3 ms·

This is not a USB firmware situation, it's the issue that any device you plug into USB can emulate one of the allowed devices (i.e. keyboard/mouse/other). What

This is not a USB firmware situation, it's the issue that any device you plug into USB can emulate one of the allowed devices (i.e. keyboard/mouse/other). What we need is for the OS to ask the user what to do if an existing keyboard/mouse already exists, with a way to whitelist the new device so that we don't have to repeat the same steps each and every time we reboot our computers, or unplug/replug the device. This way it will stop these sorts of attacks.

mrob 11y ago
It can even emulate more than one device on the same port, and introduce new ones after arbitrary delay. This attack could be made stealthier by first presenting a valid mass storage device and adding the emulated keyboard later.
OmgImAlexis 11y ago
and what happens if your keyboard and mouse break? You'd then have no whitelisted HIDs and no way of allowing new ones.
- nitrogen 11y ago
  Another commenter had a fairly clever solution: https://news.ycombinator.com/item?id=10204560 https://news.ycombinator.com/item?id=10204560 With a bit of refinement it could contribute to the overall solution. The responses here are also interesting: https://news.ycombinator.com/item?id=10203913 https://news.ycombinator.com/item?id=10203913
- brohee 11y ago
  You input your password, it the attacker knows that, you are likely toast anyway...
- jessaustin 11y ago
  If the computer requires a password to log in, then just look for the right password from the keyboard on a restart, and at that time tell the user that this keyboard is new. Sure, it's possible for evil keyboards to do bad things, but at least the user would be aware that there is now a new HID plugged in.
- lukeschlather 11y ago
  I think the idea is the machine only allows one keyboard and one mouse, and if you insert another input device you have to explicitly enable it. This would probably stop 90% of attacks.
deleted 11y ago
[deleted]

mrob 11y ago

It can even emulate more than one device on the same port, and introduce new ones after arbitrary delay. This attack could be made stealthier by first presenting a valid mass storage device and adding the emulated keyboard later.

OmgImAlexis 11y ago

and what happens if your keyboard and mouse break? You'd then have no whitelisted HIDs and no way of allowing new ones.

nitrogen 11y ago
Another commenter had a fairly clever solution: https://news.ycombinator.com/item?id=10204560 https://news.ycombinator.com/item?id=10204560 With a bit of refinement it could contribute to the overall solution. The responses here are also interesting: https://news.ycombinator.com/item?id=10203913 https://news.ycombinator.com/item?id=10203913
brohee 11y ago
You input your password, it the attacker knows that, you are likely toast anyway...
jessaustin 11y ago
If the computer requires a password to log in, then just look for the right password from the keyboard on a restart, and at that time tell the user that this keyboard is new. Sure, it's possible for evil keyboards to do bad things, but at least the user would be aware that there is now a new HID plugged in.
lukeschlather 11y ago
I think the idea is the machine only allows one keyboard and one mouse, and if you insert another input device you have to explicitly enable it. This would probably stop 90% of attacks.

deleted 11y ago

[deleted]