]

Re:Researchers crack open malware that hid for 5 years by woliveirajr on Tuesday August 09, 2016 @11:36PM (#12259364)

Port-ectomy: a new word in my dictionary, must remember to use it someday!

[ Parent | on HN ]

Re:Researchers crack open malware that hid for 5 years by rdtsc on Tuesday August 09, 2016 @05:15PM (#12257744)

> You can chip that off easily with your finger or a key.

Because it was more of a reminder for stupidity. "Oh, look there is glue in there, that's right we not supposed to stick random USB devices in there". If the machine is on their desk, yes, they could plug in a PCI device that has an USB thing on it and still connect. But by that point they are really going out of their way, they are opening the case and such, and it will be very hard to maintain the idea that it was just a stupid mistake.

[ Parent | on HN ]

Re:Researchers crack open malware that hid for 5 years by emmelaich on Tuesday August 09, 2016 @07:32PM (#12258408)

Exactly. The other related threat is the new junior admin being asked by a senior exec to allow (windows policy-wise) the USB storage just temporarily. "Because I need this presentation NOW as I have to get to the airport in 45 minutes!

[ Parent | on HN ]

Re:Researchers crack open malware that hid for 5 years by paulfurtado on Wednesday August 10, 2016 @01:07AM (#12259617)

Rear USB ports are not attached to the motherboard via trivially removable connectors.

It also really is not trivial to chip off most types of even general-purpose epoxy with your finger on a flat surface, let alone a tiny USB port which your finger doesn't fit in. If the epoxy was selected with some level of care, it may be very, very time consuming, or nearly impossible to remove, even with the right tools.

No matter what, it's a helpful measure in addition to every other way you can also disable a USB port.

[ Parent | on HN ]