6 ms·

So will this USB firmware situation eventually be solved in some newer version or are we all just silently ignoring this? Because this makes USB an absolute NO

So will this USB firmware situation eventually be solved in some newer version or are we all just silently ignoring this? Because this makes USB an absolute NO in some environments (and for quite a while now). It would be nice if we could use USB again at some point…

X-Istence 11y ago
This is not a USB firmware situation, it's the issue that any device you plug into USB can emulate one of the allowed devices (i.e. keyboard/mouse/other). What we need is for the OS to ask the user what to do if an existing keyboard/mouse already exists, with a way to whitelist the new device so that we don't have to repeat the same steps each and every time we reboot our computers, or unplug/replug the device. This way it will stop these sorts of attacks.
- mrob 11y ago
  It can even emulate more than one device on the same port, and introduce new ones after arbitrary delay. This attack could be made stealthier by first presenting a valid mass storage device and adding the emulated keyboard later.
- OmgImAlexis 11y ago
  and what happens if your keyboard and mouse break? You'd then have no whitelisted HIDs and no way of allowing new ones.
  - nitrogen 11y ago
    Another commenter had a fairly clever solution: https://news.ycombinator.com/item?id=10204560 https://news.ycombinator.com/item?id=10204560 With a bit of refinement it could contribute to the overall solution. The responses here are also interesting: https://news.ycombinator.com/item?id=10203913 https://news.ycombinator.com/item?id=10203913
  - brohee 11y ago
    You input your password, it the attacker knows that, you are likely toast anyway...
  - jessaustin 11y ago
    If the computer requires a password to log in, then just look for the right password from the keyboard on a restart, and at that time tell the user that this keyboard is new. Sure, it's possible for evil keyboards to do bad things, but at least the user would be aware that there is now a new HID plugged in.
  - lukeschlather 11y ago
    I think the idea is the machine only allows one keyboard and one mouse, and if you insert another input device you have to explicitly enable it. This would probably stop 90% of attacks.
- deleted 11y ago
  [deleted]
throwaway7767 11y ago
> So will this USB firmware situation eventually be solved in some newer version or are we all just silently ignoring this? No, it will not be fixed. There is no vulnerability. We need to plug in keyboards, and if users are willing to plug random devices into the ports where their keyboards lie, those peripherals can inject keystrokes. We can play whack-a-mole and blacklist the vendor/product IDs (like systemd does), but if this were a real attack and not a stupid marketing stunt, the device would just present itself as some popular cheap keyboard and there'd be no way for the computer to tell it apart from one. There are many other ways you could attack USB or other connectors if you get a user to plug your hardware in there, most are more involved than this one. The only solution is to educate people to not plug hardware they don't trust into their machines.
- acdha 11y ago
  > No, it will not be fixed. There is no vulnerability. … The only solution is to educate people to not plug hardware they don't trust into their machines. “We just need to educate users about passwords” “We just need to educate users about how to verify SSL certificates” “We just need to educate users about how to install only software from trusted publishers” etc. This reaction is understandable but it's a non-starter if we ever want to make meaningful progress on security. The underlying problem here is that everything local was assumed to be trustworthy and that's not true and, thanks to reflashable firmware, not even something which can be assumed to stay true even if it happens to be the case when you start. Fixing problems like this will require changes – X-Istence mentioned OS prompting for new device classes, which would particularly effective on devices like laptops (i.e. the default for most users) which could require confirmation on the built-in hardware any time an external device tries to duplicate built-in functionality (keyboard, mouse, network, etc.), but we probably need more ambitious measures like adding a public-key exchange for certain device classes or a hardware switch which controls whether a port is allowed to control the computer or provide block storage but not both. The one thing which is certain is that the .gov / .mil security people who seal ports with epoxy aren't looking as paranoid these days…
  - brillenfux 11y ago

X-Istence 11y ago

This is not a USB firmware situation, it's the issue that any device you plug into USB can emulate one of the allowed devices (i.e. keyboard/mouse/other). What we need is for the OS to ask the user what to do if an existing keyboard/mouse already exists, with a way to whitelist the new device so that we don't have to repeat the same steps each and every time we reboot our computers, or unplug/replug the device. This way it will stop these sorts of attacks.

mrob 11y ago
It can even emulate more than one device on the same port, and introduce new ones after arbitrary delay. This attack could be made stealthier by first presenting a valid mass storage device and adding the emulated keyboard later.
OmgImAlexis 11y ago
and what happens if your keyboard and mouse break? You'd then have no whitelisted HIDs and no way of allowing new ones.
- nitrogen 11y ago
  Another commenter had a fairly clever solution: https://news.ycombinator.com/item?id=10204560 https://news.ycombinator.com/item?id=10204560 With a bit of refinement it could contribute to the overall solution. The responses here are also interesting: https://news.ycombinator.com/item?id=10203913 https://news.ycombinator.com/item?id=10203913
- brohee 11y ago
  You input your password, it the attacker knows that, you are likely toast anyway...
- jessaustin 11y ago
  If the computer requires a password to log in, then just look for the right password from the keyboard on a restart, and at that time tell the user that this keyboard is new. Sure, it's possible for evil keyboards to do bad things, but at least the user would be aware that there is now a new HID plugged in.
- lukeschlather 11y ago
  I think the idea is the machine only allows one keyboard and one mouse, and if you insert another input device you have to explicitly enable it. This would probably stop 90% of attacks.
deleted 11y ago
[deleted]

throwaway7767 11y ago

> So will this USB firmware situation eventually be solved in some newer version or are we all just silently ignoring this? No, it will not be fixed. There is no vulnerability. We need to plug in keyboards, and if users are willing to plug random devices into the ports where their keyboards lie, those peripherals can inject keystrokes. We can play whack-a-mole and blacklist the vendor/product IDs (like systemd does), but if this were a real attack and not a stupid marketing stunt, the device would just present itself as some popular cheap keyboard and there'd be no way for the computer to tell it apart from one. There are many other ways you could attack USB or other connectors if you get a user to plug your hardware in there, most are more involved than this one. The only solution is to educate people to not plug hardware they don't trust into their machines.

acdha 11y ago
> No, it will not be fixed. There is no vulnerability. … The only solution is to educate people to not plug hardware they don't trust into their machines. “We just need to educate users about passwords” “We just need to educate users about how to verify SSL certificates” “We just need to educate users about how to install only software from trusted publishers” etc. This reaction is understandable but it's a non-starter if we ever want to make meaningful progress on security. The underlying problem here is that everything local was assumed to be trustworthy and that's not true and, thanks to reflashable firmware, not even something which can be assumed to stay true even if it happens to be the case when you start. Fixing problems like this will require changes – X-Istence mentioned OS prompting for new device classes, which would particularly effective on devices like laptops (i.e. the default for most users) which could require confirmation on the built-in hardware any time an external device tries to duplicate built-in functionality (keyboard, mouse, network, etc.), but we probably need more ambitious measures like adding a public-key exchange for certain device classes or a hardware switch which controls whether a port is allowed to control the computer or provide block storage but not both. The one thing which is certain is that the .gov / .mil security people who seal ports with epoxy aren't looking as paranoid these days…
- brillenfux 11y ago