3 ms·
In this case there was no faking of the vendor installed. HID is a generic input class, you're not making any promise about who manufactured a device when you m
by jcrawfordor 11y ago
In this case there was no faking of the vendor installed. HID is a generic input class, you're not making any promise about who manufactured a device when you make it represent as HID.
A lot of people seem to think that this was a device with hacked or other illegitimate firmware. It was not. It was a device called a WebKey, which is available from a number of vendors and is intended to do exactly what the author is describing.
Is it a dumb product? Yes. But this is not any kind of firmware exploit. It's just a keyboard that doesn't look like a keyboard, some as a YubiKey or one of several other sorts of non-keyboard devices that present as keyboards.
- acdha 11y agoRight, note that up-thread (https://news.ycombinator.com/item?id=10204222 https://news.ycombinator.com/item?id=10204222) I was agreeing with the general call for OS safeguards such as confirming that a particular device be allowed to act as a particular class. Signatures become relevant due to what will inevitably happen if those safeguards become common: right now someone is selling devices like this to marketing people. If Windows 11 breaks that with a permission check, the companies have the choice of either dropping that product or changing it to pretend to be a Microsoft USB keyboard on the whitelist. If it's some fly-by-night marketing services company in China, there's limited recurse to go after them unless you have a lever such as being able to revoke signing keys.