Security risk with new MBP

[New_Mac_Smell]

True, and I do agree, equally the solution is user management of the charging situation, equally the risk is far more prevalent with the ubiquitous thumb/flash drive that many of us encounter on a daily basis. To me the solution is clear same as any other USB interface, only use known devices, if you are not a position to control this, then you need to be mindful of your data, potential loss and subsequent fallout.

These days I look to avoid unknown USB devices, equally it`s not entirely practical with minimisation being very much the key word.

Q-6

Pretty much standard protocol. Also, if you work for a company and handle sensitive material, they will no doubt have strict security policies to teach people not to be stupid enough to go around plugging any old thing into the computer.

Either way, the device still has to communicate with your computer before transferring data can commence, does the OS (Windows/Mac, heck even Linux) not have any security in place here?

 

[Rigby]

True, and I do agree, equally the solution is user management of the charging situation, equally the risk is far more prevalent with the ubiquitous thumb/flash drive that many of us encounter on a daily basis. To me the solution is clear same as any other USB interface, only use known devices, if you are not a position to control this, then you need to be mindful of your data, potential loss and subsequent fallout.

Yes. One difference from standard USB though: All of the ports of the new MBPs now support Thunderbolt as well, which, as mentioned previously, has DMA capabilities and may potentially allow a malicious peripheral device to access the computer's memory. This was also a risk with Thunderbolt 2 and Firewire before. So I think people should be even more careful what devices they plug into their computers.

 

[fokmik]

So the risk applies only for 2016? What about 2015 12" macbooks? They are on the market for almost 2 years

 

[Queen6]

Pretty much standard protocol. Also, if you work for a company and handle sensitive material, they will no doubt have strict security policies to teach people not to be stupid enough to go around plugging any old thing into the computer.

Either way, the device still has to communicate with your computer before transferring data can commence, does the OS (Windows/Mac, heck even Linux) not have any security in place here?

The concern is the malicious code is stored in the USB devices firmware and injected into the target device at the same low level bypassing typical AV & OS security etc. protocols. I am aware it`s technically possible, equally how prevalent is another matter.

Q-6

 

[Wowereit]

USB isn't the biggest problem.
If it hasn't been fixed in hardware, DMA attacks like Thunderstrike are way worse.
They will give you firmware level access to the machine.

As Thunderbolt 3 and USB-C share the same connector and it's the only port on the nMBP, it has become far easier than with Thunderbolt 2 to connect an infected device without noticing.

Sure, it's only theoretical and MIGHT have been fixed with TB3, but carrying hot-plugable PCIe out of the machine as the only port might have other attack-vectors aswell.

 

[Queen6]

Yes. One difference from standard USB though: All of the ports of the new MBPs now support Thunderbolt as well, which, as mentioned previously, has DMA capabilities and may potentially allow a malicious peripheral device to access the computer's memory. This was also a risk with Thunderbolt 2 and Firewire before. So I think people should be even more careful what devices they plug into their computers.

I think applying the same caution as with the currently ubiquitous USB A type peripherals is a reasonable solution. Depending on your computer`s role, data etc. connecting to external peripherals may well be unavoidable. Personally I look to mitigate as much as possible when dealing with third party`s, by having data transferred wireless as much as possible and trying to avoid thumb/flash drives etc.

Q-6

 

[mcnallym]

USB has ALWAYS allowed it to supply Power to the connected device. USB-C is simply allowing greater power to be supplied and provide enough power to charge a laptop, however the pins are separate for Data and Power. As such whilst you can provide greater power over USB-C the Power Pins are not connected to the Data Pins ( and not a good idea to try shoving power into the Data Pins on the port on your laptop )

Data Pins and Power Pins may be in the same connector but once inside they aren't connected in a way that Data can be sent over the Power pins or Power over the Data to charge your laptop.

As such whilst it is possible to hack via the usb-c port, then it was perfectly possible over usb prior to USB-C, and thunderbolt and firewire as well.

https://techcrunch.com/2014/12/18/this-little-usb-necklace-hacks-your-computer-in-no-time-flat/

Case being the same person doing similar thing over USB-A back in 2014.

Basically if you would expect this to work over the mains power cabling then would need the USB Device plugged into something that will power it and put Data onto the Mains.
Then at the Outlet would need something that would take the Data OFF the Mains and place onto the Data Pins at the USB Outlet, as well as provide Power to the Power Pins without putting power on the Data pins Due to the nature of USB then would need one device at every outlet as such for this to work.

Again could do that with regular USB as well.

Data and Power over USB is like Power over Ethernet. In Power over Ethernet then Data Uses 2 of the 4 pairs and you then supply power over the normally unused 2 pairs.

USB-C has a 24-pin double-sided connector provides four power-ground pairs, two differential pairs for USB 2.0 data bus (though only one pair is implemented in a Type-C cable), four pairs for super-speed data bus, two "sideband use" pins, and two configuration pins for cable orientation detection, dedicated biphase mark code (BMC) configuration data channel, and VCONN +5 V power for active cables.

Power and Data is SEPARATE on the Cable, you aren't using the same Pins on the cable for Data and Power.

If you want to stop it then either use a Power Only Cable when charging, or the Apple USB-C Digital AV Multipart Adaptor as the USB-C port on that is Power Only so Data won't get through.

As such should be providing the same level of diligence as should have been doing for years.

1.) Don't plug unknown devices into your laptop
2.) Use software that controls what you can do with your USB ports ( and any other port on your laptop ) As such can block unknown devices from getting access, as in Network Adaptors etc.

Nothing NEW here

 

[Garage Battle]

so

I counter with - new MBP is safer because it has a less common USB port
[doublepost=1479432572][/doublepost]Are we able to create a whitelist of allowed USB devices. I'm not sure what serial numbers/MAC addresses dongles have.

Can we set USB devices, when plugged in, to prompt the user for approval before allowing it to work?

 

[Queen6]

so

I counter with - new MBP is safer because it has a less common USB port
[doublepost=1479432572][/doublepost]Are we able to create a whitelist of allowed USB devices. I'm not sure what serial numbers/MAC addresses dongles have.

Can we set USB devices, when plugged in, to prompt the user for approval before allowing it to work?

Moot; USB C to USB A adaptors will soon be ubiquitous.

Microsoft states: Regardless of operating system, for this to work, physical access to a machine is required. So, the best defence is to avoid leaving laptops and computers unattended and to keep your software up to date.

Personally I adhere to the above, as leaving any notebook unattended is inviting trouble, albeit more likely from the casual thief.

Q-6

 

[mcnallym]

so

I counter with - new MBP is safer because it has a less common USB port
[doublepost=1479432572][/doublepost]Are we able to create a whitelist of allowed USB devices. I'm not sure what serial numbers/MAC addresses dongles have.

Can we set USB devices, when plugged in, to prompt the user for approval before allowing it to work?

You can block off whole classes of devices with the correct software, however isn't built into the OS. Most Endpoint Security product suites have some sort of Media Encryption ( Check Points is the one work with ) that allow you to lock down what can and cannot plug into the USB ( and other ports )

 

[dyn]

Using the Apple supplied power supply isn't going to help either.

Nope, the power supply does not support data at all as it uses the standard power connections available throughout the world. It is an ordinary power supply and ordinary power supplies are unable to carry any data. Ask any electrical engineer and Google the default schematics for a power supply.

The point I'm making is the USB C connector now supports data and power, the socket used for charging your laptop is physically bridged/connected to the data plane on the logic board.

Which is no different than firewire, ePCI, Thunderbolt 1, Thunderbolt 2, etc. since these are all low level buses. The points I'm making is that this isn't new and it isn't a problem when using the power supply (as it only supports power). As always you shouldn't be plugging your device into something you don't own/control/know and vice versa.

The possibility of an security expolit is now very very possible

It is no different than before as this is just as possible with the magsafe connections. Again, we've had devices that use USB for both data and power for more than a decade (media players, smartphones). The issue has been brought forwards numerous times in that decade (with many organisations advising against using USB charging stations that isn't your own). The only thing different is that this has now been extended to the MBP.

The Raspberry Pi is another good example of a device solely powered by USB. At my former employer they used a lot of those and quite a lot of them were hacked...via the network (you know, ethernet, TCP/IP)...by SSH-ing into the RPi by using the default credentials. The solution was very simple: boot those devices off the normal network and into a secured VLAN (and whack the user when he came over to complain).

 

[jerryk]

The Raspberry Pi is another good example of a device solely powered by USB. At my former employer they used a lot of those and quite a lot of them were hacked...via the network (you know, ethernet, TCP/IP)...by SSH-ing into the RPi by using the default credentials. The solution was very simple: boot those devices off the normal network and into a secured VLAN (and whack the user when he came over to complain).

The issue there is the default credentials provided to make the Pi easy to use, and publishing those on every article about setting up your Pi.

 

[Ries]

Hello, I'm your unknown UBS-C charging outlet someone faked at the airport, btw I'm a keyboard and storage too (ok, really no, I just pretend to be)! Here, have some power. Im sending you some keypresses too to launch that malware on my storage, that silently encrypts your user files until the ransom popup.

 

[jerryk]

Hello, I'm your unknown UBS-C charging outlet someone faked at the airport, btw I'm a keyboard and storage too (ok, really no, I just pretend to be)! Here, have some power. Im sending you some keypresses too to launch that malware on my storage, that silently encrypts your user files until the ransom popup.

Why waste the effort? Just put a hacked USB-A charger waiting for someone to plug in a cell phone. And harvest from the phone online banking access codes, check images, contact information, Twitter, Apple, Facebook IDs, etc. A lot more targets than laptops.

Also, to charge a Macbook the USB-C would need to be a specialized USB-C supplying 20v at 3-5 amps. Not the standard 5V at 0.5-2.0 Amps most USB-C or -A ports have, so these charging ports are going to be much fewer.

 

[dyn]

The issue there is the default credentials provided to make the Pi easy to use, and publishing those on every article about setting up your Pi.

That's not the issue at all. There is nothing wrong with having default credentials and there is nothing wrong with it being published everywhere. Not changing it before you connect it to a network is what's wrong. The fact that they are default and thus can be found almost everywhere is THE reason why changing it should be the first thing you do.

 

[jerryk]

That's not the issue at all. There is nothing wrong with having default credentials and there is nothing wrong with it being published everywhere. Not changing it before you connect it to a network is what's wrong. The fact that they are default and thus can be found almost everywhere is THE reason why changing it should be the first thing you do.

Agreed, but think about target audience for a Pi. It is billed as a low cost educational computer. They were supposed to be giving them out to every child in the UK, they even includes one with an issue of MagPi, the Raspberry Pi magazine. A lot of them are going to end up with the default account/password and left wide open.

 

[dyn]

The articles you refer too plus the official documentation all state that the first thing you should do is change the credentials. In other words, this is part of the course material and like with anything, not following instructions/doing what you are told has consequences. They'll learn rather quickly why it says you have to change the credentials. All part of learning

In my example we are talking adults that went to university and even gotten a PhD. This is more like someone with a drivers license ignoring traffic lights.

 

[jerryk]

The articles you refer too plus the official documentation all state that the first thing you should do is change the credentials. In other words, this is part of the course material and like with anything, not following instructions/doing what you are told has consequences. They'll learn rather quickly why it says you have to change the credentials. All part of learning

In my example we are talking adults that went to university and even gotten a PhD. This is more like someone with a drivers license ignoring traffic lights.

Having graduate degrees in computer science I never equate degrees to common sense when it comes to security. I know guys with PhDs that have their Wifi router and other devices set to the default settings.

 

[dyn]

Yep, that's why we make it their problem and their responsibility (as in, it will have consequences for them).