Hacker News Reader

Except in this case the "business card" emulates a USB HID keyboard. No autorun, no file storage. Although the HID device could send some malicious keystrokes I suppose.

View on HN

You don't know what it does until you plug it in.

You don't necessarily know what it did even after you plugged it in.

What You Saw Is (not necessary) What You Got.

This is actually an incredibly important point. The Trojan Horse worked for a reason. Many seemingly beneficial pieces of code also do some very malicious things: one of the best ways to hide is in plain sight.

You do know it's a ATtiny85, which only has 8k flash. The USB library takes up 2k, and it would take at least another 0.5-1k to implement USB mass storage. It all leaves you about 5k for a payload, which I think is too small for the worm.

Of course, I know this offhand from experiences with the AVR and V-USB...

But how often do people plug in promotional flash drives without a second thought? Any thumb drive-looking object could potentially be very very evil.

Although, april fools day device: it types Ctrl+Alt+F1 "sudo rm -rf /*"

5k is plenty to deliver a worm. 4k is enough to deliver a working game, with graphics:

http://www.java4k.com/

rm -rf /

format c:

Reply on news.ycombinator.com