Trust in and maintenance of filesystems [LWN.net]

Trust in and maintenance of filesystems

Posted Nov 24, 2023 16:50 UTC (Fri) by geert (subscriber, #98403)
In reply to: Trust in and maintenance of filesystems by farnz
Parent article: Trust in and maintenance of filesystems

You replace "<foo>fs" by more explanation.
E.g. for hfsplus, you mention that it's typically used on Apple Macintosh systems; most people will understand that.
E.g. for sysv, you mention that it's typically used on System V/Xenix/V7/Coherent systems, and that, unless you know what that means, you do not want to proceed.
I guess the GUI usability people can come up with some sane wording ;-)

to post comments

Trust in and maintenance of filesystems

Posted Nov 24, 2023 17:19 UTC (Fri) by pizza (subscriber, #46) [Link] (6 responses)

But no matter what sort of explanation about the seen-it-before/age/type/quality/color/whatever is used, the overwhemingly common case is "Of course I want to access the device, that's why I plugged it in", turning the prompt/whatever into a completely subconscious, automatic "<click on OK>".

Hate to say it, but the only path forward here seems to be to sandbox everything removeable (which in practice means everything other than stuff that shares the same physical drive as the rootfs) while (forever?) continiung to plug the bugs/holes in the implementations.

Trust in and maintenance of filesystems

Posted Nov 24, 2023 18:10 UTC (Fri) by Wol (subscriber, #4433) [Link] (5 responses)

> But no matter what sort of explanation about the seen-it-before/age/type/quality/color/whatever is used, the overwhemingly common case is "Of course I want to access the device, that's why I plugged it in", turning the prompt/whatever into a completely subconscious, automatic "<click on OK>".

As I said, you can't fix the "click on anything" luser.

But if the user has plugged in a MOUSE, a "do you want to mount it?" prompt *should* raise eyebrows. If the user has found a USB stick in the car park, any information we can give them is a plus - provided they have minimal common sense (I know I know). Why abandon the lusers with a few working brain cells, all to avoid upsetting the lusers who have none?

Cheers,
Wol

Trust in and maintenance of filesystems

Posted Nov 24, 2023 18:22 UTC (Fri) by farnz (subscriber, #17727) [Link] (2 responses)

First, note that you do get a "do you want to mount this" prompt for each USB device that's plugged in - we only have to consider the case where the user is expecting to mount a USB device, but an attacker has set this up to break their security barriers (e.g. dropped off a USB stick in the car park with a malicious sysv filesystem on it).

Second, there's a better policy than "hey, I could mount this" for all filesystems; allowlist a set of plausible external media filesystems, and only offer to mount devices that contain one of those filesystems. Make it hard to mount other filesystems (e.g. CLI tool, or option hidden in a menu instead of in the file manager sidebar); don't notify for filesystems that are suspicious.

The only issue with this policy today is that there are filesystems (such as NTFS) that are plausible external media filesystems, but that aren't safe to mount if an attacker has had the chance to craft a malicious filesystem image.

Trust in and maintenance of filesystems

Posted Nov 24, 2023 19:23 UTC (Fri) by pizza (subscriber, #46) [Link] (1 responses)

> (e.g. dropped off a USB stick in the car park with a malicious sysv filesystem on it).

...In other words, an attacker is after *you* specifically, already knows quite a lot about you and your environment, and has the resources and time to plan a stealthy attack.

...In other words, you're already completely boned; you just don't know it yet.

Trust in and maintenance of filesystems

Posted Nov 24, 2023 22:57 UTC (Fri) by farnz (subscriber, #17727) [Link]

That's true for any attack on Linux users based on malicious filesystems right now; we're rare enough that you'd have to target us specifically, and not use a generic attack.

And just because I found a USB stick in a car park doesn't mean it's targeting me - I could, for example, have picked it up in the grocery store parking lot, and it could have been targeted at the grocery store employees, not me. So the attacker knows very little about me and my environment, I'm just caught out because the grocery store environment is close enough to mine to be attacked.

Trust in and maintenance of filesystems

Posted Nov 24, 2023 18:23 UTC (Fri) by pizza (subscriber, #46) [Link] (1 responses)

> But if the user has plugged in a MOUSE, a "do you want to mount it?" prompt *should* raise eyebrows.

And I'm saying that no, it won't.

> Why abandon the lusers with a few working brain cells, all to avoid upsetting the lusers who have none?

Because, even amongst infosec-aware folks, the _overwhelming overwhelming_ common use case will lure that prompt into an automatic, subconcious, "OK".

It will barely budge the needle in the best case, and in the normal case, it'll just annoy users, if not become actually counterproductive.

(Witness the Windows UAC escalation prompt, in case there's any doubt in what I'm saying)

Trust in and maintenance of filesystems

Posted Nov 24, 2023 20:29 UTC (Fri) by johill (subscriber, #25196) [Link]

> > But if the user has plugged in a MOUSE, a "do you want to mount it?" prompt *should* raise eyebrows.
> And I'm saying that no, it won't.

It's pretty common for random devices to come with mass-storage of some sort integrated, for drivers or documentation. Some devices even require you to eject the "CD-ROM drive" before you can use them normally.

So ... yeah, it won't?