Hot answers tagged

78

You are trying to use a technical tool to solve a social problem. The answer is that cannot fit. Techniques can provide great security when correctly used, but only user education can allow proper use. I often like the who is responsible for what question. That means that users should know that they will be accountable for anything that could be done with ...


73

Could I mitigate that risk by taking a regular usb cable and cutting the data (but not the power) cables? Or does the usb protocol needs a data handshake to begin charging? Such a cable does exist, so a data handshake must not be required. Such cords are discussed on some Stack Exchange sites: Micro USB cables that only charge but no data, no mounting etc ...


67

Buy a PS2 to USB adapter for keyboards+mice (important: both need to be in one usb port to make sure it's not a naive straight-through connector). They have logic and cost about $10 USD at time of writing. Then buy USB to PS2 adapters for both mice and keyboard (separate adapters). They have no logic, just internal wiring to each connection and they ...


65

What your bank gave you is an USB security token with a digital certificate (like these). These are standardized hardware devices which almost every operating system supports plug&play out of the box. They are very common for implementing multi-factor-authentication to high-security systems in enterprise IT. Your web browser uses HTTPS with client-...


62

First the attacker needs to have physical access to the machine in order to plug the device into the USB port. This means any kind of full remote exploit is not possible. It does work though if the computer screen is locked with a password or similar. Note that the physical access does not need to be direct, i.e. it can also be some gullible user plugging a ...


61

Firewire and also Thunderbolt provide direct access to the OS memory, thus bypassing the operating system. See Wikipedia: DMA attack for more details on the possible attacks. USB does not provide this kind of direct access. But it has other problems like the ability to unexpectedly emulate devices like a keyboard, see BadUSB.


60

You are taking the wrong side of the problem. If someone you do not trust can access to a machine, the machine has been compromised. Full stop. That's the reason why access to server rooms is highly controlled, and why admin normally do not care for the physical security of the connectors: the defense line is not at the connector level but at the room ...


54

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do that, they would have no end of workarounds, up to printing QR codes on A4 sheets. Rather, it is to prevent employees from saving sensitive information on USB ...


51

USB devices can negotiate the provided current from the host device. If power negotiation is not possible (because you cut the data wires), a maximum of 100 mA is supplied. This means you can charge devices, but it may be slower than usual. Devices such as LockedUSB do the power negotiation on both sides, while not allowing data to pass between devices. ...


43

There is nothing stopping an attacker from putting a powerline ethernet transceiver as well as a USB-enabled microcontroller into a USB charger. This would allow them to communicate with the charger in the hope to offload some malware onto a smartphone plugged into that port. However, such a device would need to be highly specialized and specifically ...


43

To quote the ISM (Australia's military standards for cyber security). Security Control: 0359; In flash memory media, a technique known as wear levelling ensures that writes are distributed evenly across each memory block. This feature necessitates flash memory being overwritten with a random pattern twice as this helps ensure that all memory blocks ...


41

Although not entirely in line with the OP's question, I wanted to share a different solution. You could take a powerbank with you. Small powerbanks capable of charging your phone at least 1 time don't take up too much space. You can charge the powerbank at the airport terminal, in your hotel, or even on the flight (as there's no risk for malicious data ...


33

The BadUSB attack is based on the fact that computers allow and enable HID devices on all usb ports. Faked network adapters are no real danger. My answer tries to describe how to use udev to temporarily disable the addition of new HID devices. I'm no udev expert, but I've tested my approach, and it works for me. For preparation, create a file /etc/udev/...


33

Do you have reason to expect targeted attacks? It's reasonable to assume that random cheap cables sold in large scale generally aren't modified to include offensive hardware, mostly for two reasons: That would raise the cost of the cable far above its price, and would be uneconomical even considering the ability to "monetize" a certain amount of random ...


30

Security issues with cables? No. It's technically possible to have a hidden/embedded device in which case all the caveats of an untrusted USB device apply. However the cost of a device, especially one small enough to be hidden in a cable, would be quite a bit higher than the cable itself so you probably don't need to worry about this.


30

One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect to claim that "it works in any device that has a USB port, Windows, Mac, Linux and more, and to work out of the box". Did they claim that it works in any ...


27

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very risky to insert what you believe to be a compromised USB device into your PC, no matter what AV you have installed. If you desperately need files from the drive (to quote ...


27

....they don’t require the user to install any software on the machine.... I thought that the ability for a webpage to browse the file system freely without user action is too commonly restricted by default Yes, that should definitely not be possible without smartcard drivers. This is a fundamental security mechanism of any browser. What gives the clou ...


24

The idea behind BadUSB is that a malicious agent re-flashes a device's USB controller chip to do something nasty. This is an interesting possiblity, but there are some serious assumptions here that people tend to gloss over: 1: The USB controller chip has to allow firmware flashing over the USB connection This is a security vulnerability for sure if it's ...


24

On Windows systems, you've been able to block or restrict USB devices through Local or Group Policy since at least Windows Vista. By setting the "Removable Storage Access" policies, you can disable the attachment of USB storage devices (that category includes a lot of nefarious USB devices). These settings block Windows from interacting with the devices ...


23

The difference in modern version of Windows is that Autoplay is off by default, but it is still available and can be enabled. However, if you do not know the current Autoplay configuration of a Windows machine, you should check it before inserting a suspect stick.


22

Most likely yes, but it depends Much like PATA, SCSI, and Ethernet devices, USB devices don't directly connect to the computer. They connect to a Host Controller that manages all signaling and communication. All ports are connected to something called a Root Hub, and to each Root Hub you may connect other hubs and subsequently more hubs. Each of these hubs ...


22

Next time you're about to put sensitive data on a flash drive, consider encrypting it first! Strongly encrypted data is useless without the key, and if you securely erase the drive first, all that will be left is an occasional sector of such encrypted data surviving due to wear leveling. If you're still unsatisfied by this technique because there's a small ...


17

This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of course there are many more possibilities to run malicious software too.) The smartphone pretty much acts like an usb stick. So every security risk you get with ...


17

A quick check at amazon.com shows 64GB USB drives in non-designer cases go for about $20. Less if you buy in bulk. Since you want "quick and efficient" lets factor in the time needed to overwrite the drive at least twice, and maybe running a drive scanner to verify the erasure. And then remembering to do it each time. A quick check of homedepot.com shows a ...


16

Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live. You would still be exposed to attacks that can take place over the power cables, such as the device supplying a very high voltage or current back to your laptop. Presumably MacBook USB ports have ...


16

It seems to me that a startup script could check for mounted USBs and block the wifi/network if there is a USB mounted while showing a message. A simple polling function could check for new USBs connected. All this is possible in Powershell. This would solve the problem of having the USBs mounted and would force the user to eject before using the laptop. ...


14

BadUSB isn't an attack. It's a tool used when designing attacks. When you plug a USB device into a computer, the device tells the computer what sort of thing it is, so the computer can select the appropriate driver. For example, a thumb drive declares itself as a "USB Mass Storage" device, while a keyboard is a "Human Interface Device". BadUSB is a ...


14

I really cannot imagine that the cable itself contains a malicious device as explained by @GeorgeBailey. So I would say that those cables are harmless when confidentiality or integrity is considered. But if you consider that security also encompasses disponibility (availability), chances are that the contacts are of poor quality and that you experience ...


Only top voted, non community-wiki answers of a minimum length are eligible