Federal agency destroyed computers, keyboards, mice over virus fear(foxnews.com)
foxnews.com
Federal agency destroyed computers, keyboards, mice over virus fear
http://www.foxnews.com/politics/2013/07/10/us-agency-destroys-computers/
40 comments
Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware.
It's not hypothetical. A friend of mine has created an USB based pen-test tool based on this very idea. The early prototype idea was to open up a mouse, splice a USB hub into the USB connection, then attach an "Arduino like" Teensy[1] to it such that, when the mouse was connected, in addition to the mouse being detected and registered by the host machine, it would also detect and install a new keyboard. The Teensy could then dump it's payload as anything that could be typed on a physical keyboard (subject to the memory limitations of the board).
He's now doing a Kickstarter campaign to manufacture and sell the things, which he calls The Glitch[2]. You can see pictures on the Kickstarter page, of the Glitch embedded in a generic mouse.
[1]: http://www.pjrc.com/teensy/
[2]: http://www.kickstarter.com/projects/1186217328/the-glitch
It's not hypothetical. A friend of mine has created an USB based pen-test tool based on this very idea. The early prototype idea was to open up a mouse, splice a USB hub into the USB connection, then attach an "Arduino like" Teensy[1] to it such that, when the mouse was connected, in addition to the mouse being detected and registered by the host machine, it would also detect and install a new keyboard. The Teensy could then dump it's payload as anything that could be typed on a physical keyboard (subject to the memory limitations of the board).
He's now doing a Kickstarter campaign to manufacture and sell the things, which he calls The Glitch[2]. You can see pictures on the Kickstarter page, of the Glitch embedded in a generic mouse.
[1]: http://www.pjrc.com/teensy/
[2]: http://www.kickstarter.com/projects/1186217328/the-glitch
I don't think you actually need to do the keyboard thing.
You should be able to use "accessibility" features to bring up a soft keyboard (or just cut and paste from known things) to run the entire attack as a normal-appearing HID mouse, which just happens to be evil. No need to reconnect via a hub; you could do the whole thing within a mouse controller. Bonus points if you can manage to fit all the logic in the same processor/memory the thing includes by default, or something which looks like the same physical package and thus passes a non-destructive open-device analysis.
(which is kind of terrifying if you think about it; almost no one checks the provenance of "dumb" devices like mice. Keyboards sometimes get a tiny bit more scrutiny due to hardware keyloggers inside inline, but that's about it.)
The ultimate solution is a trusted supply chain and equipment which is tamper-evident, non-counterfeitable, and which can securely attest to intactness and provenance; x9.9 pinpads and hsms. But no one does that for general purpose hardware.
You should be able to use "accessibility" features to bring up a soft keyboard (or just cut and paste from known things) to run the entire attack as a normal-appearing HID mouse, which just happens to be evil. No need to reconnect via a hub; you could do the whole thing within a mouse controller. Bonus points if you can manage to fit all the logic in the same processor/memory the thing includes by default, or something which looks like the same physical package and thus passes a non-destructive open-device analysis.
(which is kind of terrifying if you think about it; almost no one checks the provenance of "dumb" devices like mice. Keyboards sometimes get a tiny bit more scrutiny due to hardware keyloggers inside inline, but that's about it.)
The ultimate solution is a trusted supply chain and equipment which is tamper-evident, non-counterfeitable, and which can securely attest to intactness and provenance; x9.9 pinpads and hsms. But no one does that for general purpose hardware.
Except the mouse doesn't know exactly where it is on the screen, or how it's concept of CPI (counts per inch) relates to pixels on the screen.
That's a pain, but I think I could work around it by observing the human's use of the mouse for a while; there are some known actions (let's restrict to Windows), like clicking on start menu and some other stuff. By watching and calibrating, you could get a good idea what to do. You also might know a lot about the target environment; maybe they have totally standardized configurations including mouse speed, display size, etc.
The environment I'm thinking about is something like a SCADA control system for, say, a centrifuge cascade :)
The environment I'm thinking about is something like a SCADA control system for, say, a centrifuge cascade :)
Fascinating.
How hard would this part be?
> But surely you could simply test the hardware
Scanning system devices would reveal it pretty quickly if it's just an additional USB device.
How hard would this part be?
> But surely you could simply test the hardware
Scanning system devices would reveal it pretty quickly if it's just an additional USB device.
Yes, if you took the time to connect each mouse to a machine and see what devices it detects, it would be readily apparent that a mouse loaded with a Glitch was doing something funny. And, as far as that goes, a really observant user might notice something weird going on when it's first connected. But most users aren't terribly observant, or at least that's the assumption.
A slightly cleverer device could get even better. If it only enumerated as the "evil" device (whatever it is) after several minutes or even hours after some amount of activity followed by inactivity, then it would be quite likely the user isn't at their PC to notice any messages from their operating system, suspicious behaviour, or other warning signs. Someone attempting to scan hundreds of mice for malicious ones would have an even worse time: Because it waits until the user appears to be using the mouse, simply plugging them into a test computer won't immediately reveal the evil. This can be taken further, including fingerprinting the host operating system, time of day, or any other number of factors.
Even that's not guaranteed. You could just have the mouse wait 1 hr before doing nasty-keyboard-mode. Or only go into nasty-keyboard-mode after certain amount of button presses etc. It's an arms race.
Some mice have user-upgradeable firmware. If you plug one of them into a system and the adversary roots the system, you should assume any other system you plug that mouse into is rooted.
Given the prevailing prices for mice and for computer vulnerability researchers, I'd thing buying a new mouse is orders of magnitude cheaper than verifying that a suspect mouse does not contain a threat.
Given the prevailing prices for mice and for computer vulnerability researchers, I'd thing buying a new mouse is orders of magnitude cheaper than verifying that a suspect mouse does not contain a threat.
For the simple case (wire up an additional USB hub and a USB-flash-drive into the mouse body) that's easily done (under Linux, lsusb would suffice).
But if you allow arbitrarily complex logic to be present which only activates additional functionality on the presence of an arbitrarily complex trigger, you can no longer proove the existence of this additional logic.
As an example: Maybe my microcontroller passively watches the mouse, and only activates the payload (routes the mouse signals through the USB hub and activates the flash-drive) after a complex sequence of mouse-moves and clicks have been performed? The trigger might be to monkey-train the unsuspecting user with a specifically crafted flash-game on a frequently visited website.
But if you allow arbitrarily complex logic to be present which only activates additional functionality on the presence of an arbitrarily complex trigger, you can no longer proove the existence of this additional logic.
As an example: Maybe my microcontroller passively watches the mouse, and only activates the payload (routes the mouse signals through the USB hub and activates the flash-drive) after a complex sequence of mouse-moves and clicks have been performed? The trigger might be to monkey-train the unsuspecting user with a specifically crafted flash-game on a frequently visited website.
This doesn't surprise me. Government agencies tend to hire people based primarily on the fact the individual has a top secret clearance. This drastically cuts the talent pool and allows people that have gamed the system to get the job. Sometimes legitimate experience is cast aside for the mere fact a person has a clearance. I know so many people that because they have a clearance have a cushy 6 figure job with a great title. I've talked to people that are System Admins and Analysts and I can tell they have no idea what they are doing. They got the job because they knew somebody, embellished their resume, and have a clearance.
These are the people that take the money out of your paycheck each week. Don't know whether it's gross incompetence or cronyism to buy new equipment from a contractor.
I wasn't aware that the EDA was the IRS. Learn something new every day I guess.
He means they are paid by our taxes -- not that they collect them directly.
Snark FAIL.
Snark FAIL.
I know what he meant, otherwise snark wouldn't have been necessary.
He's basically saying that because there was one CIO somewhere, anywhere, in the Federal government that it's appropriate to tar every military and civil servant with that same 'idiot' brush.
I mean, I'm assuming you would be offended if someone said that all computer hackers have my own personal morals, so it seems wise to only blame people for what they actually do, not their seventh-order relationships to other people.
He's basically saying that because there was one CIO somewhere, anywhere, in the Federal government that it's appropriate to tar every military and civil servant with that same 'idiot' brush.
I mean, I'm assuming you would be offended if someone said that all computer hackers have my own personal morals, so it seems wise to only blame people for what they actually do, not their seventh-order relationships to other people.
It's not about being offended. It's about theft and corruption. All these agencies are taking away our income and squandering it through incompetence, cronyism, and worthless spy programs and military adventurism. If the "computer hackers" were stealing 30% our collective income and wasting it I'd be very angry about them too.
If the worst thing a Federal agency does to the taxpayers in a day is waste a computer keyboard, they're still far in the black compared to the rest. True story.
Besides, you're talking about an issue which afflicts essentially all large organizations. Have you never received a small part from a retailer wrapped in waaaaaay too much packing material?
Besides, you're talking about an issue which afflicts essentially all large organizations. Have you never received a small part from a retailer wrapped in waaaaaay too much packing material?
Military adventurism, overly harsh sentencing, and illegally spying on our own citizens are not simply wasting a day at the keyboard. They are actively harming all of us.
I'm not just talking about an issue that affects large organizations. I have never feared imprisonment from Apple, MSFT, or Amazon. I have never made involuntary payments to any of them. Steve Ballmer can't stop and frisk me for weapons on the street b/c he fears for his safety. Sure big companies have waste and inefficiency, but it's at a much lower level than the federal government.
I'm not just talking about an issue that affects large organizations. I have never feared imprisonment from Apple, MSFT, or Amazon. I have never made involuntary payments to any of them. Steve Ballmer can't stop and frisk me for weapons on the street b/c he fears for his safety. Sure big companies have waste and inefficiency, but it's at a much lower level than the federal government.
>He's basically saying that because there was one CIO somewhere, anywhere, in the Federal government that it's appropriate to tar every military and civil servant with that same 'idiot' brush.
Well, I don't know if he meant it that way. But whether he did not or did, there are two counter-arguments to be made.
First, one has to note that he didn't say that broad a thing as you accuse him of: he merely wrote about "these people", that is "those described in the article". So it could very well be that he did not meant it for everybody.
Second, even if he did intent to talk about all "military and civil servants" ("all" meaning "most", as it mostly does in conversation), why assume he was basing it on this particular case only?
Well, I don't know if he meant it that way. But whether he did not or did, there are two counter-arguments to be made.
First, one has to note that he didn't say that broad a thing as you accuse him of: he merely wrote about "these people", that is "those described in the article". So it could very well be that he did not meant it for everybody.
Second, even if he did intent to talk about all "military and civil servants" ("all" meaning "most", as it mostly does in conversation), why assume he was basing it on this particular case only?
Funny how no one points out that it was a government agency that uncovered this issue in the first place...
Are we supposed to start rewarding these institutions for being capable of "uncovering" million dollar technology projects that are wasteful and pointless? The fact it happened in the first place is bad enough.
Is this for real? Man, $823,000 + $688,000 for a cybersecurity contractor to do 6 months work. I'm in the wrong industry.
The report: http://www.oig.doc.gov/OIGPublications/OIG-13-027-A.pdf
The report: http://www.oig.doc.gov/OIGPublications/OIG-13-027-A.pdf
That's astronomical compared to a typical cyber-security salary, even at the higher levels.
such numbers make me wonder - is it just idiocy of bureaucrats or we're talking kickbacks here. For example, in Russia government contracts have 75% kickback, so that explains it there. What is the explanation here in the US?
>I'm in the wrong industry.
it is not about industry. In any industry you can have government as a client.
>I'm in the wrong industry.
it is not about industry. In any industry you can have government as a client.
We don't have kickbacks in the U.S.
Only sales commissions and lobbyist fees.
Only sales commissions and lobbyist fees.
$2.7mm in damages over 6 malware infected parts. That escalated quickly.
Where do they get the rationale for the Mice and Keyboards?!
Where do they get the rationale for the Mice and Keyboards?!
It's low probability but a mouse can absolutely be an attack vector. See: http://www.kickstarter.com/projects/1186217328/the-glitch
A paranoid, incompetent IT team plus an opportunistic "cybersecurity" contractor.
If the brief for the contract includes "We believe we may have been compromised by a nation state. Check for us." then checking keyboards and mice is totally reasonable. Some of them incorporate user-upgradable firmware. Given this, turning the keyboard/mouse into an "advanced persistent threat" is an exercise trivially within the capability of garden-variety security consultants. (Ballpark cost: $20k if you get everything scratchbuilt the first time, assuming you've separately rooted one machine to infect the peripheral.)
Nation states can be presumed to have access to garden-variety security consultants, and more elaborate tricks besides.
Nation states can be presumed to have access to garden-variety security consultants, and more elaborate tricks besides.
Yes, even I fell for the "but it's only a stupid mouse!" spin on this story, and I've been shopping for embedded processors recently so you'd think I would know better.
If it has a USB port, it contains a tiny computer. One which is probably more powerful than the Commodore PET I learned computing with. Not that you need that much power to log keystrokes.
Those of us who were brought up in the 20th century can no longer trust our intuition about where computers might be hiding.
If it has a USB port, it contains a tiny computer. One which is probably more powerful than the Commodore PET I learned computing with. Not that you need that much power to log keystrokes.
Those of us who were brought up in the 20th century can no longer trust our intuition about where computers might be hiding.
A lot of threat models that the USA defends against are perfectly legitimate, because the USA has used them against opponents in the past! e.g. US military and embassies always fly in new equipment from the USA, rather than buying local. Why? Because in the cold war, the Soviets got a local photocopier and local repairmen. The USA had a camera in it and the repairman was a spy. These aren't theoretical attacks to the USA.
In the article it comes across like the contractor was constantly saying 'no, it's all ok'.
It seems to say that he took 2 weeks to do the initial audit and then they got him to do some sort of detailed review of every machine which took months. To which he also then said there was nothing really wrong.
To me it sounds like he just did his job while some crazy, incredibly incompetent CIO kept asking for more.
It seems to say that he took 2 weeks to do the initial audit and then they got him to do some sort of detailed review of every machine which took months. To which he also then said there was nothing really wrong.
To me it sounds like he just did his job while some crazy, incredibly incompetent CIO kept asking for more.
If they were programmable keyboards / mice, or they were suspected to be counterfeit or other surreptitiously modified parts, I might understand.
Right, if it's a mouse that came from the OEM manufacturer and you know it is truly original, it's probably safe. But if there's any way that an outsider could have snuck a loaded mouse into your environment, then the mouse can certainly be setup to attack your system. See note above about The Glitch.
It's like when Egypt killed herds of pigs to mitigate the "swine flu"
I keep a can of Raid on my desk in case I find a bug in the software.
Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. But surely you could simply test the hardware with a known good installation (say, off a Live CD) to figure out if that was the case?