3 ms·
"Making a thing type stuff when you plug it in" is an attack vector in the same way "sending a request over the network" is.
by klausa 11y ago
"Making a thing type stuff when you plug it in" is an attack vector in the same way "sending a request over the network" is.
- lucastx 11y agoIt's not "typing stuff", it's exercing forced, unasked control of your computer (plus unknown behavior on other operating systems), isn't it? If the user's expectation when handed a thumb drive looking USB device from a big company is that it will display files, and instead it just pretends to be him and controls his computer interface, for me it is at least a gray area regarding computer abuse. But I am not a lawyer.
- tripzilch 11y agoWell it's not "just typing stuff", it's typing some rather specific stuff to make your computer do something quite unexpected. The reasonable expectation (for a promotional item) is that it's a memory stick, not that it suddenly starts typing system control global keyboard shortcuts into your computer. Say you'd post a persistent XSS to a forum, but only use it include Fartscroll.js, is that an attack or not? Cause I consider that to be pretty much the same category as the "surprise" automatic typing USB thing. This weekend actually I used a USB device where this was in fact the intended behaviour: a barcode scanner. It registers as a keyboard and just types the numbers (or string) of whatever it scans. Very clever idea because it makes it very easy to write apps for, you don't need a driver or anything. Except I had momentarily forgotten that was how it works, so it surprised me anyway. Fortunately the numbers didn't do much in the program I had focused but still, that feeling of something else unexpectedly typing on my computer! Yeah if it had sent global keyboard shortcuts in order to make my computer start applications and load webpages, I'd be pretty pissed.