Title: TEARDOWN OF USB FAN REVEALS JOURNALISTS’ LACK OF OPSEC

Content: "The real story here is that accomplished journalists would be grateful for a random USB device given to them by a foreign government. There is every indication this journalist actually plugged this USB fan into his computer. But even if he went the safe route and opted to use a USB battery or a cable with data lines disconnected to protect against malware, I’m sure others didn’t take precautions. Out of 2500 journalists at the Singapore summit, some unquestionably plugged this threat into their computer."

Question: What is the indication that the journalist actually plugged this USB fan into his computer?

Reality: there is no evidence of any journalist plugging in the USB fan.

Conclusion: YAZWPSRAAS (yet another zer0cool wannabe posting self-righteous articles about security)

Exactly - the photo shows the fan in the plastic bag, the evidence is it was not used!

Also, "The journalist who started this whole mess by posting the image of the USB fan drive on Twitter" how is posting the image on Twitter starting a mess?

This is a bad article with a blatant disregard for fact, and I've flagged it.

Seems like a strange headline... the teardown apparently didn't "reveal" anything unexpected at all.

"Lack of opsec" is still all fine and good as a comment about this story, but this article is implying (really, more than implying) that they actually found something hidden in the fan.

Agreed. Based on the headline I was expecting the journalist had inadvertently revealed some data about which they weren't intending to.

A physical switch on all ports that are sometimes used for power-only, disconnecting data lines, would be worthwhile for many people.

Or just train people to use power banks for USB-powered accessories instead of their computers.

There are cables and adapters that don't have the data lines connected, they are sometimes called USB condoms.

I would expect them to be made of clear plastic for easy visual confirmation

That just makes me want to design a fake USB condom that looks legit. Maybe modulating the data over the power cables using ICs implanted in the connector...

I guess the downside of having “one port” for power/ stoarage and peripherals, is that you really can’t know what’s going to happen when you plug a device in.

It’s almost like you want a dialog box approving what the usb device can do. But nobody really wants that.

Convenience over security.

Android already does this. When you plug in you get a notification with options for - Charging only (with direction selection if your phone supports it) - USB media protocol - USB flash storage

That’s assuming the software can’t be exploited.

Alternative headline: Teardown of USB fan reveals systems were engineered without taking into account the need for user-friendly security

¯\_(ツ)_/¯

Can't have opsec if you don't know "op"(how a system operates and is meant to be operated) or or "sec".

Teardown of article on USB Fan teardown reveals lack of teardown

Recent discussion: https://news.ycombinator.com/item?id=17459041.

Is OPSEC covered in modern journalism degrees?