full-disclosure - Re: Fwd: Comment on: USB devices spreading viruses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6887.1227292603@turing-police.cc.vt.edu>
Date: Fri, 21 Nov 2008 13:36:43 -0500
From: Valdis.Kletnieks@...edu
To: n3td3v <xploitable@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, soc@...cert.gov
Subject: Re: Fwd: Comment on: USB devices spreading viruses

On Fri, 21 Nov 2008 18:13:27 GMT, n3td3v said:
> Its sad when it comes to the state of affairs when random folks on a
> mailing list need to advise the u.s department of defense because
> their IT security staff suck.

Yeah, especially when the random folks don't even understand the problem space.

You ever consider the possibility that some of those machines *need* the
removable media, because they are sneaker-netting highly sensitive data
around (the sort that you'd be upset if it was on a network-accessible
machine)?  That puts constraints on what you can and can't do to secure
the removable media.

It's a bad idea to epoxy-glue the USB slots when that's the only way to
get data in or out of the machine.  Kinda boat-anchors it.

Having said that, it *is* a good idea to configure the box so the removable
media is flagged non-execute - unless the removable media includes the
executable that's the machine's reason for being, but the media has to go
back into the GSA-rated safe when you're done working with it.

(And yes, there *are* boxes out there that don't *have* permanent storage - you
have to check the removable storage in and out of the vault.)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/