Slashdot stories can be listened to in audio form via an RSS feed, as read by our own robotic overlord.

 



Forgot your password?
typodupeerror
Open Source Security Software Linux IT News

USB Autorun Attacks Against Linux 274

Posted by CmdrTaco
from the don't-put-strangers-in-there dept.
Orome1 writes "Many people think that Linux is immune to the type of Autorun attacks that have plagued Windows systems with malware over the years. However, there have been many advances in the usability of Linux as a desktop OS — including the addition of features that can allow Autorun attacks. This Shmoocon presentation by Jon Larimer from IBM X-Force starts off with a definition of autorun vulnerabilities and some examples from Windows, then jumps straight into the Linux side of things. Larimer explains how attackers can abuse these features to gain access to a live system by using a USB flash drive. He also shows how USB as an exploitation platform can allow for easy bypass of protection mechanisms like ASLR and how these attacks can provide a level of access that other physical attack methods do not." I've attached the video if you are curious. Skip the first 2 minutes if you don't care where the lost and found is.

This discussion has been archived. No new comments can be posted.

USB Autorun Attacks Against Linux

Comments Filter:
  • by JustNiz (692889) on Monday February 07, 2011 @01:17PM (#35128416)

    Autorun as a concept just sucks.
    Copying whatever Windows does, warts and all, into Linux, just sucks.
    When is this insanity going to end?

  • by pclminion (145572) on Monday February 07, 2011 @01:23PM (#35128494)

    Yeah, having a computer automatically react to a piece of media... What a stupid idea. Next thing you know they'll be using computers to compute things, and then we've just gone straight to hell.

  • Re:Oh boy (Score:2, Insightful)

    by HermMunster (972336) on Monday February 07, 2011 @01:28PM (#35128560)

    Has there really ever been anyone responsible for Linux making claims of "the year of Linux"? Or has it just been some random users that once made a reference?

  • by hedwards (940851) on Monday February 07, 2011 @01:31PM (#35128612)

    It really depends how you do it. It's one thing to go the UAC route and have the computer notify the user that something has been inserted and request authorization to do something, and quite another to make that decision for the user. Certain actions really shouldn't be allowed to be completed completely on their own, autorun is definitely a candidate for that.

  • by $RANDOMLUSER (804576) on Monday February 07, 2011 @01:36PM (#35128660)
    Exactly.

    87.3% of all the biggest forehead-whapping Windows security bugs have come from Microsoft's (really Bill Gates) love of whizzo features that look really cool in a developers conference keynote but don't survive the first three minutes of critical thought or exposure to the real world.

    I'm specifically referring to things like where IE or Windows Explorer execute code of unknown provenance to provide "previews". Windows Explorer once had a bug which could execute arbitrary code via JPEG preview. Of course, the Outlook preview exploits are LEGION, but we can also include VB macros included in Word and Excel "data" (hahaha) files. Only a sick love of flashy features, consequences be damned can account for this.
  • by morcego (260031) on Monday February 07, 2011 @01:44PM (#35128756)

    Shoot him.

  • Exactly (Score:2, Insightful)

    by boristhespider (1678416) on Monday February 07, 2011 @01:48PM (#35128820)

    MS *tried* to fight it (in part) by effectively adding a GUI sudo prompt into Windows Vista. A million people -- including Linux users posting on Slashdot -- immediately flew into fits of nerd rage about how annoying it was to have a GUI sudo prompt. (I never saw an issue with it myself, actually. Seemed no more irritating than going sudo on Linux or OSX's own authentication prompt. Unlike many, I actually really quite liked Vista, although I use OSX most of the time.) MS listened to their users and allowed them to scale it back in Windows 7, creating a million new security holes and causing a million people -- including Linux users posting on Slashdot, although not necessarily the same ones -- to complain about security flaws in Windows.

    MS have made many stupid mistakes over their history and not least due to the ancient and creaking XP (and, even worse, the immediately-owned ME) have a history of shit security. Thing is they tried to patch it up in an easy way and people bitched and puled enough that they had to make it less secure again.

    That, of course, ignores the other few million security flaws riddling the kernel. I'm just talking about the UAC here.

  • by Animats (122034) on Monday February 07, 2011 @01:56PM (#35128924) Homepage

    Linux still has the antiquated "user, group, everyone" security model from the 1970s. By now, we know that outside data can't be given all the privileges of the user. But Linux's legacy security model is so deeply embedded in the UNIX/Linux world that it's almost impossible to get beyond that.

    Yes, there's SELinux. But there isn't a whole distribution with a full range of applications which can run under a mandatory security model.

  • by Jonner (189691) on Monday February 07, 2011 @02:40PM (#35129334)

    The presenter in TFV says that because autorun always prompts the user, it's not a big security risk. He spends much more time talking about exploiting bugs in various software layers, including kernel, root-running userspace, and normal user processes.

    I'm not sure that I agree that always asking permission to autorun something is safe enough, but it is far less onerous than how Windows used to work.

  • by adamofgreyskull (640712) on Monday February 07, 2011 @04:03PM (#35130164)
    Almost every comment here is concentrating on "Autorun" i.e. automatic execution of scripts/executables on media and ignoring the main focus of the talk, which is about exploiting bugs in the way the file-manager handles previews of image, PDF, DVI files etc. situated on the media. More generally he talks about the possibilities of exploiting vulnerabilities in every layer involved when automatically handling inserted media, from device discovery, device drivers, file-system drivers, up to and including the file-manager.

    Unless we're all conflating "autorun" with "automount & show the media in a file-manager" now?
  • Re:Exactly (Score:4, Insightful)

    by multisync (218450) on Monday February 07, 2011 @04:44PM (#35130620) Journal

    MS *tried* to fight it (in part) by effectively adding a GUI sudo prompt into Windows Vista. A million people -- including Linux users posting on Slashdot -- immediately flew into fits of nerd rage about how annoying it was to have a GUI sudo prompt.

    If you are referring to UAC, it is hardly a "GUI sudo prompt." sudo requires you to prove that you are an authentic user by providing your password each time you open a shell to perform an administrative task (and every fifteen minutes after), and you also have to be a member of the sudo group (which only the first account created at install time is by default).

    All UAC does is basically confirm with whomever is currently sitting at the computer (authorized or not) that they initiated some arbitrary action. This is also useful, in that it prevents some web site from installing a piece of malicious software without the user's knowledge, but it is far from a "GUI sudo prompt."

    This is the reason it was met with derision by Slashdotters (and I don't recall many "fits of nerd rage," although a few might have snorted Code Red through their noses when they realized how impotent - and easily disabled - this new Microsoft "security feature" was).

The sooner all the animals are extinct, the sooner we'll find their money. - Ed Bluestone

Working...