ShmooCon 2011: USB Autorun attacks against Linux

Speaker: Jon Larimer

Many people think that Linux is immune to the type of Autorun attacks that have plagued Windows systems with malware over the years. However, there have been many advances in the usability of Linux as a desktop OS - including the addition of features that can allow Autorun attacks. In this presentation, I'll explain how attackers can abuse these features to gain access to a live system by using a USB flash drive. I'll also show how USB as an exploitation platform can allow for easy bypass of protection mechanisms like ASLR and how these attacks can provide a level of access that other physical attack methods do not. The talk will conclude with steps that Linux vendors and end-users can take to protect systems from this threat to head off a wave of Linux Autorun malware.

For more information visit: http://bit.ly/shmoocon2011_information
To download the video visit: http://bit.ly/shmoocon2011_videos

• Category

  Science & Technology

[kyuznum1]

This is by far the best SchmooCon talk on USB Autorun attacks I've seen this morning.

[reya10276]

blah blah blah...Sure if your Linux/Ubuntu system is not patched then sure you would be in trouble otherwise nothing to see here move on folks. Linux/Ubuntu is still way more secure than any windows version by default. So lets simmer down windows fanboys. Also Ubuntu is secure with app armor, hence is one of the main things Ubuntu emphasizes on in their advertisement of Ubuntu. Also if and when this suppose attack would happen it wont affect the actual system at the root level.

[galenrivera512]

I want this video on my GU1100 phone.

[siodhe]

The problem with that plan with regards to xlock, namely killing the xlock and then putting up a fake one with a fake login window (if I'm interpreting your correctly) is as I said: The access list has been wiped from the X server - *nothing* could access it at that point, the X server had to be killed to continue, logging out the user's session in the process. And TheMegentus mentioned that killing the screensaver would kill off the session directly, an even more direct approach.

[MsPwain]

Thanks for making Linux more secure and me a bit smarter. Good talk.

[frenchpet]

This is cool

[Fredderic Unpenstein]

Interesting talk... I am curious, though, when I was last using Debian, killing the screensaver caused the entire session to get killed, giving you a nice new login prompt, on a fresh X server. Doesn't that happen any more in modern installs?

[siodhe]

Hi :-) Many linux users don't run the user level tools (nautilus..) in the exploit, completely removing this vector. The older xlock program would wipe the access list, and so when killed would leave the X11 server unusable (obviously the modern screensavers need to be updated to the same destroy-access mentality). The TCP port mentioned in the demo in disabled by default in Xorg (the X11 server). And lastly, remember these exploits only grant user access, not root (although closer to root)