Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. But surely you could simply test the hardware with a known good installation (say, off a Live CD) to figure out if that was the case?

It's not hypothetical. A friend of mine has created an USB based pen-test tool based on this very idea. The early prototype idea was to open up a mouse, splice a USB hub into the USB connection, then attach an "Arduino like" Teensy[1] to it such that, when the mouse was connected, in addition to the mouse being detected and registered by the host machine, it would also detect and install a new keyboard. The Teensy could then dump it's payload as anything that could be typed on a physical keyboard (subject to the memory limitations of the board).

He's now doing a Kickstarter campaign to manufacture and sell the things, which he calls The Glitch[2]. You can see pictures on the Kickstarter page, of the Glitch embedded in a generic mouse.

[1]: http://www.pjrc.com/teensy/

[2]: http://www.kickstarter.com/projects/1186217328/the-glitch

You should be able to use "accessibility" features to bring up a soft keyboard (or just cut and paste from known things) to run the entire attack as a normal-appearing HID mouse, which just happens to be evil. No need to reconnect via a hub; you could do the whole thing within a mouse controller. Bonus points if you can manage to fit all the logic in the same processor/memory the thing includes by default, or something which looks like the same physical package and thus passes a non-destructive open-device analysis.

(which is kind of terrifying if you think about it; almost no one checks the provenance of "dumb" devices like mice. Keyboards sometimes get a tiny bit more scrutiny due to hardware keyloggers inside inline, but that's about it.)

The ultimate solution is a trusted supply chain and equipment which is tamper-evident, non-counterfeitable, and which can securely attest to intactness and provenance; x9.9 pinpads and hsms. But no one does that for general purpose hardware.

The environment I'm thinking about is something like a SCADA control system for, say, a centrifuge cascade :)

How hard would this part be?

> But surely you could simply test the hardware

Scanning system devices would reveal it pretty quickly if it's just an additional USB device.

Given the prevailing prices for mice and for computer vulnerability researchers, I'd thing buying a new mouse is orders of magnitude cheaper than verifying that a suspect mouse does not contain a threat.

But if you allow arbitrarily complex logic to be present which only activates additional functionality on the presence of an arbitrarily complex trigger, you can no longer proove the existence of this additional logic.

As an example: Maybe my microcontroller passively watches the mouse, and only activates the payload (routes the mouse signals through the USB hub and activates the flash-drive) after a complex sequence of mouse-moves and clicks have been performed? The trigger might be to monkey-train the unsuspecting user with a specifically crafted flash-game on a frequently visited website.

Snark FAIL.

He's basically saying that because there was one CIO somewhere, anywhere, in the Federal government that it's appropriate to tar every military and civil servant with that same 'idiot' brush.

I mean, I'm assuming you would be offended if someone said that all computer hackers have my own personal morals, so it seems wise to only blame people for what they actually do, not their seventh-order relationships to other people.

Besides, you're talking about an issue which afflicts essentially all large organizations. Have you never received a small part from a retailer wrapped in waaaaaay too much packing material?

I'm not just talking about an issue that affects large organizations. I have never feared imprisonment from Apple, MSFT, or Amazon. I have never made involuntary payments to any of them. Steve Ballmer can't stop and frisk me for weapons on the street b/c he fears for his safety. Sure big companies have waste and inefficiency, but it's at a much lower level than the federal government.

Well, I don't know if he meant it that way. But whether he did not or did, there are two counter-arguments to be made.

First, one has to note that he didn't say that broad a thing as you accuse him of: he merely wrote about "these people", that is "those described in the article". So it could very well be that he did not meant it for everybody.

Second, even if he did intent to talk about all "military and civil servants" ("all" meaning "most", as it mostly does in conversation), why assume he was basing it on this particular case only?

The report: http://www.oig.doc.gov/OIGPublications/OIG-13-027-A.pdf

>I'm in the wrong industry.

it is not about industry. In any industry you can have government as a client.

Only sales commissions and lobbyist fees.

Where do they get the rationale for the Mice and Keyboards?!

Nation states can be presumed to have access to garden-variety security consultants, and more elaborate tricks besides.

If it has a USB port, it contains a tiny computer. One which is probably more powerful than the Commodore PET I learned computing with. Not that you need that much power to log keystrokes.

Those of us who were brought up in the 20th century can no longer trust our intuition about where computers might be hiding.

It seems to say that he took 2 weeks to do the initial audit and then they got him to do some sort of detailed review of every machine which took months. To which he also then said there was nothing really wrong.

To me it sounds like he just did his job while some crazy, incredibly incompetent CIO kept asking for more.