[1352] I Got Rick-Rolled Via Mail (Locking USB Drive)

[@markhudson2088]

"Just because you're paranoid doesn't mean they're not out to get you" is actually a good approach to IT security ;-)

[@Black-Swan-007]

Gibbs' Rule #40: If it seems like someone’s out to get you, they are.

[@kosmikme]

@@Black-Swan-007 if you run a company, someone is out to get you

[@dimesonhiseyes9134]

@@kosmikme if you live anywhere other than a third world country someone is out to get you.

[@galiojusticejustice3191]

Exponential paranoia

[@charleschapman2428]

Conspiracy Theory, great movie.

[@tobidobidu1129]

"Don't inject random needles you find on the street into your body!" "Wow you must have a really bad immune system."

[@water5210]

Here's some HIV!

[@feathero3]

That's a perfect analogy!

[@MultiDean1980]

I work in IT and this analogous comparison fully checks out.

[@DannySullivanMusic]

lolol this comment rules

[@jmolenaar]

This is literally the best comparison I've seen for this

[@wolfdale_3m]

"This is the Rick-Rolling Lawyer, and I'm here to defend your case and never give you up."

[@relevantinformation6655]

🤣😂🤣🤣😂🎶

[@vortiez.]

DANG IT

[@Jesus_Offical]

And Never Let you Down

[@eyebags2860]

And never gonna make you cry

[@chrism.1749]

@@eyebags2860 And never say goodbye

[@SleepyNoid]

As a cybersecurity professional, I just HAD to comment a quick thank you. Education about these types of things is the single best defense against them. People are always the single biggest point of failure, and anything we can do to be better educated about the risks that are out there, the better off we as a society are as a whole.

[@catwiesel_81]

no dont be ridiculous. if people were the danger, then we would get attacked all the time. with mails, and phone calls. heck, you could throw usb drives with malware on the parking lot. there would be a word for that. like people hacking or people engineering, since its not exactly hacking, although, come to think of it maybe its more a social thing then just "people". but ive never heard of people hacking, so, its not happening. also, if it was that easy, stuff would get hacked all the time. which it doesnt. not like a company like, say, adobe, would lose all their customer data, and no one would know... /s

[@rix1602]

They are the reason why our IT service disabled USB drives usage from our computers. Tbh, if someone were to plug a fake USB stick, it could still do damage. But people are less likely to do it because there is no reason to do it.

[@Tralin]

@@rix1602 Why is there no reason to do it?

[@rix1602]

@@Tralin because it wouldn't do anything.

[@Tralin]

@@rix1602 USB Rubber Ducky is a fast way to totally compromise a computer and gain a persistent foothold in a corporate network...

[@tomnovak6649]

Forget the risk of opening malicious USBs… I’m surprised so many people clicked on this video knowing there was a risk of being Rick-Rolled. Brave souls indeed

[@TheRealColBosch]

It's only a Rick Roll if it's a surprise. If you're forewarned, then it's just watching a music video.

[@HaggisMuncher-69-420]

I was hoping to see him load the USB in real time so I can hear his reaction but no such luck

[@mudalaca01]

i watched the video hoping for a rick roll, love the song

[@Ghryst]

just as with trolling, which is what rickrolling is, if you are aware that a rick is involved, its not rickrolling.

[@hojdog]

We know the game and we’re gonna play it

[@DFiNEdotnet]

As an IT Administrator, im so happy to hear people like yourself, warn about the dangers of unknown USB devices. Awareness of such dangers, is the only way to avoid them!

[@president8]

Wish my clients could understand that too. Last week, an important shared drive on my network with some hundred gigabytes of data was about to get lost, thanks to replicas, daily backups and powerful Antivirus, I'm still at the place now! (reason was one of my client's computer having a virus that was trying to spread though the mapped share drive)

[@HansDampf1911]

As an IT administrator myself I find it staggering that other IT "specialists" aren't able to inspect such sticks with a simple old offline throwaway pc. We do this at work since 2005.

[@DFiNEdotnet]

@@HansDampf1911 while i agree, this channel is not about computers and technology - And that's a viable excuse for not doing so, in my opinion:-)

[@tc2241]

@@HansDampf1911 we called ours the ‘bomb disposer’, we would rotate scrap components and usb hubs.

[@yukonfarnsworth1688]

No, you just test it at a internet bar.

[@Cattyclysm]

It's like "I'm not scared of a USB drive, I'm scared that it's *not* a USB drive."

[@ThatOneTruckGuy]

This.

[@gigaatom]

"Nah bro u don't get it my PC doesn't use electricity I'm literally immune your rig sucks"

[@wahyuhendrohartono7362]

this is the truth

[@robertwyatt3912]

@@gigaatom bro I use a quantum computer from 2040 that runs windows Xp 2. ur rig sucks.

[@lilchromie]

Bro it's just gonna download some more ram for you don't worry

[@noahkuschel5547]

One time in my freshmen year of Uni, I was taking a programming course. I didn't have the coding program and asked the person next to me where I could get it. They offered me a USB drive claiming they had it on their drive and I can download it if I want. I thanked them and plugged it in. My computer's volume shot to max instantly and a window opened playing rick astley which couldn't be closed. I turned to him and he was howling with laughter and said "you shouldn't trust anyone with a USB, that's my own homemade virus!" I was annoyed and asked him "How do I get rid of it?" and he chuckled before telling me he programmed it to self destruct on restart so it will delete itself when I turned off my computer. He told me that he made it just to teach people not to trust drives from strangers

[@danielthecake8617]

Liar

[@noahkuschel5547]

@@danielthecake8617 if you say so. You don't have to believe me, the guy was going to uni for cyber security, but was also a grey hat hacker who did it for fun

[@yvrelna]

That wasn't really "teaching people not to trust drives from strangers", that's just being annoying IMO. You weren't really strangers, you were classmates. You were asking legitimate question in a context where you should be able to assume that people would be trustworthy enough to give reasonable answer. All that he's teaching is that he is not to be trusted.

[@TestTestGo]

Yep. Lesson learned. Siri take a note: "This guy is a dick, stay away from him" Problem solved. Practical jokes are almost always a strong indicator that the "joker" is a dick and best avoided.

[@danh7647]

Thats a good lad. Not even a dick for putting a virus on your computer

[@codydaily3807]

I'm a cybersecurity professional by trade. When doing user training on computer security and awareness I would often leave unmarked USB sticks in the breakroom, front lobby, or parking lot. The USB would run a script when plugged in that would send me the MAC and IP for the endpoint it was plugged into and display a message to the user letting them know they needed to contact me. Always be wary of something you are inserting into your high value assets. Common sense.

[@Gnarkson]

I inserting my ispen in some values

[@markm0000]

Unmarked? That could stop some people that are smarter than the average bear. If it has a Kodak or Polaroid sticker on it with a vacation amusement park lanyard everyone will try and see what pictures are on there. Gets them every time.

[@someperson7]

And that is why you glue USB to PS2 converters into 2 ports and manually disconnect all others.

[@homunculus777]

Always be wary of something you are inserting into your high value assets. Words to live by.

[@fukumarkzuckerburg]

reminds me of a cyber security specialist my company hired to teach us older folks why USB attacks are the most insidious and dangerous. guy left USB sticks in the most random of places, with a first name of one of my co-workers or myself on some, stickers on others, vacation lanyards, hell, in one case an outright response code from our firm. any time one was plugged in, it would start blaring the word dumbass paired with a loud siren from the computer it was plugged in to and couldnt be shut off.

[@AtomicShrimp]

I feel your pain. There just seem to be people out there who react to any sensible security message with scorn and skepticism, as if they believe themselves invulnerable.

[@judewaide8328]

Love your vids!

[@drosselvonflugel4886]

John Warosa thinks he is invulnerable

[@robertketch8508]

Hi atomic...ive been searching for you sir to give you a 1000,000,000 inheritance... Just send all those details you should never share😂😂😂😂 great content creator seriously 👍

[@grootsChannel]

Hey, when I'm done with college I want to move to England, could you do a video about daily life over there?

[@Wheres-my-toes-bro]

I've got a craving for Marmite

[@blarghmcblarghson1903]

"Your computer must be poorly configured if you're afraid to plug in a random USB stick," say people who fail to understand the weakest link in all IT security is the _user._

[@simonspacek3670]

Yes, the computer security is on such a high level that all brute attacks are pretty much obsolete. Bypassing security is next to impossible. Still, there are even IT professionals who think "hey, this is a good, 20 characters long random password, I type it in multiple times everyday so I remember it, let's use this on this shady porn site as my password. Oh, and because my wife can check my emails on our home computer, I will use my work email"... Is it still phishing when somebody gives you all details on his free will?

[@TheJECNova]

@@simonspacek3670 knee-jerk response was, "People (idiots) still use a single password and permutation?" But, recalled immediately people do. (Myself, I've a range if passwords and a horrifying number permutation for EACH ONE. lmao.)

[@mrkthmn]

Kevin Mitnick would agree!

[@pwegulian]

@@simonspacek3670 that’s not exactly true. Brute Force attacks are completely viable against something that doesn’t limit login attempts and even if they do, depending on the configuration of a website a rainbow table can be used to crack passwords. Hacking has always been depended on what exactly you are attacking and then finding the vulnerabilities. Malware on a usb can infect someone’s system if it exploits a vulnerability in their operating system, (of which there are many in every version of every OS). The USB stick is just nice bait.

[@simonspacek3670]

@@pwegulian Brute force on 22 characters? Estimate time for this with unlimited tries is 2.9*e29 (or infinity and a half or 29 and hell lot of zeroes), just because it takes that long to put in the characters. And yes, I know, my example started with "I", so we will get there in about a third of that, so it is "only" about 10 and a 28 zeroes. It looks like this: 100 000 000 000 000 000 000 000 000 000 years. Even if the technology moves forward a lot and you will be able to put in the passwords million times faster, I still have a lot of zeroes to be safe. Another million times faster? Still 19 zeroes. But I take that there will be a major breakthrough and your computer will be billion times faster in both cases. I still have 13 zeroes. Even bigger breakthrough, trillion times faster input, twice. And I still have 7 zeroes. 100 000 000 years. I don't worry about brute force, I worry about placing strategic people in service desks, that is the easiest way in. One guy in the company to know where to strike, one guy at service desk to know how to strike.

[@randmayfield5695]

I am a retired high school teacher and remember a time back in the late 90's when the district computer network got the "I love you" virus email. This drove IT crazy for several months. What teacher isn't going to open something like that up? Despite a district wide effort to educate staff not to open this virus infected email, somebody would always do so. "Oh, look, somebody loves me! I am gonna open this"... and there goes the network. Lol

[@jayhache5609]

That says a LOT about teachers… but is not surprising.

[@maskedbadass6802]

@@jayhache5609 Lol, so many of them just do it for the paycheck and the few who actually try to go above and beyond to help kids just open themselves up to a bunch of liability, especially male teachers. On the other hand I remember one time one of our female teachers and a student got into the most awkward fight in the middle of class that was obviously over something that they had said or done in private because there was no logical reason for them to be upset with each other. She eventually pulls him out of class so they can talk in the hallway and in the eerie classroom silence that followed without a word everybody was thinking the same thing, "Are those two secretly having sex?"

[@mrcvry]

20-30 years later and nothing has changed. EMail is still the #1 entry for malware.

[@saphiriathebluedragonknight375]

My mom's a teacher, and she's pretty tech savvy. Of course it helps my dad is an expert. Something my younger brother inherited.

[@haroldsturm7961]

I had a friend that got that while I was sitting in his office. He said "Oops, that's a virus". How do you know? He said "It says I love you, it's from Dave in personell. He doesn't love me he hates me, actually." It got deleted.

[@dcraig4]

Plot twist: Rick Astley is a fan and actually sent this in. Now he's deeply disappointed that he didn't get to tell LPL that he'll never let him down.

[@crimsonhalo13]

And by doing so, he has let LPL down and branched the timeline.

[@imgladnotu9527]

@@crimsonhalo13 d-mail toime yet again

[@NapalmLlama]

He's never going to give him up, either. Expect many more drives in the coming weeks and months.

[@vbscript2]

haha, I was thinking this same thing. Poor Rick is a fan, sent a lock in for free, and got his music dissed in return. :/

[@SurotaOnishi]

@@crimsonhalo13 great now the TVA have to deal with a variant Rick

[@YuBeace]

I don’t know what’s worse. Getting Rick Roll’d when you don’t expect it. Or expecting it and then not getting anything at all…

[@sidewaysvertical2138]

+YuBeace....What's worst is you taking the time to ponder those two scenario's instead of just dismissing them both by shining them ON!!

[@doubtful_seer]

We're no strangers to love You know the rules and so do I A full commitment's what I'm thinking of You wouldn't get this from any other guy I just wanna tell you how I'm feeling Gotta make you understand Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you We've known each other for so long Your heart's been aching, but You're too shy to say it Inside, we both know what's been going on We know the game and we're gonna play it And if you ask me how I'm feeling Don't tell me you're too blind to see Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you (Ooh, give you up) (Ooh, give you up) Never gonna give, never gonna give (Give you up) Never gonna give, never gonna give (Give you up) We've known each other for so long Your heart's been aching, but You're too shy to say it Inside, we both know what's been going on We know the game and we're gonna play it I just wanna tell you how I'm feeling Gotta make you understand Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you Never gonna give you up Never gonna let you down Never gonna run around and desert you Never gonna make you cry Never gonna say goodbye Never gonna tell a lie and hurt you

[@MartijnCoppoolse]

@@doubtful_seer Thank you for not letting us down!

[@sidewaysvertical2138]

@@doubtful_seer....WOW that's DEEP!!

[@theoneet3162]

@@doubtful_seer thx for that was waiting for someone to do that

[@jManAscending]

The entire point of this channel is showing that physical security is usually lacking, and can almost always be bypassed in some way. Why would people who often watch this channel think that digital security is any different?

[@YOEL_44]

Killing phisically a computer is not considered a digital threat anymore

[@caseyleenb]

digital security is worse arguably. it just takes one person with a quantum computer to destroy most security on the internet.

[@YOEL_44]

@@caseyleenb I don't know if you're joking, or just somewhat dense. A quantum computer is not something you buy in a grocery store, nor something you operate like a smartphone with a nice GUI and a touchscreen.

[@tyralexander]

@@YOEL_44 I think you're the dense one here; since I doubt he was implying that any regular person could just go pick up and assemble a quantum computer like a LEGO set, proceeding to then take over the world in a matter of days through the knowledge gained from watching a KZbin tutorial from 2012. What I'm assuming he meant is that if someone (or a team) not only knew how to operate a quantum computer, but owned one, they could probably demolish most security options available on the internet with ease.

[@RomeoAirsoft]

YOEL _44 Pretty sure he just meant a powerful/good computer, not specifically a quantum computer.

[@rustbucket1043]

People who think they're invincible against malware from things like thumb drives need to know one thing: The first ever randsome-ware attack happened with Floppy Disks. If Floppy Disks could do it, a thumb drive can

[@MrAkurvaeletbe]

ransomware

[@CashIsKing_UseItOrLoseIt]

@@MrAkurvaeletbe - it's probably just a very good looking piece of ransomware.

[@Reddotzebra]

Reminds me of that guy that created a virus that would force you to complete some crazy difficult tohou bullet hell video game in order to get your files back. He made the thing as a joke and then managed to accidentally infect his own computer, and he wasn't good enough to beat the game.

[@atcpadi1]

Degree in Cybersecurity management and policy - most people do not in fact realize the threat of USB drives. I was already excited one of favorite channels talked about that, then when you pulled out the USB killer I was even more excited!

[@cladbecaha]

Wow! A degree. You must know what you’re talking about.

[@billionai4871]

Degree in Computer Science and interest in cybersecurity: you are NEVER covered, you can only decide what threat level is acceptable to you, and "i'm curious about what is in this drive" is a very low bar for the threat of killing a computer or USB threats. if you assume you are secure enough to do you are asking for trouble

[@Skyhawk996]

it's a bad idea in general.. the D.O.D had USB slots on their computers. These were removed dew to people not realizing the risk. Surprising someone that is an highly educated electrical engineer made this mistake. Everyone makes mistakes tho

[@TroIIingThemSoftly]

@@cladbecaha It's hilarious when the uneducated try to highroad those who are.

[@thekinginyellow1744]

@@TroIIingThemSoftly I don't have a degree in cybersecurity, but I've been doing computer work since before such degrees became available. In my experience, whether or not you have a degree is largely irrellavent to how well you can do computer security. Experience, common sense, and intelligence count for much more. OTOH, Having a degree certainly makes it much easier to get a job in computer security.

[@JoakimKanon]

Rick Astley: ”Why did you not use my USB stick?” LPL: ”You know the rules, and so do I.”

[@welshdave5263]

Genius!

[@mousermind]

Beautiful.

[@MK-fy8uz]

lol :D

[@Xezlec]

I read that in LPL's voice and it is perfect.

[@Feuervix]

🔫😀say good bye i hate the fact that the gun is pointed to the left, its look like im shoting at Myself/myPFP

[@teambengkong6297]

I love it when he's so calm while roasting people

[@KnockedupNout]

This is my favorite kind of person!

[@MrJimmyWalsh]

That's what Will Graham said.

[@kabosui]

ikr, but a good lesson on malicious drives

[@josueanguiano2165]

Never give your energy to haters, it’s not about the thing it’s about your reaction that they crave.

[@flopdoodle8056]

420 likes nice

[@joaq.]

I’m actually so surprised how many people told you that its ok to plug in random USB drives into your computer. LOL! I thought the whole random USB thing has become an outdated anecdote from my cybersecurity professors

[@TomJakobW]

I found it really funny: commenters saying “aaah, don’t be a wuss, is your Pc so badly set up?” Thinking the only barrier necessary is disabling auto start, only to get lectured about things they just didn’t know, like usb disguising as trusted peripherals (i didn’t know that either). Dunning Kruger Karma!

[@MarkusMahlberg]

I wish it was. It isn't. "Hey, I found this shiny USB drive and it says 5TB on it! That's giant! Fuck this, I am going to keep it. I just stick it into my computer and erase.... Holy F...!!!" With a laser engraver and cheap thumb drives with anodized aluminum bodies a dime a dozen, simply adjust the storage capacity to any ridiculous amount appropriate for the time.

[@dburris718]

I can’t believe there wasn’t even at least a still image from the music video at the end. My disappointment is immeasurable

[@_Roboute_Guilliman_]

He should've started this video with the rickroll clip tbfh! 😂

[@tungdinh4114]

and my day is ruined

[@Repaurcas]

@@tungdinh4114 you beat me to it

[@earthknight60]

@thanks Dude, stop spamming everyone with that video.

[@jackedward293]

You took the words right out of my mouth

[@brucerm01]

I can't believe LPL doesn't trust a USB sent from Rick Astley himself.

[@eclipz905]

It contains a collection of all his favorite Pixar films, barring one notable exception.

[@josiahb.8611]

@Thx ❤ You're aren't Rick Astley so I'm not clicking that!

[@kinyutaka]

@Thx ❤ Hey, stop that. We are here to see a lock fail miserably, not to he converted to Islam.

[@Rob_Enhoud]

Seriously, when has Rick ever let you down? Never.

[@battlesheep2552]

What is he, some sort of stranger to love?

[@OmegaGamingNetwork]

25+ years of IT and it still amazes me how stupid people are when it comes to just plugging whatever into their computers. Thank you for calling this kind of stuff out.

[@MrElgate]

Same. I also work in IT. We had an attack a few month back and fortunately the backup database was saved, but much of the shared folder got lost. Fortunately, we've had the pleasure to see positive change with the issued warning to ignore link in mail that do not come from a company we work with, from a name we know is from said company. Including from our own. Well, someone tried to pass for our CEO but used Gmail instead of our own mailing service. I must say I'm surprised it did not work, as myself would probably not have been too careful as I work closely with the CEO and I know he's prone to make changes, and send mails with link without warning.

[@GerblerM]

BUT BRO I got the latest norton antivirus so I'm good! Only a real dumb-ass would get their pc hacked by a USB drive, like... just turn on your firewall! I took a typing class at my community center so I'm kind of a computer whiz at this point.

[@Schdcdd]

7 years into IT, I can totally see how people can be stupid when it comes to computers although, I'd like to break the stereotype here an say that most problems are not caused by users, they are caused by shitty IT people. I think I detest IT admins more than I detest users.

[@clankinghd9177]

@@GerblerM Your firewall only defends you from incomming stuff over network but still... Your computer can easily be infected (no matter how good your "security" is) by USB drives like a rubber ducky (keystroke injection), if you plug it in while on an admin account then it can freely execute any powershell command as admin :)

[@OmegaGamingNetwork]

@@Schdcdd oh yes there absolutely are an over abundance of shitty IT people.

[@theuser810]

Inserting random USBs into your computer is the computer equivalent of picking random unidentified mushrooms and ingesting them.

[@WhoputhisXhere]

I think this is the first time I’ve felt disappointed I wasn’t Rick rolled

[@ryans6265]

I was waiting and waiting and nothing.

[@Dowlphin]

@@ryans6265 Don't give up just yet.

[@Juukez]

This was an anti Rick roll lol

[@FFVison]

I watched the video and even though I wasn't Rick Rolled, I know that LPL would never let me down... or run around and desert us

[@yaboi7239]

@@Dowlphin don’t worry I’m never gonna give up

[@limiv5272]

LPL is obviously right not to put those USBs into his computer, but I really hoped he'd get some old worthless computer just to show us what was on those drives

[@dan8ball22]

yep

[@rico76]

I sure he has dummy setups solely for that purpose now.

[@Scynthius137]

Like a Raspberry Pi 3. $35. Most viruses don't know how to infect a Linux computer.

[@Dalixam]

He did mention in the comments of the original video that there was some dodgecoin on it. He gave the amount in usd and then some to a charity.

[@gurr1264]

@@Scynthius137 Linux is way more spread (all those android devices) and it is a sweet target for criminals since a LOT of people think that you don't need protection if you use Linux. You are helping bad guys by repeating this "Most viruses don't know how to infect a Linux computer" mantra. All you need is 1 virus to lose all your money, passwords, private videos? etc.

[@michalpolak5864]

As someone who made his bachelor thesis about this, i have finally found someone outside IT security, who understands...

[@alphagt62]

I recall a story about the Iranian nuclear program. They had this facility in a small town, supposedly secret. The computers at the site were on a private network, no way to access over the internet. So, they dropped a thumb drive on the sidewalk in town, with a malicious virus on it, and sure enough, someone found it, and took it to work and stuck it into their work station! It took them months to recover their computers, and important data never recovered. Like that old saying, “curiosity killed the cat”.

[@erg0centric]

How did you get approval to base your thesis on the Rickroll?!?

[@Si74l0rd]

@@alphagt62 As far as I'm aware several were seeded in the immediate environment, but the likelihood is that someone walked one in intentionally, from what I've read about the centrifuge attack at Natanz, and background on Stuxnet generally. The story about seeding drives in the immediate environment is a good cover though.

[@infinitivez]

I bet the sourcing for that thesis was fun!!! (I'm a nerd, I know. Things like this I can read ALL DAY LONG) Hey, if you wanna share, I'd love to read it? If not, I'll understand.

[@ethelryan257]

How do we know know our host doesn't work in IT security?

[@nightfox6738]

As he gripped the usb with the pliers I half expected "Little click on 1, 2 is binding..."

[@Shenorai]

I gotta say; even if it's not a serious security device, I really appreciate the design of the pocketwatch lock. I can see that being a trinket used in, say, a codebreaker ARG.

[@susanavenir]

Yeah, I'm sitting here going, "Where can I get these?" LOL

[@strogonoff1121]

@@susanavenir WE NEED INFORMATION

[@Kitarinki]

@@susanavenir SAME

[@Bane_Amesta]

I want this as well, along with that criptex USB ❤ And if you don't trust the original USB, I bet it can removed and changed for a different one too

[@theinstitute1324]

Oh shit yeah definitely. That would be awesome.

[@whiski8357]

It's literally saying: "I won't get hurt if I get stabbed with a rusty knife, I've got a good immune system and tough skin" Lmaaaooo "Noo, you just have bad PC"

[@NearEDGE]

It's more like saying "I won't get sick if I eat random food I find laying around in public" while you probably won't, you just might and also you might eat something that's laced with poison and die.

[@Seb135-e1i]

@@Jermain-cz4bh For the same reason someone with fill a fake USB with capacitors.

[@lonerider92]

No, just good security practice. Tell me, would you brush your teeth with a tooth brush you found on the ground?

[@faz269]

Omg you really want to eat a food that's say eat me on the side walk?

[@ZelenskyPlane]

@@Jermain-cz4bh have you gotten food poisoning?

[@MikkoLaulainen]

I'm so proud to see how far people go for this one meme, it's my favorite running gag ever

[@MikkoLaulainen]

@thanks kzbin.info/www/bejne/moLaZapvjMyLmbM

[@Le_Comte_de_Monte_Felin]

3,000 years from now... on a colony lightyears from earth... people will still be getting Rick-Rolled. By that time he'll be part of the old-Earth mythology right alongside Zeus, Apollo and my cat.

[@Wampa842]

@@MikkoLaulainen kzbin.info/www/bejne/Z5C9ZqRnapd6ibM

[@jimbob1103]

There's even a world record for most done in a day, and to make it better when the Guinness committee asked the guy applying for the record what a rick roll was he rick rolled them too.

[@goodknightcarolina]

We’re never gonna give it up and It’s never gonna let us down.

[@ZenithWest169]

If I had a USB "KillSwitch" I'd definitely want to have it with one of these fancy "locks"... First it prevents the accidental usage if someone stumbles across as they'll have to either force it open or "pick" it, but if stolen the satisfaction of knowing it will most likely fry the computer of the thief is of some consolation.

[@georgiykireev9678]

Consolation. Consultation is when you get advice from a professional

[@ZenithWest169]

@@georgiykireev9678 lol I didn't even catch that (probably as it's the last word).. tbh I did what I normally do and let autocorrect correct my first spelling attempt but didn't notice it being the wrong word all together

[@nesyboi9421]

I'm curious to what would happen if you plugged it into a phone charger and then the wall. Probably not good things but I'd like to watch the fireworks.

[@ZenithWest169]

@@nesyboi9421 worse case scenario is it causes the wall charger to catch fire... At the high school I work with, a students wall charger was plugged in next to a couch and caught fire (luckily they were next to kitchen with fire extinguisher and it was put out quickly)... As far as going back into the electrical outlet, it wouldn't do anything to mains I'd imagine... Worse case there is just tripping a breaker but I'd imagine the internal wiring of a house could handle the charge.

[@LiEnby]

@@nesyboi9421 dont phone charger has data lines tied to ground? so nothing?

[@nevermore0]

That combination lock may not be a "serious security device" but it's still a thing of beauty.

[@Nachesko]

I dont understand why he says so if opening that lock took more time that opening a master

[@Wishbone1977]

@@Nachesko Probably because opening it requires no tools of any kind, meaning even if it takes a (short) while to open, anybody could conceivably do so at any time with no preparation.

[@xxportalxx.]

I mean just looking at them they're pretty obviously just for show, I'm sure there are far better approaches for practical security you could install on the drive, in fact I remember using an encryption software on one once to hide a friend's porn stash for him back in the day haha absolutely no recollection of how it worked tho, like if you needed an app to decrypt it on the computer or not...

[@travcollier]

Nothing wrong with "not a serious security device" unless it is trying to pretend to be a serious security device. IMO this thing is fine cool looking toy. I like cool looking toys. ;)

[@Wishbone1977]

@@travcollier Indeed. I wish he'd spent a bit more time on showcasing the device itself, instead of glossing over it like he did.

[@rusalex9902]

Someone tries to jokingly rickroll LPL LPL makes a lecture about electronic safety

[@quatrinavr8704]

And we expect nothing less from LPL. He is our security ASMR

[@dmkfwolf2669]

@thanks Stop the spam with the toilet sound.

[@dracula3811]

@@dmkfwolf2669 I've gone through and reported all their posts I could find.

[@shannon9993]

It's great. I'm all for this

[@harshmallow6882]

@thanks please tell me you didnt monetize this

[@FractilOpacity]

The people saying your security isn’t setup right have no clue about IT security. You’re totally correct on NEVER trusting a USB you find/is delivered to you by an unknown source. Executives have been fired for such offenses.

[@NGMK]

Of course they were. Corporate makes regular, mandatory training for all employees detailing these kind of threats. There's absolutely no excuse for making this kind of mistake.

[@humanspida]

if you really must investigate the thing, do it properly and be sensible. Do as LPL did and remove it from the housing and inspect it first, then use something like a cheap ass Raspberry Pi that's not connected to anything to plug the drive into so you can take a look at the contents - if it passed inspection and is actually a drive instead of an electrical discharge device.

[@gnuthad]

@@Si74l0rd "On most decent quality motherboards the USB ports are fused, so if you insert a USB killer all it will do is trip the fuse. " Firstly, the data lines aren't fused because they don't carry power. Secondly, fuses operate to protect against excessive current and do nothing against high voltages. Thirdly, The devices described are capable of charging up from the 5V USB power and then stepping the voltage up internally to 50V or more. This voltage is then used as the source for the final step-up stage where the stored voltage is amplified 4-5 times to give a few hundred volts injected onto the data pins.

[@Sethjxl]

@@gnuthad This is the correct response. I've not seen a consumer device yet that is able to defeat this type of attack.

[@Reziac]

@@gnuthad Well, that sounds painful... might give a nasty jolt to a human in contact with the wrong part, too. Wonder if these things have ever started a fire in the PC. Thanks for the info.

[@Trialnerror]

The main reason I like the LPL is he never gives up on a lock....never gonna let you down. Or run around. Or desert you.

[@allen_p]

Oooooooo! That song is in my head. Your virus comment got me

[@MissingRaptor]

😄😄😄

[@Unknown-2]

HOW DARE YOU

[@sarahprunierlaw9147]

+

[@sultanofsick]

go sit in time out

[@kernel_panik4558]

As a cybersecurity professional I love that you broke this down barney style for everyone. This literally cannot be reiterated enough. Do not plug unknown devices into any computers and don't click unknown links.

[@finkelmana]

I have been in IT for 20+ years and I have seen it all. You can reiterate all you want, the problem is that people simply dont care and/or learn from their mistakes. You could show this video to 100 people and 1 year from now hand those people a USB drive which you said you found on the ground and every single one of those people will plug it into their computer. Heck, you could do the same experiment with IT professionals and I would still bet that *well* into the upper 90th percentile would plug it into their computers.

[@dons8122]

yeah like the unknown links two idiots keep posting askeladd amd Fiqih Wanita

[@Ascentior]

@@finkelmana I believe the problem is that people "know better". Don't speed? I know better. I'm a better driver than most, I can handle faster speeds and have perfect reflexes! That rule is for idiots, not me! Don't do drugs? I know better. I've known this dealer since highschool and he got a b+ in chemistry. He's never sold me anything dangerous before. That rule is for idiots, not me! Everyone is an expert in everything, because we compare ourselves with the idiots. And we all ignore the fact that we're the ones acting like idiots every time.

[@punpundit5590]

"Any computer" is a stretch. If you prepare a potentially sacrificial computer properly, you can learn interesting things from malicious USB devices.

[@kernel_panik4558]

@@punpundit5590 Although true, Id rather leave that caveat unwritten for the sake of the majority of people

[@foamster3997]

This guy is so good he can unlock hidden fears.

[@yadsewnde]

This comment is amazing lol. I'm laughing a lot.

[@foamster3997]

@@yadsewnde You are most welcome.

[@bossslayer6033]

Lmfao

[@DannySullivanMusic]

wow lol fantastic comment

[@foamster3997]

@@DannySullivanMusic thanks.

[@ScottKenny1978]

Rick Astley: doing more to prevent clicking unspecified links than all other cybersecurity training combined.

[@johnather]

It's kinda sad tbh but great at the same time

[@ps.2]

Are you saying he is the goatse of our time?

[@ScottKenny1978]

@@ps.2 possibly worse, given the earworm nature of "Never gonna give you up". You can drink enough to forget goatse.

[@ratgirl34]

I did not know such ‘USB’ sticks existed, they’re so pretty. Also thanks for the computer security warning.

[@NickF60]

We're no strangers to locks You know the clicks and so do I 🎶

[@maxshykhov7518]

Never gonna lock you up Never gonna pin you down Never gonna fall in false set and reset you

[@dodecahedron1]

@thanks begone bot

[@theyearwas1473]

@@maxshykhov7518 🤜🤛

[@kasperhansen9073]

I just sang that. Amazing :)

[@JediMage]

There was no binding on 2 & 4 But I felt clicks at 6, 1, 3 & 5

[@JonLinde]

I love that someone outside "classic" IT-Security knows about stuff like USB-Killers. If people knew about just a fraction of the common and easily exploitable attack vectors that malicious people can deploy, they would be WAY more vary in their daily life.

[@Django45]

There is no wonder "ignorance is bliss" is a common saying. Apparently, it is. Untill it gives you a gut punch when your life is ruined. Sometimes my mother does not understand why I shred or burn any sensitive information I want to discard. And that is the easy part. IT is a beast of its own.

[@L44tsmasher735]

@@Django45 I found if you take sensitive information, shred it, then use it as fireplace kindling, you can watch the shredded dust fly into the air. It's actually entertaining, I recommend it.

[@fezzes428]

news flash old man there are a countless number of videos about usb killers with millions of views. your special it training from the 90s isnt so special anymore.

[@AC-vt6oq]

@@fezzes428 Who asked tho

[@Hunne2303]

@@L44tsmasher735 shred? na mate...dissolve it :p sulfuric acid and a bit of chlorine work wonders on chips etc.

[@thegentleman6115]

If anyone ever had a question about whether LPL is a public service, this video clinches it. What a legend to take the time to share this PSA!

[@Sruggs]

Hi What does PSA mean?

[@pruke8720]

@@Sruggs public service announcement

[@Sruggs]

@@pruke8720 ah that makes sense, thank you :)

[@nick91884]

I feel like LPL is gonna be getting a computer from some viewer for the express purpose of wanting to see these things plugged in

[@bejoe95]

I would absolutely love to watch this happen, good shout on sending one in!

[@ashlyy1341]

if he gets one, particularly if it's a laptop, i imagine he'd need to disassemble it somewhere safe to ensure there's nothing malicious on the hardware side (it's not hard to make a battery explode/catch fire, hence mentioning laptops), and to disable bluetooth/wifi radios in hardware before booting, to ensure it's completely air-gapped before verifying the software side of things. perhaps just replacing the hard drive w/ a blank one and doing an OS install himself would be the safest thing after verifying the hardware and BIOS are fine. or if someone wishes to give him a pc it should be shipped to his PO box directly from a reputable seller and not from the random viewer

[@Brievel]

That was my thought!

[@michealpersicko9531]

@@ashlyy1341 or if LPL uses a laptop and upgrades he can just use the old one for this purpose and avoid have to do all that in the first place.

[@cerebralhawks4544]

It would be rather underwhelming. I assume you're talking about the worst case scenario "you will never use that computer again." Specifically the USB is going to fry the motherboard. Here's what that would look like, assuming you have a monitor on and connected. Monitor goes dark, all the lights on the computer turn off. It doesn't turn back on. You won't hear a pop. It won't catch fire and you won't smell burnt components. It'll just die, like you unplugged it. The graphics card should be fine. The power supply will be fine. The hard drive(s) (including SSDs) should be fine. The optical drive will be fine. The RAM might be fine. The CPU might be fine. The motherboard and USB port will not be fine. Ideally you would be looking at $50+ (typically around $120) to replace the motherboard and $70-500 (typically around $250) to replace the CPU. Another $100 if the RAM is bad. But since everything plugs into the motherboard, it's a lot of work to replace one.

[@Dohyden2]

"Uh your computer is bad bro" "Here, let me roast you in the most polite way"

[@Django45]

A true englishman, so to speak, isnt he? :D

[@vaclav_fejt]

@@Django45 He was indeed born on a wrong continent.

[@agustinmartinez9798]

To check USB drives i have an old pc with no Hard Drive and no internet connection running Puppy Linux. This way i assure that i can scan the Drives or Format them if necessary.

[@govind_goyal]

@@agustinmartinez9798 how does it work with no hard drive? or do you mean it has a ssd?

[@schitzree]

Buncha people now know exactly what it feels like to be a Masterlock.

[@SabotuerAssassin]

I'm legitimately disappointed this wasn't a Rick-Roll ngl

[@Sigismund-von-Luxembourg]

Same haven't seen one of those in a long time.

[@theexxemos]

we got baited

[@MultiWar22]

That's almost like a reverse rick-roll. We came here expecting it and *IT WAS SOMETHING ELSE*

[@nyxiuss8205]

A rigged-roll

[@DannySullivanMusic]

hahaha very nice

[@murrayelliot]

As a cyber security manager, I appreciate the infomercial on the risks that USB devices present. It's never as simple as most may think (that's why people are always the highest risk in any organisation). *thumbsup*

[@AaronOfMpls]

Indeed, I could totally see a disgruntled employee dropping one of those near their boss's parking space, etc.

[@Smol_Eri]

I absolutely love that you brought up that the biggest kink in security are the meatsacks walking around, moreover their hubris and lack of fear. Even in physical security, you need to estabish why the parimiter is so critical, if you have people who are bringing in untrusted sources, or devices, it can quickly go from a secure location to a place under constant survaliance just because they did some stupid stuff. People who think, "well i've never been attacked, so everyone else must just be really stupid" are the most terrifying people to deal with as security.

[@coffeeisgood102]

I learned something. Never guessed that a usb would be packed with capacitors instead of memory chips. They never taught us that in computer school.

[@JamesScholesUK]

Not to mention that even if a drive appears to do nothing, it's entirely possible it's just rewritten the firmware on your USB Host Controller and will now infect any future drive you ever use.

[@infinitivez]

ick, the bane of all hardware.. programmable host controllers! (whoever originally thought this was a good idea, obviously didn't have much forward thinking)

[@theonlyDerp]

What else would that firmware do?

[@metaparalysis3441]

it's also common to edit the firmware to make the capacity higher then it actually is

[@johndododoe1411]

@@metaparalysis3441 That would be the firmware of the device controller in the stick, not the firmware (if any) in the host controller in the computer. To the extent some host controllers contain their own CPU and firmware, that would be pretty useless given that the entire protocol and driver stack is designed around less than 10 designs of mostly stupid hardware by Intel, AMD, NEC and ARM. Attacking the device driver seems a more viable route, as a modified device driver will have unlimited access to the entire computer.

[@mnicolas9742]

How can someone actually think an unknown USB Drive could not be an actual threat?

[@MetalMachine131]

There are people out there who think the monitor is actually the PC. There are no limits to human stupidity.

[@FozziePrints]

Someone in my high school gave all the teachers USB capacitor drive like he just showed which fried a lot of the computers at school.

[@janematthews9087]

Always remember "Half of the people you meet are stupid. And twice the people you don't meet are stupider than that." Either they think they know better, or they believe they've accounted for all situations (Spoilers: They didn't)

[@YOEL_44]

@@FozziePrints They're called USB killers

[@xureality]

@@janematthews9087 the phrase I like to say is "however stupid you think an average person is, realize that half of them are dumber than that"

[@StormcloudLive]

That lock is so pretty, it looks like something Doctor Who would have in his pocket to transfer word docs.

[@joejoethepigeon2628]

@liouy cnny That's a weird bot, looks like it copied one of the top comments, but just a part of it

[@sinephase]

yeah too bad it's so crappy though LOL

[@joeyattack99]

I want it so bad

[@garywheeler7039]

I hear from a review, some of the Doctor Who pocket watches have plastic in them though.

[@pikariocraftf2802]

@@joejoethepigeon2628 - hahaha, thats incredible

[@asherkennedy1276]

Yeah. Plugging in unknown devices is literally security 101.

[@danielweston9188]

in more ways than just computers . . . .

[@kellysmith7357]

Don't you mean "Not plugging in..." :) sry

[@Zorgot.]

@@kellysmith7357 plugged

[@MagzGTV]

It may not be a serious security device, but I love how it looks. Also thank you for showing off the attack drive.

[@foldionepapyrus3441]

Like any 'security' device it is another layer of hassle, watching this channel really shows how even a 'pretty good' lock can be beaten by somebody prepared for it in basically no time, at least if they also possess some skill with the tools... And because its so pretty, and not obviously a lockbox folks after your digital secrets might well not look at it twice, thinking its just your inherited pocket watch, compass etc, so I actually quite like it as a security accessory - small enough to keep on you, and looks like something you might choose to keep on you, not obviously what it really is if somebody comes across it at your desk... Soon as they know what it really is its of no use at all, like any security through obscurity it doesn't last once its secret is known, but its damn cool still.

[@Runtergesprungen]

@keep rollin damn i thought it was a rick roll but no its one of those bots...

[@Boeing_hitsquad]

You can get a cable to protect against voltage attacks

[@smrqdt]

What people have to understand on IT security: relative to the state of IT security in general, Masterlock makes very secure locks. A Masterlock has at least only a limited number of possible attacks.

[@Djbiohazard1991]

If I could like your comment twice, I would. Made my day.

[@ThatGoth]

I think a comparison in this situation would be that putting a random USB stick in is a bit like you opening the lock to your house with the keys and then passing the lock over to someone you think you can trust who goes in with a building crew while you go on holiday and don't look at what they do next... By the time you realise they have robbed your house and changed the locks it's too late.

[@whiteface513abandonedchann8]

@@ThatGoth no, it's more like inviting a stranger inside. It _could_ be harmless, or they could pull a weapon on you, call in their buddies, and trash everything

[@jacob8565]

And you have to take turns attacking a master lock

[@ThatGoth]

@@jacob8565 You don't need to take turns with a Master Lock, because the 1st amateur to try will get it open.

[@01cthompson]

I've actually contacted folks to ensure that they have actually sent me a file that I've received via email, and in one case an actual USB via US mail, and they've all acted like I'm stupid. 🙄

[@ShadowDragon8685]

Yep. When other people are being inconvenienced, it's "security." When it's _Karen_ being inconvenienced, it's "Oh my gawd, I can't believe you're doing this to _me!"_

[@pflaffik]

@@ShadowDragon8685 And from that you found a way to drag Karens into it. Its like Howard always managed to mention he went to space, no matter the original topic.

[@Kalvinjj]

I have quite a bunch of contacts that had their e-mails compromised sending random spam nowadays, it makes me puzzled that someone would feel it weird to need confirmation of sending files via e-mail.

[@thelastword4616]

Wow, you are doing a security best practice and people think it is stupid, wish I could say I was surprised though.

[@THX-vp9fz]

When i leave my home i always wear a mask and most ppl look at me like i'm stupid but i dont care bc i know i'm right. And with the email thing: i just never open suspicious attachments and have all the time a virus scanner/guard running in the background and use vpn, so what. Going outdoor without a mask (when ppl in the near, less than 10m) or computing without a scanner is like having seggs with random ppl without doing it safe. This world is entirely paranormal but it doesnt hold me back from doing things safe. And the other idiots who dont feel the need to protect themself and the other ppl they come close to are potential killers. So guess what i think about ppl nowadays. I wish all good ppl all the best and no, i will not discuss about what i wrote, thanks.

[@getsmarter5412]

Yep- as soon as I saw the caps. I'm a live sound tech, a few years back one sound co. in my area snuck into an area that another sound co. had set up for a large event and left for the evening, sabotaging the mixer. Next day, 1/3 of the channels on the mixer didn't work. After pulling the ckt. board, you could see where diodes on the selected channels were fried at the XLR inputs. I'm guessing a bug zapper with an XLR mic connector did the trick. Unfortunately, the replacement mixer was also hit the next evening.

[@davysmith1934]

Absolute bastard. Why would he do this?

[@mikkelbreiler8916]

Your company has a problem with security to rig, gear and possibly anything else back stage.

[@danielweston9188]

@@davysmith1934 There was a case in SF where one music rental company - F'ed up the equipment of another one in order to gain emergency business at $$$ by a power device.

[@davysmith1934]

@@danielweston9188 MONSTERS. That's not fair ball; you out compete, over-price, but you don't do that!

[@MichaelTilton]

Sage advice from pre-computer days: "Do not insert untrusted dongles into the port"

[@ChiragCJain]

Also, "Do not insert your dongle into untrusted ports." I live by this rule.

[@CyberBeep_kenshi]

Not without proper insulation;)

[@Dumascain]

Great advice to teenage girls as well.

[@iamconio]

always wear protection

[@djweavergamesmaster]

“pre-computer days”

[@dcfan7838]

I found some old memory sticks while clearing out some old stuff recently and to check the contents (and if any were still useful) I got an old laptop, I disconnected the wifi and bluetooth connector (as well as forgetting any devices/networks) before plugging in the memory sticks for this exact reason. It turned out all of the memory sticks were mine that I had just lost and forgotten about, but I'm so glad I took the precautions because it could've ended badly if I hadn't.

[@amanofmanyparts9120]

Interestingly I 'lost' all my microSD cards a while back and actually came across them all again just yesterday. They were in a small clear box on the window sill, just behind my laptop - in plain sight. *D'oh!*

[@rmdhn1]

I wouldn't have cause y'know, my house, so must be mine or someone I know

[@THESLlCK]

@Holy Knight Hodrick then cover it in gas and blow it up it's a precaution not a end all solution

[@Yhsanave_]

I always tell people this but I don't think they take me seriously. I used to work in my university's computer lab and we had an old policy manual that literally said the policy for found USB drives was to plug them into a computer and see if there were any files on them that could identify the owner. Not only is that a violation of the owner's privacy, it's a serious security risk.

[@digitaIgorilla]

I hope you re-wrote that section of the manual 😉

[@andrehashimoto8056]

My university had a FUCKING MALWARE plague everyone's USBs for a while because some dipshit KEPT pluging an INFECTED ONE on the machines.... the IT guy was really annoyed, but he at least helped purge the crap off anyone that got an infected USB.... and some labs with the better PCs were left unusable for a few weeks for a year BECAUSE he had to go and manually clean everything from those units

[@Melissanoma]

When I was a student in university, they told us to make a text file in our usb drive's root directory that had our contact info. The intention was so that anyone following a policy like from your computer lab would be able to return it if lost. At the time, I thought "wow that's a good idea". It was years ago, and I know better now.

[@d3xbot]

We keep a burner laptop at our Help Desk in case someone brings something in on a flash drive. It never touches our network unless it's been wiped and we are re-imaging it.

[@redfailhawk]

I actually kept a folder on my school one attached to my keys for years, folder name “owner contact”, and inside was a single txt file with my name, phone number, email, and dorm name (no room number). It saved my butt only once but was worth it for that. Note, it was shaped like a turtle, so it wasn’t obviously a drive to begin with. They ended up asking at the front desk if they knew my room number as they’d found my keys. Saved me 60$ from having to replace the dorm room lock.

[@pickeljarsforhillary102]

Along with the fry chip is a note: "We here at Newegg will be readily available to help you purchase a new computer"

[@DaveyP212]

I see what you did there lol.

[@NWolfsson]

That's a really important point, indeed to remind people that attacks on electronics are not limited to data, but can also affect hardware.

[@Liokindy]

Oi, nerethil, wassup

[@NWolfsson]

@@Liokindy Hey, doing good and you?

[@Liokindy]

@@NWolfsson Hai, im fine too.

[@hectorcorona9536]

not to forget a "psychological" attack. a friend and I built several USB sticks that would behave as a regular device but had a microcontroller (I believe we ended up using PIC12s) that played a high pitched cricket like sound through a piezoelectric buzzer. we set it up to wait at least 60 mins and then start playing at random intervals for no longer than 5 seconds. USB stick theft was a thing in my school so we designed these as a way to punish people who stole them.

[@chdreturns]

@@hectorcorona9536 LOL

[@135Fenrir]

"And then there are things like this, let me show you"... disassembles a literal PC nuke. Holy hannah man, my eye started twitching when I saw those capacitors.

[@BenkiAU]

I know what you mean, I never had a clue that devices like this existed. Going to disable all USB ports on the server now.

[@wolfcryo]

@@BenkiAU That will help only if you can disconnect the power supply to the USB ports. Physically unplugging them inside is the best option if you can do that.

[@NoLifer2]

oh my

[@user-bc7cb8uu7e]

At a career fair I attended, one of the companies was passing out free flashdrives that when plugged in would emulate a keyboard that would use hotkeys to open your web browser and navigate to their website. They included a sequence of inputs for both Windows and Mac. It definitely opened my eyes to this kind of attack

[@refl9630]

It's sad that you have to explain this, but I'm glad you did! People think expensive software will make them invulnerable, the same with expensive locks.

[@jessebeaver4677]

I was IT in the navy, straight from a background of absolutely no experience. The more I learned about computers, the more paranoid about them, I became. Even the few items I do have, aren't connected to a network most of the time. You can do a lot, with very little, and the right knowhow.

[@dons8122]

any of my IoT are on a totally different network from the rest of my main system at home just for that reason.

[@Practicality01]

@@dons8122 they aren't IoT then, it's just a single NoT, lol

[@jennacarter937]

@@Practicality01 I’m not savvy with cyber security and stuff what is LoT and NoT

[@DumbledoreMcCracken]

@@jennacarter937 internet of things, network of things. just another dorky way of saying computer.

[@Practicality01]

@@jennacarter937 Internet of things is devices that you can control over the internet. A network of things can only be controlled if you are connected to that "totally different network" Don talked about. But calling it a NoT is just a bad geek pun. 😜

[@robmaclachlan1264]

Best advice i ever heard was : compared putting an unknown USB in your computer to eating an unwrapped hamburger you found on the floor of a parking garage.

[@donsurlylyte]

*homer simpson voice* mmmmm, burger

[@0neDoomedSpaceMarine]

It's more like engaging in unprotected sex with a complete stranger you only just met a second ago.

[@TheKAlltop]

@@0neDoomedSpaceMarine I'm okay with both sex, and a garage burger, but don't fuck with my computer

[@thebigcheese8715]

I know of another classic: Don't stick your winky where you wouldn't put your pinky.

[@sammiches6859]

Well if it's a Culver's Butterburger I'll take my chances.

[@teej008]

I was lucky enough to be invited to the Russian embassy in London when I worked as a photojournalist. One of the gifts I was given was a usb drive containing copies of the artwork hung around the building. Needless to say, it never went near my computer :)

[@jaypaans3471]

You sound like a smart person

[@json_bourne3812]

That's when it goes into my clean cheap off-the-network raspberry pi where I can check the contents :)

[@jaypaans3471]

Reminds me of an episode of NCIS.

[@theamorphousflatsch2699]

You sound like someone, that has a clear and stable mind, im happy that people like you still exist. You've become rare.

[@mumtrz]

I don't understand...

[@yohoki4642]

I mentioned this to a walmart manager once. Their ATM was in the lobby, but when I pulled on the card swipe area, the entire front of the case pulled off... It wasn't screwed in. Inside, I could see clearly visible USB ports and other vital components. I told them that they need to have some one watching that machine and have it closed off until it's fixed because of how easy it is to mess it up, or even hack it, with exposed usb ports. There could have been any number of things going on with that machine that day, I'm so glad I always pull on everything before I swipe my card.

[@sethmoyer]

LPL's first ever detected flaw: He doesn't like Never Gonna Give You Up

[@Aenonar]

That's not a flaw

[@TheChronova]

he likes rick astley, but not more than he likes having a computer and a secure internet connection

[@benjaminfinlay829]

Personally? I don't think the song's bad - it's quite good, really - but I've been subjected to it while trying to watch something else _far_ too many times to associate it with anything but annoyance.

[@dustinmorse8497]

I feel like he really let me down.

[@sethmoyer]

@@TheChronova He said it was annoying in the video.

[@Snickersnek]

Remember, virtual defences are meaningless if you have physical access.

[@WhereWhatHuh]

There is no security but physical, and airgap is its protocol.

[@digitalunity]

@Arthur Sounds like a really hackerman of a client

[@madwlad799]

@@WhereWhatHuh even the gap, isnt always save, you might not get direct access, but there is alot of Radio waves and signals being radiatet into the air which you could read out with enough invetment and the right machines

[@shadesmarerik4112]

@@WhereWhatHuh if someone wanted to destroy ur device from a mile away, it could be done. Airgap or not

[@cezarcatalin1406]

@@WhereWhatHuh Even airgap can be breached by special phreaking side-channel attacks because computers can leak sensitive data through emanating electromagnetic waves.

[@sanansa4567]

damn I wasn't even aware of the USB devices that are designed to damage computer hardware. thanks for showing that.

[@questioner1596]

It's also possible to simply have a malfunctioning device cause damage.

[@DannySullivanMusic]

i agree! 100% true!!

[@ilovefunnyamv2nd]

yeah that's just meant to fry the device. now for the fun part, the newer usb 3 ports, the ones that are superfast (not to be confused with ysb 2.0 superspeed)... connect to pcie lanes, either through a bridge or directly to the cpu. it could do a lot more than burn out the USB controller, this attack could literally kill your laptop

[@MrPLC999]

He's absolutely right about being very careful what you expose your beloved computer to, be it Windows or iMac.

[@arisvideodrop3595]

just imagine plugging one into a high end gaming computer lolz

[@deluxejay69]

Everybody should listen to LPL's keynote speech at saintcon, he goes into detail about how he's had people send him tracking devices in the hopes it would lead them to his house, people have hired PI's to track him down, people have sent death threats to him and his family, just from the content he posts here on youtube. It's seriously creepy how some people become intent on finding and potentially harming a person and their family just because they didn't like their youtube videos. I think that really puts this video into context, and any precautions LPL takes to protect himself and his loved ones shouldn't be dismissed as "paranoid". He's being smart.

[@JargonGigantus]

As an IT professional, I appreciate your want to educate beyond of your locking picking skills. Well done, sir.

[@LM-qv7cy]

What is that stuff he used to pull the usb out to show the capacitor?? I want to get one in case any usb I purchase will fry my computer

[@michaelthornes]

@@LM-qv7cy just pliers. many usbs are two pieces of plastic connected around the usb, though, so you'd want to pry those apart using something flat instead of using pliers for those cases

[@LM-qv7cy]

@@michaelthornes thank!

[@yashasan83]

One of the first things i learned being an IT professional is there is no such thing as a secure system especially if that system is connected to a network of any kind

[@alphagt62]

I too am an IT professional, and I am amazed at the important systems that are connected to the internet! I worked for a large, $4 Billion dollar company in the late 90’s, they got fiber optic internet to the building, and of course all the chiefs wanted to be able to access from home. And all of their passwords were their last names! And after exposing the company to such a giant compromise, almost none of them actually ever logged in from home. But arrogance and self importance made them think their convenience was more important than security. And if we had been hacked, us IT workers would have been blamed. My last day there in 2003 was a happy day!

[@marksalot5035]

even if its air gaped , it can still be compromised

[@mikecimerian6913]

There are ways to make things more secure but users will hate you for it. I worked on Netware servers. I trusted them because they were C2 capable.

[@chrispartosbro4555]

When my oldest start secondary school 2 years ago they wanted her finger prints for the canteen etc as they cashless, i said no chance are you storing that kind of data on your tin pot computer system, they assured me its 100% safe and so on, so i pointed out if i top her account up on line it stands to reason you will have it automated to top her account up in school that has her prints and date of birth etc stored on, so no, any system is only as strong as the weakest link, in the end i said yes ok but only if you sign this, and handed them a consent slip for to try and retrieve as much data as i can from there system and if i get any details of anyone they pay all concerned £10,000 cash, i promise to do nothing with any data other than put to CD and hand over to you, they refused, i asked why if your system is so secure? what you got to loose?

[@thomasl8810]

I would go so far as to say that as long as the system has a human user interface of any kind, it cant truly be secure.

[@CLAYPOOLALAMENOSUNO]

Makes me wonder if Rick Astley had issues during his life when contacting people or sending mail to others... "yeah, I'm not going to get rick-rolled"

[@pierrecurie]

Can you imagine if you work at the bank he uses?

[@kuzmavolkov]

@@pierrecurie What about take out place? "Oh yeah sure buddy you wanted 2 large pies uh huh."

[@SierraLimaOscar]

True story. A business partner working for a really big corp. called me and asked me if I could call the Interconti in Belgrade and book him a room for next week. I said: sure, no problem. But I can also give you their number I have it right here. He said: Oh I have the number, but they keep hanging up on me when I tell them my name. His name is James Bond...

[@MissLilyFae]

Rock Astley is still alive, and I'd be willing to bet he does run into trouble! Haha

[@GeneralPenemonto]

What do you mean "had", the guy is still alive an kickin, he had a reddit AMA a few years back, where he himself got rickrolled...

[@itskarl7575]

It never occurred to me that there was malicious _hardware_ out there.

[@mareck6946]

you can brick your hardware even with malicious software and imean physically

[@Dasher498]

As an IT instructor, thank you for pointing out the flaws in the perception of security. We use many devices like the one you mentioned in our program, where the system detects the USB as a keyboard, and as soon as it connects to the system it auto creates an administrator account, among many other possibilities.

[@ryuucorvin2300]

0:40 They think you're an old man who picks locks, they didn't expect a man who knows his way around a computer.

[@alexfrank5331]

It's not about the old man. It's more about idiots who act like they know everything then going around spilling their nonsense.

[@cultclassic999]

So glad you mentioned the attack with capacitors. Physical damage is something a lot of people don't know. There are USB 'Prophylactic" products out there that block the data pins, and only allow the power terminals to pass through, to thwart hacking attempts. So you can use the USB port to charge devices. Even those devices can be malicious if they do what LPL showed.

[@andrewdreasler428]

Block the data pins but allow the power terminals to pass through? That can be quite useful if, for example. your phone has almost no charge and you don't want your company's computer to access your phone while you do an emergency charge off the USB port.

[@dons8122]

There was one out there with a external drive it stored so much power when it release it set a desk top on fire

[@mr.mckinnon5680]

Prophylactic... now there is a word that doesn't get tossed around the bedroom very often. I'm surprised that they have them for computers. Though I shouldn't be. We get all the engineering and technological capabilities of building robots that, can serve humanity in great ways... and our first true robots are sex dolls. Which makes me wonder... will they have robotic prophylactics for sex dolls? I mean ... Where would that go, what would that look like? Would it be something to stop her from being penetrated by hackers? Will it stop the Siri and Alexa from introducing her to third-wave feminism? I'm so full of questions now. In the vast plethora of sources and experts on the internet, I should probably consult one of them... I know... Reddit. I'm sure to find some experts on this topic... On Reddit. #research

[@gullreefclub]

@@mr.mckinnon5680 the real question then is “do android’s dream of electric sheep?”

[@dbattleaxe]

There are also ones like USBKill Shield which don't just block data pins but also flash LEDs if they're being attacked in this manner. Still doesn't protect you from malicious software. First plug the untrusted USB into one of those, then try reading it on some dirt cheap chromebook if you've really want to take a look.

[@bradbla]

I'm never going to give you up, LockPickingLawyer.

[@neonkuriboh2830]

Astounded at the self-control this guy has to not put a rickroll at the end of the video.

[@kylegardner9453]

Kinda bummed me out ngl

[@maximusdecimus2805]

This video will then be flagged and monetized by the company which owns that song. Why would lpl knowingly give up his earnings?

[@markgearing]

LPL: This is the second USB drive I’m not putting into my computer Astley: I’m never gonna give you up

[@dodger1486]

Lol

[@WillyBGames]

"I have AVG therefore I am invincible" I worked on a military base for a co-op in school with the IT department, and they have a dedicated computer that is not hooked up to any network, and they use that to scrub ANY device they use. Even when they get a new set of USBs from a trusted source, they still scrub them to make sure there's no threat. If you think you have better security than a military base, feel free to plug random usbs into your pc.

[@ouicestbien]

Well, to be fair: You're forgetting the nuclear silos with their passwords set to 0000. For decades on end.

[@johnnylavoie]

Wow, I hope they are using a locked down Linux and reboot-to-restore to do that. If not, it's just a great way to propagate zero day attack like Stuxnet did.

[@jaykay9836]

@@ouicestbien Like you actually know.

[@vbscript2]

@@ouicestbien It wasn't like it was some way to access the silo. It was an extra lock on the launch sequence that they ended up determining wasted too much time to be worthwhile, so effectively disabled it. You still have to go through a bunch of armed guards and giant steel doors (and, of course, the base's perimeter security) to get to the silo in the first place. And have the launch keys.

[@svenzverg7321]

@@johnnylavoie Systems like these just run on live CDs, no need to complicate things.

[@mgv00]

There was a case of a US Submarine where a sailor plugged in a device to a piece of equipment to charge it. A total security risk that could have compromised systems. Now all phones have to be left topside in port and not allowed underway.

[@Ravie1]

Phones also enable dragnets. There was a civilian dragnet a while back that tracked the route of a Chinese sub using GPS in it's crew's cell phones.

[@harl3quinn]

"Your settings must be wrong if you're worried about USB attacks." *laughs in Rubber Ducky*

[@Benoit-Pierre]

Same :)

[@Benoit-Pierre]

Except, it can be done with any rPi0, or rooted android ... Example. A good friend has the Windows install disk in his phone. When a computer needs reformat, he plugs his phone as storage, and restart computer. 15mn later, fresh windows. Also works with linux installer.

[@DavidLindes]

@@Benoit-Pierre Of course, this doesn't help in the case of "devices like this" - 0:47

[@davidlewis2171]

Funny enough, I actually made a python script that would near instantly open a browser window and type in a link to, you guessed it, rick roll someone

[@logitimate]

There are reliable countermeasures to USB Rubber Ducky, at least if you're willing to modify your kernel's source and recompile it. But that still won't save your machine from being fried by an electrical discharge.

[@ShadowKstr]

As a IT Sec practitioner - I am impressed and grateful. First off, let me apologize: physical security is one of the pillars of the IT Sec field, yet, I assumed you stopped at that. A thousand apologies. But then - with your extended viewership, provide this awesome lesson on IT Sec. I am in awe. Please, keep it up. We kinda need it...

[@TimeBucks]

how nice that lock is

[@AdamSmith-du6us]

Calm down yoda

[@ab3ki84hayate]

wassup checkmark

[@just_another_person_who_li4675]

Ok verified

[@VaderWhoop]

@@AdamSmith-du6us Very nice, much fancy... ( sorry, that's Dogecoin ) Confused I am.

[@morellatovar4151]

Bien

[@TD-wi1zh]

to make the machine data-safe, use a computer with no hdd, boot from usb/dvd/pxe, but preferably air-gapped. For hardware protection, a usb hub or daisey-chained. Cheao sacrificial ones. Or build yourself a usb connector withba voltmeter on the data pins or some oher test means. Ran an IT repair service, "don't plug in strange devices" was not an option, so hardening our tools was mandatory.

[@LiEnby]

just use a cheap arduino to read what device descriptor it reports. your overthinking it xD

[@Tim.Stotelmeyer]

Do not forget the port killer USBs with a delay. They look harmless at first and have memory chips on them so you think they are OK but after X amount of time they charge up their capacitors and fry your USB port.

[@enigmaticx326]

Very happy to learn that LPL is cognisant of IT security threats as well as physical security threats.

[@neon5162]

He’s probably some god like hacker too

[@paulevans9307]

@@neon5162 That's a click out of 1, a click out of 2, a click out of 3 [...] a click out of -, a click out of =, nothing on backspace. So that is the keycap that is damaged. In any case, that's all I have for you today.

[@johncochran8497]

Now waiting for someone to send him a small locked box with a firecracker triggered by opening inside. And of course a note saying "It could have been bigger. Opening unidentified packages is a security risk." There's lots of extremely nasty things people can do.

[@SpecterNeverSpectator]

He probably is a god at fallout too

[@ShadowDragon8685]

And memelogical threats...

[@hiltonian_1260]

My sister worked in IT at ExxonMobil. The IT security folks would go around the EM campus scattering thumb drives with vendor logos on them. Employees would pick them up and stick them in USB ports and their computers would freeze up with a “Go visit IT you moron” message. Occasionally someone would bring one to IT and they would get a doughnut.

[@vendettamedianl]

That is the most effective way to teach people alright. 🤣 Would have loved to have seen their faces when showing up to the IT department to explain what happened. 🤣

[@ShadowDragon8685]

That could backfire if people start swiping actual vendors' USB sticks to swap for donuts. "Hey, Bill? How many of those trap USBs did you put out?" "Uh... About forty, why?" "Got Bob from Accounting here with an tote bag full expecting baked goods and ballpark guesstimate says he's got at least seventy." _"Fuck._ Okay, you go clean out Wawa and Dunkin' to give Bob his good boi treats - take the company card and for these purposes the speciality stuff and muffins are "donuts," and get me two 24-ounces of Pumpkin Spice while you're at Wawa. I'm gonna _need it_ to unfuck this bag of sticks."

[@HorizonIncarnate]

You really just got a computer nuke sitting there

[@Ralesk]

Can we just appreciate how gorgeous these "steampunkish" devices look? :D

[@RMeitzen]

Yeah this thing looks amazing. Would be even better if it had a watch or something embedded into it.

[@nickborn2369]

I was thinking the same thing the compass looks great

[@bodaciouschad]

Who knew that Rick Astley was such a gifted craftsmen!

[@hargert]

Anyone know if that lock is for sale anywhere?

[@TyphinHoofbun]

The device that opened my eyes to the sheer possibilities of a USB "drive" is probably the PS3 Jailbreaker. It pretends to be a hub with so many components, with devices that return a size for their header before returning a much larger header that it overruns the buffer, and adds/removes "devices" with perfect timing to eventually get the system to run the attack code in order to crack the security completely open.

[@daviddunmore8415]

There's an easy way to prevent buffer overflows (If the developers are aware of OWASP's secure coding best practices) It goes like this: You know how big your buffer's max size is, so you count bytes being read in and stop when you hit max size and ignore anything that follows.If required throw an 'Invalid buffer contents' message.

[@alexanderdaum8053]

@@daviddunmore8415 In this case the developers assumed, that USB devices would report the correct header size and omitted the extra overflow check, which is a pretty easy mistake to make.

[@MaakaSakuranbo]

@@daviddunmore8415 And despite it being so easy, it keeps popping up again and again ;)

[@jonathanbuzzard1376]

@@alexanderdaum8053 Indeed but presumption is the mother of all screw ups. Presuming all USB devices are standards compliant is idiocy.

[@TheAquaticMandolin]

Thank you so much for making this point. As an IT professional this is one of my biggest concerns at the company I work for. I can harden every possible Network node and user interface, but nothing is stopping my end users from letting the bad guys right in the front door with a USB key. People just don't get how creative the bad guys will get to try and hack into a large company. So to repeat your point again, if you do not know where a device comes from please do not plug it in.

[@Masterofcreat]

But what can you do instead? It´s unreasonable to pull every stick apart and inspect it, trashing it would be unreasonable too. If you had a cheap mini pc setup simply to open files/pictures it could get damaged everytime a new stick comes in and you´d have to format it everytime after I presume.

[@beeble2003]

@@Masterofcreat You don't need to do anything. If you find a USB stick, treat it like any other lost property: hand it to reception. The owner can get it back by asking for it; you don't need to investigate and try to find out who the owner is.

[@foldionepapyrus3441]

There is one sure-fire way, don't have users... I guess not letting the users have USB ports, or any exposed ports at all even might work too... In the days of almost all data being on the company server do you actually need your users to have anything but screen, and whatever HID devices suit their work at the desk - often wondered why none of the big commercial computer providers don't have locked IO covers, or even no 'user' serviceable IO at all - just have the cables coming out the box needing to open the case to change them (maybe they do, but I've never come across the old decommissioned commercial computer with those features).

[@AlexusMaximusDE]

The place I work for simply disables all USB ports which are not in use for keyboard/mouse/webcam. Of course that doesn't prevent a USB hub from being connected to one of those ports

[@beeble2003]

@@foldionepapyrus3441 You can't not have USB ports. Unless everyone is using bluetooth keyboards and mice, and have built-in webcams, USB is the only way that those peripherals are attached. Even if you only have exactly the number of USB slots needed, there'll always be someone who unplugs their mouse or webcam so they can plug in the USB stick and try to figure out who lost it.

[@GuiltyPleasures]

Never - EVER - connect an unknown device to your computer. If anyone tells you it's fine or that modern computers are safe from USB Key styled attacks, they are woefully - dangerously - uninformed on the subject matter. Also, props for showing one of those USB kill sticks. They're real, and they're cheap.

[@Kragatar]

1:35 "To be fair, I'm not sure if I'd rather have my computer compromised, or my eyes and ears by the music video this contains." lmao

[@johndododoe1411]

Great video and song, liked it since the 1980s.

[@davedooney8473]

I have a simple policy when it comes to finding USB sticks in the wild: "Assume it has been sent back in time by Skynet to enslave and/or destroy humanity" Hasn't let me down yet.

[@thetourminator]

Yep, I've heard that many malware baiters will leave USB sticks in plain sight in places like parking lots, hoping for peeps to plug them in to computers.

[@agent3c]

one of my friends once ran an AI program without really knowing what they were doing. It didn't turn into skynet, but it was really annoying. The AI would move files around, change OS settings, and be an overall nuisance. At some point it learned to copy its own files, and occasionally it would hide itself on USB sticks that got plugged into the computer. The laptop ended being gifted to somebody else, and last I heard the AI had somehow learned to change the login password. To this day though, she has a box full of USB sticks that she's afraid to touch because she's not sure which ones have the AI on it.

[@relevantinformation6655]

Supposed it was sent back in time from 2347, it could still be a Rick Roll…. Epic long term prank involving a time machine, bending the rules of known physics & of course Rick Asterly ;)

[@KabegamiTheGreat]

God: The gates to heaven are locked by my otherworldy gifts. LPL: Hello everyone, this is the lockpickinLawyer-

[@qwintur349]

And you can tell by the sounds of horns, that seal one is set. Second Seal is binding. Click out of three.

[@Psych_Ward]

@@qwintur349 This is just gold :D

[@nightshadeknight9797]

@@qwintur349 I'm laughing so hard right now😂😂😂

[@KabegamiTheGreat]

@@qwintur349 as you just saw, this is not a very effective security measure and I wouldn't use it for my own realm.

[@thisguy1355]

Ah yes the KZbin "experts" who think anti malware/virus program will protect there $1000+ machine from any form of attack.

[@TheBaumcm]

Which only protects against known threats and only if you update it religiously. Yep, lots of dinguses posing as experts