Hot answers tagged

77 votes
Accepted

Force user to remove USB token

You are trying to use a technical tool to solve a social problem. The answer is that cannot fit. Techniques can provide great security when correctly used, but only user education can allow proper ...
Serge Ballesta's user avatar
75 votes
Accepted

Secure USB cable for charging in untrusted environments

Could I mitigate that risk by taking a regular usb cable and cutting the data (but not the power) cables? Or does the usb protocol needs a data handshake to begin charging? Such a cable does exist, ...
Alexander O'Mara's user avatar
69 votes
Accepted

Allow only specific devices to be connected to USB

Buy a PS2 to USB adapter for keyboards+mice (important: both need to be in one usb port to make sure it's not a naive straight-through connector). They have logic and cost about $10 USD at time of ...
dandavis's user avatar
  • 2,693
65 votes

How can "USB stick" online identification possibly work?

What your bank gave you is an USB security token with a digital certificate (like these). These are standardized hardware devices which almost every operating system supports plug&play out of the ...
Philipp's user avatar
  • 49.4k
62 votes
Accepted

How worried should I be about getting hacked with PoisonTap?

First the attacker needs to have physical access to the machine in order to plug the device into the USB port. This means any kind of full remote exploit is not possible. It does work though if the ...
Steffen Ullrich's user avatar
60 votes
Accepted

Why is Firewire a bigger threat than USB?

Firewire and also Thunderbolt provide direct access to the OS memory, thus bypassing the operating system. See Wikipedia: DMA attack for more details on the possible attacks. USB does not provide ...
Steffen Ullrich's user avatar
60 votes

Allow only specific devices to be connected to USB

You are taking the wrong side of the problem. If someone you do not trust can access to a machine, the machine has been compromised. Full stop. That's the reason why access to server rooms is highly ...
Serge Ballesta's user avatar
54 votes
Accepted

Is disallowing write to USB actually an efficient way to prevent data leakage?

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do ...
LSerni's user avatar
  • 22.8k
51 votes

Secure USB cable for charging in untrusted environments

USB devices can negotiate the provided current from the host device. If power negotiation is not possible (because you cut the data wires), a maximum of 100 mA is supplied. This means you can charge ...
Sjoerd's user avatar
  • 30.4k
47 votes
Accepted

Can a stolen Android phone with USB debugging enabled have screen lock bypassed?

A sophisticated threat actor could potentially try to exploit the Android Debug Bridge's authorization protocol by switching your phone's storage media to another same model phone with already active ...
OakDEV's user avatar
  • 612
43 votes

How to safely wipe a USB flash drive

To quote the ISM (Australia's military standards for cyber security). Security Control: 0359; In flash memory media, a technique known as wear levelling ensures that writes are distributed evenly ...
meowcat's user avatar
  • 1,359
41 votes

Secure USB cable for charging in untrusted environments

Although not entirely in line with the OP's question, I wanted to share a different solution. You could take a powerbank with you. Small powerbanks capable of charging your phone at least 1 time don'...
BlueCacti's user avatar
  • 950
33 votes
Accepted

Is it safe to use cheap USB data cables?

Do you have reason to expect targeted attacks? It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons: ...
Peteris's user avatar
  • 8,419
30 votes

Is it safe to use cheap USB data cables?

Security issues with cables? No. It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply. However the cost of a device, especially ...
700 Software's user avatar
29 votes

Can BadUSB be avoided by looking at the shapes and the controller model inside it?

No, you can't tell by looking at it. There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The ...
Gilles 'SO- stop being evil''s user avatar
28 votes
Accepted

Can I block viruses from a USB stick by scanning it before opening its folder?

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very ...
WorseDoughnut's user avatar
28 votes

How can "USB stick" online identification possibly work?

One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect ...
Lie Ryan's user avatar
  • 31.4k
28 votes

Can a stolen Android phone with USB debugging enabled have screen lock bypassed?

Without full-disk encryption, your unencrypted data can be read without recovering the pincode. Enabled USB debugging, definitely, extends the attack surface, but it's not necessary for a determined ...
Alex Cohn's user avatar
  • 848
25 votes

How can "USB stick" online identification possibly work?

....they don’t require the user to install any software on the machine.... I thought that the ability for a webpage to browse the file system freely without user action is too commonly restricted ...
J.A.K.'s user avatar
  • 4,833
25 votes

Allow only specific devices to be connected to USB

On Windows systems, you've been able to block or restrict USB devices through Local or Group Policy since at least Windows Vista. By setting the "Removable Storage Access" policies, you can disable ...
claidheamh's user avatar
24 votes

Can autoplay USB stick spread virus to windows 8 or 10?

The difference in modern version of Windows is that Autoplay is off by default, but it is still available and can be enabled. However, if you do not know the current Autoplay configuration of a ...
Graham Hill's user avatar
  • 15.6k
24 votes
Accepted

How to safely wipe a USB flash drive

Next time you're about to put sensitive data on a flash drive, consider encrypting it first! Strongly encrypted data is useless without the key, and if you securely erase the drive first, all that ...
Dmitry Grigoryev's user avatar
21 votes

Can a stolen Android phone with USB debugging enabled have screen lock bypassed?

Without the encryption, your data can be trivially read out using a flash adapter such as this one: Removing a flash chip is a 5 minutes job on a hot air rework station. Of course, this assumes that ...
Dmitry Grigoryev's user avatar
19 votes
Accepted

Is all the alarmism around BadUSB really called for with respect to host devices?

BadUSB is largely overrated. It is a very, very old attack that simply got a lot of recent press coverage, like IDN homograph attacks or filename unicode reversal (or has that one not gotten press yet?...
forest's user avatar
  • 66.6k
17 votes

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of ...
licklake's user avatar
  • 1,072
17 votes

How to safely wipe a USB flash drive

A quick check at amazon.com shows 64GB USB drives in non-designer cases go for about $20. Less if you buy in bulk. Since you want "quick and efficient" lets factor in the time needed to overwrite the ...
peter's user avatar
  • 179
16 votes
Accepted

Attacks via physical access to USB (DMA...?)

Before we start, a quick word about how USB works. A USB device connects to a piece of hardware inside the computer called the USB host controller. This decodes the complex USB protocol, which, much ...
forest's user avatar
  • 66.6k
16 votes

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live. You would still be exposed to attacks ...
Cory Klein's user avatar
16 votes

Force user to remove USB token

It seems to me that a startup script could check for mounted USBs and block the wifi/network if there is a USB mounted while showing a message. A simple polling function could check for new USBs ...
schroeder's user avatar
  • 129k

Only top scored, non community-wiki answers of a minimum length are eligible