<story><title>No one, not even the Secret Service, should randomly plug in a strange USB stick</title><url>https://techcrunch.com/2019/04/08/secret-service-mar-a-lago/</url></story><parent_chain><item><author>rblatz</author><text>&lt;i&gt;Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system.&lt;p&gt;“We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.”&lt;/i&gt;&lt;p&gt;That&amp;#x27;s an ok start, but you not only want to prevent it from auto-mounting the filesystem, you want it to not even auto-configure any USB HIDs presented to the OS. And even then that may not be enough if there are flaws deep in the usb stack that are being exploited.  Ideally you&amp;#x27;d have an analyzer in the middle that records everything and allows analysis later, think Wireshark or Fiddler.</text></item></parent_chain><comment><author>lamontcg</author><text>My null hypothesis on reading this article is that the Secret Service did exactly what Mr &amp;quot;NSA Hacker&amp;quot; Williams suggested onto an isolated linux laptop -- and in fact this was sophisticated enough malware to start attacking it when it wasn&amp;#x27;t even mounted.  So the agent shut it down and sent it all off to a better equipped lab.&lt;p&gt;Which is actually pretty sane procedure.&lt;p&gt;I think techcrunch here is trying to sell us on the idea that we&amp;#x27;re all smarter than the stupid secret service in order to get clicks through manufactured outrage.</text></comment>
<story><title>No one, not even the Secret Service, should randomly plug in a strange USB stick</title><url>https://techcrunch.com/2019/04/08/secret-service-mar-a-lago/</url></story><parent_chain><item><author>rblatz</author><text>&lt;i&gt;Williams said the best way to forensically examine a suspect USB drive is by plugging the device into an isolated Linux-based computer that doesn’t automatically mount the drive to the operating system.&lt;p&gt;“We would then create a forensic image of the USB and extract any malware for analysis in the lab,” he said. “While there is still a very small risk that the malware targets Linux, that’s not the normal case.”&lt;/i&gt;&lt;p&gt;That&amp;#x27;s an ok start, but you not only want to prevent it from auto-mounting the filesystem, you want it to not even auto-configure any USB HIDs presented to the OS. And even then that may not be enough if there are flaws deep in the usb stack that are being exploited.  Ideally you&amp;#x27;d have an analyzer in the middle that records everything and allows analysis later, think Wireshark or Fiddler.</text></item></parent_chain><comment><author>AlphaWeaver</author><text>For people unfamiliar with this strategy, check out a commercialized version, the USB Rubber Ducky.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;shop.hak5.org&amp;#x2F;products&amp;#x2F;usb-rubber-ducky-deluxe&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;shop.hak5.org&amp;#x2F;products&amp;#x2F;usb-rubber-ducky-deluxe&lt;/a&gt;</text></comment>