3 ms·

I could only speculate how specific applications (e.g. at airports) are built. However, if some specific vendor was susceptible to this attack, it would just b

I could only speculate how specific applications (e.g. at airports) are built. However, if some specific vendor was susceptible to this attack, it would just be a stupid, obvious and easily fixable input handling bug in their product. But the linked article doesn't even demonstrate such an attack against an actual application ("BadBarcode is not a vulnerability of a certain product"). Just a trivial "demo" where they use a virtual keyboard device to enter commands directly into a windows shell and then get excited that it works...

voltagex_ 11y ago
Well yes, but it's a new application of a HID attack, and it's nicely wrapped up for the media/public (who just got done watching CSI Cyber and Mr Robot) Also, just because it's trivial doesn't mean it'll get patched quickly (wasn't it France's airports that were still running Windows 3.11?) or even be acknowledged by the vendor. I'd try this on my local self-serve supermarket checkout if I were feeling brave...
- paulasmuth 11y ago
  Agreed on all points. Still the "airports can be hacked using this ninja barcode trick" spin that they put on the story pushes my buttons. -- The "trick" is absolutely trivial and they haven't even bothered to try and confirm it on _any_ real world device. This doesn't stop them from framing it in a way that makes it look like a significant discovery of a new vulnerability which "affects the entire barcode scanner-related industries" and then try to insinuate fear of the possible consequences of that "new discovery": "[It's] really a serious problem, not just a bug people could use to get free beer". Even though it's all based on complete speculation in the first place. In all likelihood, the people building those systems have thought of and closed the attack vector a long time ago (if it was ever there). But of course vice apparently hasn't even asked a single vendor for comment -- maybe the answer would've been "no, it's not a problem in our product". I find it a typical case of vice reporting. They take something that isn't exactly true/new to begin with and then blow it extremely out of proportion. This creates the illusion that only vice has the hottest, rawest and most uncensored stories abut sex, drugs and crime which nobody else reports about like they do (because they are mostly made up by vice). IMO vice is classic yellow press packaged for the hip and trendy geeks of my/our generation. </rant>

voltagex_ 11y ago

Well yes, but it's a new application of a HID attack, and it's nicely wrapped up for the media/public (who just got done watching CSI Cyber and Mr Robot) Also, just because it's trivial doesn't mean it'll get patched quickly (wasn't it France's airports that were still running Windows 3.11?) or even be acknowledged by the vendor. I'd try this on my local self-serve supermarket checkout if I were feeling brave...

paulasmuth 11y ago
Agreed on all points. Still the "airports can be hacked using this ninja barcode trick" spin that they put on the story pushes my buttons. -- The "trick" is absolutely trivial and they haven't even bothered to try and confirm it on _any_ real world device. This doesn't stop them from framing it in a way that makes it look like a significant discovery of a new vulnerability which "affects the entire barcode scanner-related industries" and then try to insinuate fear of the possible consequences of that "new discovery": "[It's] really a serious problem, not just a bug people could use to get free beer". Even though it's all based on complete speculation in the first place. In all likelihood, the people building those systems have thought of and closed the attack vector a long time ago (if it was ever there). But of course vice apparently hasn't even asked a single vendor for comment -- maybe the answer would've been "no, it's not a problem in our product". I find it a typical case of vice reporting. They take something that isn't exactly true/new to begin with and then blow it extremely out of proportion. This creates the illusion that only vice has the hottest, rawest and most uncensored stories abut sex, drugs and crime which nobody else reports about like they do (because they are mostly made up by vice). IMO vice is classic yellow press packaged for the hip and trendy geeks of my/our generation. </rant>