5 ms·

> So will this USB firmware situation eventually be solved in some newer version or are we all just silently ignoring this? No, it will not be fixed. There is

> So will this USB firmware situation eventually be solved in some newer version or are we all just silently ignoring this? No, it will not be fixed. There is no vulnerability. We need to plug in keyboards, and if users are willing to plug random devices into the ports where their keyboards lie, those peripherals can inject keystrokes. We can play whack-a-mole and blacklist the vendor/product IDs (like systemd does), but if this were a real attack and not a stupid marketing stunt, the device would just present itself as some popular cheap keyboard and there'd be no way for the computer to tell it apart from one. There are many other ways you could attack USB or other connectors if you get a user to plug your hardware in there, most are more involved than this one. The only solution is to educate people to not plug hardware they don't trust into their machines.

acdha 11y ago
> No, it will not be fixed. There is no vulnerability. … The only solution is to educate people to not plug hardware they don't trust into their machines. “We just need to educate users about passwords” “We just need to educate users about how to verify SSL certificates” “We just need to educate users about how to install only software from trusted publishers” etc. This reaction is understandable but it's a non-starter if we ever want to make meaningful progress on security. The underlying problem here is that everything local was assumed to be trustworthy and that's not true and, thanks to reflashable firmware, not even something which can be assumed to stay true even if it happens to be the case when you start. Fixing problems like this will require changes – X-Istence mentioned OS prompting for new device classes, which would particularly effective on devices like laptops (i.e. the default for most users) which could require confirmation on the built-in hardware any time an external device tries to duplicate built-in functionality (keyboard, mouse, network, etc.), but we probably need more ambitious measures like adding a public-key exchange for certain device classes or a hardware switch which controls whether a port is allowed to control the computer or provide block storage but not both. The one thing which is certain is that the .gov / .mil security people who seal ports with epoxy aren't looking as paranoid these days…
- brillenfux 11y ago
  I think signed firmware would probably solve most problems. Hobbyists would have to run their system in an insecure mode, though and it's a whole new story if a certificate-based system would actually work in a market as volatile as USB peripherals. So, I don't think there's one magic bullet but it's far too silent on that front!
  - acdha 11y ago
    Agreed – signed firmware is going to be the way forward for a lot of things but it's going to open up other problems like fighting to retain the user's ability to decide whose signatures to trust and I'm sure we'll see a bunch of horrible key management by vendors.
  - brohee 11y ago
    I don't see how signed firmware solves that issue at all. It could solve BadUSB, where one corrupts a legitimate device with poisoned firmware, but it doesn't address at all a user tricked into plugging a bad device...
    - acdha 11y ago
      It adds an accountability mechanism for spoofing device types: the vendor's signing certificate can be revoked if they release devices which pretend to be from a different vendor or which misrepresent the device class. A reasonable criticism is that this would likely result in several examples of customers being screwed when SmallCorp Inc. loses control of their signing key, it's used to sign malware, and the revocation takes out all of the legitimate users but that's arguably an unavoidable cost of the industry maturing.
      - Someone 11y ago
        Also, if "large device manufacturer" ever losse its key, zillions of devices could become unusable overnight (scenario: Evie signs malware with the leaked key, Apple and Microsoft revoke it in a high-priority update; all devices signed with the key become unusable; the world is 'not happy') You likely also would need a way to update the key or flash new firmware and, possibly, a way for the updater to detect whether the device it is talking to has been tampered with. That's expensive for low-margin products such as USB sticks and mice. Also, the average user would not know how to update the firmware, and even if he knew, might not be able to because his keyboard and mouse are fried.
elektromekatron 11y ago
How many keyboards do you need to type with? If a keyboard exists and a second one suddenly appears, giving it a separate buffer and keeping that buffer from doing anything until asked, would seem to be pretty sane.
- stan_rogers 11y ago
  Four, typically, along with three things that could be called pointing devices. (That would be a laptop's built-in keyboard, a proper external keyboard, the hotkeys on a Wacom tablet, and a programmable keypad to make Ctrl+Alt+Shift+[optional Fn if using a compact/laptop keyboard]+[whatever]+"hold your tongue in precisely this position while trying to do things with the other hand using a pressure-sensitive pen" key combinations into a single simple keystroke, the laptop's pointing device, an external mouse, and the actual tablet part of the Wacom.) And yes, there are home and travelling versions of the set-up. People seriously working in 3D, non-linear editing, and so forth, would have more. Things can get rather complicated in a hurry when the computer becomes the core of a dedicated toolset that can also be used, on occasion, to perform simple administrative tasks like email, invoicing, ...
digi_owl 11y ago
That systemd thing is hilarious in its tragic misunderstanding. Basically a patch was offered that would lock a computer if a new device was plugged in. This to counter act police mouse wigglers etc. But Poettering decided that no that was too heavy handed, lets instead black list the specific product id. Never mind that changing a product id is a firmware flash away (one could probably make a wiggler that randomize its id on each insertion).
- mayoff 11y ago
  Or just make the wiggler identify itself as an extremely common type of mouse.
- pnathan 11y ago
  link to source? I'm interested in reading the discussion.
  - digi_owl 11y ago
    Best i recall there was no discussion. At least all i read was a patch note. Sadly i didn't save a link...
- vacri 11y ago
  It is too heavy-handed. Locking the computer every time I plug in a controller or some other HID? What if the battery dies in my wireless keyboard, and I need to plug in another one temporarily? How could I possibly type in the password at a lock screen with one dead keyboard and all new keyboards forbidden?
  - Dylan16807 11y ago
    With your mouse. I'm being cheeky but any good lock screen should have an onscreen keyboard button. And it should only need to do it the first time you plug it in.
    - vacri 11y ago
mcherm 11y ago
> The only solution is to educate people to not plug hardware they don't trust into their machines. Solution to what problem? If the problem is "people keep getting hacked by plugging things into USB ports" then there are lots of other solutions. Filling in the USB ports with glue works well. If the problem is "we need a way to plug in hardware easily without introducing security vulnerabilities" then educating people doesn't help at all.
MichaelGG 11y ago
>We need to plug in keyboards Uh, even a prompt like "A new keyboard was added, do you wish to use it?" would work (after the system is up and there is already an input device). Yes you can come up with edge cases, but it should be easy enough to detect the difference between someone trying to get a keyboard working versus someone going about their day and a new USB device showing up as a keyboard.
egypturnash 11y ago
We can watch for unusual situations and ask questions about them. ---- USB device: hi computer i'm a new usb device, i can provide keystroke input computer: that's a little weird, I already have a keyboard. hey user, do you really want two keyboards at once? user: wtf no computer: cool. sorry, usb device. no keystrokes from you. ---- USB device: hi computer I'm a new usb device, I can do keyboard input and provide mass storage computer: that's a weird combination there buddy. hey user, does this sound cool? user: weeeird, hmm, yeah how about mass storage so I can see what's on this thing, but no keyboard input. computer: a pox upon your possibly-suspicious data, my hot-pluggable friend! but tell me about your filesystem. USB device: hey here are some keystroke events anyway computer: I'm not listeniiiiiing plus I just told on you to the user USB device: curses, foiled again ---- USB device: hi computer I'm a new usb device, I can do keyboard input and provide mass storage computer: that's a weird combination there buddy. plus i already have a keyboard plugged in. oh wait the user said you were okay and told me to never ask again. USB device: cool ---- USB device: hi computer I'm a new usb device, I can do @$T%^&#R&ssnhf^23&298>>> computer: that's a nice buffer overflow you have there, darling. take me, I'm yours! USB device: p0n'd. here's a payload! user: huh, that usb key I found in the parking lot of the nuclear plant doesn't work. Oh well. throws it away payload: all yr base belong to us ---- Obviously "not plugging untrusted hardware into their machine" is still useful. And users often just say 'okay' to everything anyway. But "a weird thing is happening, are you cool with this?" would be a nice line of defense.

acdha 11y ago

> No, it will not be fixed. There is no vulnerability. … The only solution is to educate people to not plug hardware they don't trust into their machines. “We just need to educate users about passwords” “We just need to educate users about how to verify SSL certificates” “We just need to educate users about how to install only software from trusted publishers” etc. This reaction is understandable but it's a non-starter if we ever want to make meaningful progress on security. The underlying problem here is that everything local was assumed to be trustworthy and that's not true and, thanks to reflashable firmware, not even something which can be assumed to stay true even if it happens to be the case when you start. Fixing problems like this will require changes – X-Istence mentioned OS prompting for new device classes, which would particularly effective on devices like laptops (i.e. the default for most users) which could require confirmation on the built-in hardware any time an external device tries to duplicate built-in functionality (keyboard, mouse, network, etc.), but we probably need more ambitious measures like adding a public-key exchange for certain device classes or a hardware switch which controls whether a port is allowed to control the computer or provide block storage but not both. The one thing which is certain is that the .gov / .mil security people who seal ports with epoxy aren't looking as paranoid these days…

brillenfux 11y ago
I think signed firmware would probably solve most problems. Hobbyists would have to run their system in an insecure mode, though and it's a whole new story if a certificate-based system would actually work in a market as volatile as USB peripherals. So, I don't think there's one magic bullet but it's far too silent on that front!
- acdha 11y ago
  Agreed – signed firmware is going to be the way forward for a lot of things but it's going to open up other problems like fighting to retain the user's ability to decide whose signatures to trust and I'm sure we'll see a bunch of horrible key management by vendors.
- brohee 11y ago
  I don't see how signed firmware solves that issue at all. It could solve BadUSB, where one corrupts a legitimate device with poisoned firmware, but it doesn't address at all a user tricked into plugging a bad device...
  - acdha 11y ago
    It adds an accountability mechanism for spoofing device types: the vendor's signing certificate can be revoked if they release devices which pretend to be from a different vendor or which misrepresent the device class. A reasonable criticism is that this would likely result in several examples of customers being screwed when SmallCorp Inc. loses control of their signing key, it's used to sign malware, and the revocation takes out all of the legitimate users but that's arguably an unavoidable cost of the industry maturing.
    - Someone 11y ago
      Also, if "large device manufacturer" ever losse its key, zillions of devices could become unusable overnight (scenario: Evie signs malware with the leaked key, Apple and Microsoft revoke it in a high-priority update; all devices signed with the key become unusable; the world is 'not happy') You likely also would need a way to update the key or flash new firmware and, possibly, a way for the updater to detect whether the device it is talking to has been tampered with. That's expensive for low-margin products such as USB sticks and mice. Also, the average user would not know how to update the firmware, and even if he knew, might not be able to because his keyboard and mouse are fried.

elektromekatron 11y ago

How many keyboards do you need to type with? If a keyboard exists and a second one suddenly appears, giving it a separate buffer and keeping that buffer from doing anything until asked, would seem to be pretty sane.

stan_rogers 11y ago
Four, typically, along with three things that could be called pointing devices. (That would be a laptop's built-in keyboard, a proper external keyboard, the hotkeys on a Wacom tablet, and a programmable keypad to make Ctrl+Alt+Shift+[optional Fn if using a compact/laptop keyboard]+[whatever]+"hold your tongue in precisely this position while trying to do things with the other hand using a pressure-sensitive pen" key combinations into a single simple keystroke, the laptop's pointing device, an external mouse, and the actual tablet part of the Wacom.) And yes, there are home and travelling versions of the set-up. People seriously working in 3D, non-linear editing, and so forth, would have more. Things can get rather complicated in a hurry when the computer becomes the core of a dedicated toolset that can also be used, on occasion, to perform simple administrative tasks like email, invoicing, ...

digi_owl 11y ago

That systemd thing is hilarious in its tragic misunderstanding. Basically a patch was offered that would lock a computer if a new device was plugged in. This to counter act police mouse wigglers etc. But Poettering decided that no that was too heavy handed, lets instead black list the specific product id. Never mind that changing a product id is a firmware flash away (one could probably make a wiggler that randomize its id on each insertion).

mayoff 11y ago
Or just make the wiggler identify itself as an extremely common type of mouse.
pnathan 11y ago
link to source? I'm interested in reading the discussion.
- digi_owl 11y ago
  Best i recall there was no discussion. At least all i read was a patch note. Sadly i didn't save a link...
vacri 11y ago
It is too heavy-handed. Locking the computer every time I plug in a controller or some other HID? What if the battery dies in my wireless keyboard, and I need to plug in another one temporarily? How could I possibly type in the password at a lock screen with one dead keyboard and all new keyboards forbidden?
- Dylan16807 11y ago
  With your mouse. I'm being cheeky but any good lock screen should have an onscreen keyboard button. And it should only need to do it the first time you plug it in.
  - vacri 11y ago

mcherm 11y ago

> The only solution is to educate people to not plug hardware they don't trust into their machines. Solution to what problem? If the problem is "people keep getting hacked by plugging things into USB ports" then there are lots of other solutions. Filling in the USB ports with glue works well. If the problem is "we need a way to plug in hardware easily without introducing security vulnerabilities" then educating people doesn't help at all.

MichaelGG 11y ago

>We need to plug in keyboards Uh, even a prompt like "A new keyboard was added, do you wish to use it?" would work (after the system is up and there is already an input device). Yes you can come up with edge cases, but it should be easy enough to detect the difference between someone trying to get a keyboard working versus someone going about their day and a new USB device showing up as a keyboard.

egypturnash 11y ago

We can watch for unusual situations and ask questions about them. ---- USB device: hi computer i'm a new usb device, i can provide keystroke input computer: that's a little weird, I already have a keyboard. hey user, do you really want two keyboards at once? user: wtf no computer: cool. sorry, usb device. no keystrokes from you. ---- USB device: hi computer I'm a new usb device, I can do keyboard input and provide mass storage computer: that's a weird combination there buddy. hey user, does this sound cool? user: weeeird, hmm, yeah how about mass storage so I can see what's on this thing, but no keyboard input. computer: a pox upon your possibly-suspicious data, my hot-pluggable friend! but tell me about your filesystem. USB device: hey here are some keystroke events anyway computer: I'm not listeniiiiiing plus I just told on you to the user USB device: curses, foiled again ---- USB device: hi computer I'm a new usb device, I can do keyboard input and provide mass storage computer: that's a weird combination there buddy. plus i already have a keyboard plugged in. oh wait the user said you were okay and told me to never ask again. USB device: cool ---- USB device: hi computer I'm a new usb device, I can do @$T%^&#R&ssnhf^23&298>>> computer: that's a nice buffer overflow you have there, darling. take me, I'm yours! USB device: p0n'd. here's a payload! user: huh, that usb key I found in the parking lot of the nuclear plant doesn't work. Oh well. throws it away payload: all yr base belong to us ---- Obviously "not plugging untrusted hardware into their machine" is still useful. And users often just say 'okay' to everything anyway. But "a weird thing is happening, are you cool with this?" would be a nice line of defense.