3 ms·

I wonder if you actually need a hardware device for this? Seems you could have an OS feature so when you insert a USB device it first confirms you're happy for

I wonder if you actually need a hardware device for this? Seems you could have an OS feature so when you insert a USB device it first confirms you're happy for the device to register as an X (mass storage, input, audio etc) before it lets it do it.

gchadwick 11y ago
Though saying yes to registering your keyboard, mouse etc every time you boot might get a little tedious (not to mention impossible if you have no other input devices!). Perhaps an extension to USB that has 512-bits worth of persistent storage per device. When you register a device the OS produces a random number and writes it and saves the list of allowed IDs. Or perhaps you could ask the OS to only apply the ask to register feature to certain USB ports?
- nitrogen 11y ago
  USB ports are individually addressable, even through hubs, so you can do what everyone hated about Win98 and show a new hardware wizard if a particular port ever has its device change (devices can be recognized by vendor, product, type, and in some cases serial number).
- zxv 11y ago
  USB firewall. White-list the USB keyboard when it is first attached, using its unique serial number, and avoid a prompt in the future.
  - dfox 11y ago
    Various devices tend to either have serial number empty (for example both my keyboard and mouse, Sun and Logitech respectively, so not exactly cheap Chinese crap) or filled with some random garbage that is not unique at all ("123456", "Serial" and so on). One would assume that "garbage in iSerial" is workaround for Windows' behavior of identifying devices by either it's serial or physical port and requiring distinct driver registrations for devices that are "different" according to this logic.
    - the8472 11y ago
      it might still be useful to filter based on type. if you expect a mass storage device you don't want it to register as input device.
  - okasaki 11y ago
    You can do something like this with grsecurity. It's not a whitelist but you can deny any new usb devices after you toggle a switch: If you say Y here, a new sysctl option with name "deny_new_usb" will be created. Setting its value to 1 will prevent any new USB devices from being recognized by the OS. Any attempted USB device insertion will be logged. This option is intended to be used against custom USB devices designed to exploit vulnerabilities in various USB device drivers.
- IshKebab 11y ago
  Simple: You don't have to confirm the first mouse and keyboard.
  - jfoutz 11y ago
    Is the order deterministic? More to the point, if i leave a bad USB stick plugged in, how do i guarantee my keyboard gets the free pass rather than the evil stick?
    - PeterisP 11y ago
      The OS can know that you had the same keyboard (the same ID) plugged in for the whole last year at the same socket, but the new 'keyboard' is plugged in that socket where you usually plug in random USB data storage devices.
mschuster91 11y ago
> I wonder if you actually need a hardware device for this? Yes. Bugs in the kernel part parsing the USB descriptors IIRC were one of the avenues in PS3 jailbreaking.
toyg 11y ago
Users will just click yes, or whichever default for "just make it work" you choose. Advanced protection/admin features left to consumers simply don't work, I thought we understood that by now. You must have something that will intelligently handle them on its own (e.g. heuristic AVs, smart firewalls etc). Because there is no way for a system to say "well, this looks like a storage device, but it's telling me it's an input one, something is fishy", you're just going to have a whitelist nobody really uses, like IE's "trusted sites" zones.

gchadwick 11y ago

Though saying yes to registering your keyboard, mouse etc every time you boot might get a little tedious (not to mention impossible if you have no other input devices!). Perhaps an extension to USB that has 512-bits worth of persistent storage per device. When you register a device the OS produces a random number and writes it and saves the list of allowed IDs. Or perhaps you could ask the OS to only apply the ask to register feature to certain USB ports?

nitrogen 11y ago
USB ports are individually addressable, even through hubs, so you can do what everyone hated about Win98 and show a new hardware wizard if a particular port ever has its device change (devices can be recognized by vendor, product, type, and in some cases serial number).
zxv 11y ago
USB firewall. White-list the USB keyboard when it is first attached, using its unique serial number, and avoid a prompt in the future.
- dfox 11y ago
  Various devices tend to either have serial number empty (for example both my keyboard and mouse, Sun and Logitech respectively, so not exactly cheap Chinese crap) or filled with some random garbage that is not unique at all ("123456", "Serial" and so on). One would assume that "garbage in iSerial" is workaround for Windows' behavior of identifying devices by either it's serial or physical port and requiring distinct driver registrations for devices that are "different" according to this logic.
  - the8472 11y ago
    it might still be useful to filter based on type. if you expect a mass storage device you don't want it to register as input device.
- okasaki 11y ago
  You can do something like this with grsecurity. It's not a whitelist but you can deny any new usb devices after you toggle a switch: If you say Y here, a new sysctl option with name "deny_new_usb" will be created. Setting its value to 1 will prevent any new USB devices from being recognized by the OS. Any attempted USB device insertion will be logged. This option is intended to be used against custom USB devices designed to exploit vulnerabilities in various USB device drivers.
IshKebab 11y ago
Simple: You don't have to confirm the first mouse and keyboard.
- jfoutz 11y ago
  Is the order deterministic? More to the point, if i leave a bad USB stick plugged in, how do i guarantee my keyboard gets the free pass rather than the evil stick?
  - PeterisP 11y ago
    The OS can know that you had the same keyboard (the same ID) plugged in for the whole last year at the same socket, but the new 'keyboard' is plugged in that socket where you usually plug in random USB data storage devices.

mschuster91 11y ago

> I wonder if you actually need a hardware device for this? Yes. Bugs in the kernel part parsing the USB descriptors IIRC were one of the avenues in PS3 jailbreaking.

toyg 11y ago

Users will just click yes, or whichever default for "just make it work" you choose. Advanced protection/admin features left to consumers simply don't work, I thought we understood that by now. You must have something that will intelligently handle them on its own (e.g. heuristic AVs, smart firewalls etc). Because there is no way for a system to say "well, this looks like a storage device, but it's telling me it's an input one, something is fishy", you're just going to have a whitelist nobody really uses, like IE's "trusted sites" zones.