4 ms·

I think signed firmware would probably solve most problems. Hobbyists would have to run their system in an insecure mode, though and it's a whole new story if

I think signed firmware would probably solve most problems. Hobbyists would have to run their system in an insecure mode, though and it's a whole new story if a certificate-based system would actually work in a market as volatile as USB peripherals. So, I don't think there's one magic bullet but it's far too silent on that front!

acdha 11y ago
Agreed – signed firmware is going to be the way forward for a lot of things but it's going to open up other problems like fighting to retain the user's ability to decide whose signatures to trust and I'm sure we'll see a bunch of horrible key management by vendors.
brohee 11y ago
I don't see how signed firmware solves that issue at all. It could solve BadUSB, where one corrupts a legitimate device with poisoned firmware, but it doesn't address at all a user tricked into plugging a bad device...
- acdha 11y ago
  It adds an accountability mechanism for spoofing device types: the vendor's signing certificate can be revoked if they release devices which pretend to be from a different vendor or which misrepresent the device class. A reasonable criticism is that this would likely result in several examples of customers being screwed when SmallCorp Inc. loses control of their signing key, it's used to sign malware, and the revocation takes out all of the legitimate users but that's arguably an unavoidable cost of the industry maturing.
  - Someone 11y ago
    Also, if "large device manufacturer" ever losse its key, zillions of devices could become unusable overnight (scenario: Evie signs malware with the leaked key, Apple and Microsoft revoke it in a high-priority update; all devices signed with the key become unusable; the world is 'not happy') You likely also would need a way to update the key or flash new firmware and, possibly, a way for the updater to detect whether the device it is talking to has been tampered with. That's expensive for low-margin products such as USB sticks and mice. Also, the average user would not know how to update the firmware, and even if he knew, might not be able to because his keyboard and mouse are fried.
  - jcrawfordor 11y ago
    In this case there was no faking of the vendor installed. HID is a generic input class, you're not making any promise about who manufactured a device when you make it represent as HID. A lot of people seem to think that this was a device with hacked or other illegitimate firmware. It was not. It was a device called a WebKey, which is available from a number of vendors and is intended to do exactly what the author is describing. Is it a dumb product? Yes. But this is not any kind of firmware exploit. It's just a keyboard that doesn't look like a keyboard, some as a YubiKey or one of several other sorts of non-keyboard devices that present as keyboards.
    - acdha 11y ago
      Right, note that up-thread (https://news.ycombinator.com/item?id=10204222 https://news.ycombinator.com/item?id=10204222) I was agreeing with the general call for OS safeguards such as confirming that a particular device be allowed to act as a particular class. Signatures become relevant due to what will inevitably happen if those safeguards become common: right now someone is selling devices like this to marketing people. If Windows 11 breaks that with a permission check, the companies have the choice of either dropping that product or changing it to pretend to be a Microsoft USB keyboard on the whitelist. If it's some fly-by-night marketing services company in China, there's limited recurse to go after them unless you have a lever such as being able to revoke signing keys.

acdha 11y ago

Agreed – signed firmware is going to be the way forward for a lot of things but it's going to open up other problems like fighting to retain the user's ability to decide whose signatures to trust and I'm sure we'll see a bunch of horrible key management by vendors.

brohee 11y ago

I don't see how signed firmware solves that issue at all. It could solve BadUSB, where one corrupts a legitimate device with poisoned firmware, but it doesn't address at all a user tricked into plugging a bad device...

acdha 11y ago
It adds an accountability mechanism for spoofing device types: the vendor's signing certificate can be revoked if they release devices which pretend to be from a different vendor or which misrepresent the device class. A reasonable criticism is that this would likely result in several examples of customers being screwed when SmallCorp Inc. loses control of their signing key, it's used to sign malware, and the revocation takes out all of the legitimate users but that's arguably an unavoidable cost of the industry maturing.
- Someone 11y ago
  Also, if "large device manufacturer" ever losse its key, zillions of devices could become unusable overnight (scenario: Evie signs malware with the leaked key, Apple and Microsoft revoke it in a high-priority update; all devices signed with the key become unusable; the world is 'not happy') You likely also would need a way to update the key or flash new firmware and, possibly, a way for the updater to detect whether the device it is talking to has been tampered with. That's expensive for low-margin products such as USB sticks and mice. Also, the average user would not know how to update the firmware, and even if he knew, might not be able to because his keyboard and mouse are fried.
- jcrawfordor 11y ago
  In this case there was no faking of the vendor installed. HID is a generic input class, you're not making any promise about who manufactured a device when you make it represent as HID. A lot of people seem to think that this was a device with hacked or other illegitimate firmware. It was not. It was a device called a WebKey, which is available from a number of vendors and is intended to do exactly what the author is describing. Is it a dumb product? Yes. But this is not any kind of firmware exploit. It's just a keyboard that doesn't look like a keyboard, some as a YubiKey or one of several other sorts of non-keyboard devices that present as keyboards.
  - acdha 11y ago
    Right, note that up-thread (https://news.ycombinator.com/item?id=10204222 https://news.ycombinator.com/item?id=10204222) I was agreeing with the general call for OS safeguards such as confirming that a particular device be allowed to act as a particular class. Signatures become relevant due to what will inevitably happen if those safeguards become common: right now someone is selling devices like this to marketing people. If Windows 11 breaks that with a permission check, the companies have the choice of either dropping that product or changing it to pretend to be a Microsoft USB keyboard on the whitelist. If it's some fly-by-night marketing services company in China, there's limited recurse to go after them unless you have a lever such as being able to revoke signing keys.