News for hackers. Stuff that matters.

A comment on No one, not even the Secret Service, should randomly plug in a strange USB stick. Parent comment

Re:No one, not even the Secret Service, should randomly plug... by tyingq on Tuesday April 09, 2019 @12:28AM (#19611800)
I wouldn't be terribly surprised if you could create a barcode that caused a barcode reader to send <windows key>+r and run some arbitrary command. So perhaps it wasn't a vector for an ATM, but maybe some other barcode reader where workers scan in arbitrary things they are handed...TSA maybe?
[ Parent | on HN ]
Re:No one, not even the Secret Service, should randomly plug... by YjSe2GMQ on Tuesday April 09, 2019 @01:00AM (#19611922)
As far as I remember that's roughly how that exploit against an ATM worked:

https://xlab.tencent.com/badbarcode/

Also, perhaps folks working in data centers can and confirm/deny, but from what I know it's usually strictly forbidden to bring any USB devices into a data center area.

[ Parent | on HN ]
Re:No one, not even the Secret Service, should randomly plug... by sokoloff on Tuesday April 09, 2019 @06:26AM (#19613246)
We use USB drives as installers and, in some cases, as boot volumes. (And of course keyboards and mice on crash carts and USB serial ports for laptops.)

We’re not a cloud provider, but I’ve been in lots of DCs and seen plenty of USB devices.

[ Parent | on HN ]
Re:No one, not even the Secret Service, should randomly plug... by HocusLocus on Tuesday April 09, 2019 @08:07AM (#19613753)
I'd love to have a crash cart. I'd spend all day crashing it into other carts.
[ Parent | on HN ]