3 ms·
If you just leave away the USB mass storage kernel module when compiling the kernel, the mass storage device won't work anymore while the mouse still works. I w
by chrisper 10y ago
If you just leave away the USB mass storage kernel module when compiling the kernel, the mass storage device won't work anymore while the mouse still works. I wonder if this is a solution to this problem or not since it seems quite naive.
- drvdevd 10y agoJust speculating: this might mitigate some kernel level exploits but since its typically usb card <--> usb bus/controller <--> PCI bus, presumably hardware or kernel bugs elswhere in that stack could still be exploited. Interesting thought!
- ge0rg 10y agoThis is not sufficient. One known vector is to emulate a USB network device that provides a nameserver via DHCP, but no default route,allowing the attacker to MitM chosen connections. And of course you have a plethora of different USB device types with default drivers that probably contain exploitable bugs.
- jandrese 10y agoToo easy to have that undone by a security update later. Better to physically disable the ports (fill them with epoxy for example). Much more foolproof and easy to verify.
- superuser2 10y agoAny USB device gets to be a keyboard and mouse. If it comes down to it, the device could just "type" its payload.
- cxseven 10y agoAnd if that malware can't liberate USB access, and still needs to read data (rather than just writing it), it could exploit the capacity for various devices to emit detectable EM radiation. The fake keyboard/mouse, being inside the Faraday cage, would be able to sense that radiation and extract data that the malware in its payload sends back to it. In fact, all of this would work equally well with a PS/2 port.
- robocat 10y agoThe BIOS may access USB devices e.g. during boot or config.