Headlines - Infosec 2008 round-up

[HEXUS]

A walk around the show sees a PC on a flash drive, a lot of very complicated software and an unconvincing pirate ship.

Read more.

[chrestomanci]

I don’t think Hexus committed a schoolboy error by offering an unknown USB stick. If his laptop was running a fully patched and secure OS, then Toby Weiss (CEO of Application Security Inc) could have inserted and USB device into it with impunity. (Unless you had put superglue on it or suchlike).

Of course any flavour of windows cannot be considered a secure OS for USB devices, because if you plug a USB device into windows which it does not recognise, then windows will ask the USB device if it has windows drivers, and if it does it will install them without prompting the user. There is a well know hack where someone builds a USB device that looks like an ordinary thumb drive but is not. When the victim plugs it into a windows PC it offers a trojaned device driver and the PC is 0wned. Usually it will then present a filing system with some files so as not to arouse suspicion. Needless to say Linux and MacOS computers are not vulnerable.