4 ms·
As someone who has only spent enough time to superficially comprehend this threat, I am left wondering why Windows does not have a mode wherein I would be UAC-p
by bhauer 10y ago
As someone who has only spent enough time to superficially comprehend this threat, I am left wondering why Windows does not have a mode wherein I would be UAC-prompted to activate any newly-attached USB device, regardless of what it is. I'd like the OS to say, "Hey, it looks like you just attached another keyboard. Please authenticate on your boot keyboard to accept this new keyboard." Similar for other kinds of devices. "You just attached a new network adapter. Please authenticate to enable this new adapter."
I would enable such a feature without hesitation. Especially with Windows Hello-enabled UAC, the additional pain of authenticating in order to use USB devices is minimal. But even if I have to type in my password every time I attach a device, that's fine.
- mtgx 10y agoBut if you put a USB device into a PC, wouldn't you want to authenticate it regardless of what it has on it? I think Microsoft's UAC security is pretty flawed in general, as it puts all the responsibility of installing an app package and making sure it's secure on the user. Users who find a "lost" USB stick on the street would still authenticate it in Windows when they get home, so this would do nothing to protect them.
- Filligree 10y agoIf they find a "lost USB stick", and the dialog box says "This is a network adapter, do you want to send your internet traffic through it", then they at least have that.
- BuuQu9hu 10y agoThis might be better: What did you just plug in? Mouse/Keyboard/Network/... Then if they get it wrong, disable the device.
- wyldfire 10y agoWhen the system is booted, which HID should it consider authoritative? I suppose your solution would mitigate some of the problem but you could imagine MS being reluctant to take on this complexity without being confident it would squash the risk entirely. Imagine all of the new interesting failure modes of not just accepting all HIDs.
- tedunangst 10y agoAll of them. 90% of the risk comes from new devices attached after boot (and subsequently detached before reboot). Eliminating that threat can be done without inconveniencing users.
- r00fus 10y agoEvil Maid says you shouldn't trust even your existing HID devices.
- tekklloneer 10y agoWe're trying to do better when best is really, really hard. Saying "it's not perfect so it's not good enough" really doesn't make anything harder for attackers. If you trust on boot, and someone forces a reboot, then that is a huge alert that something has changed.
- voltagex_ 10y ago>Saying "it's not perfect so it's not good enough" really doesn't make anything harder for attackers. This mentality is a huge problem in IT security at the moment. Not everyone's threat model includes Mossad.
- tekklloneer 10y agoAnd the thing about being Mossad'd is that even if you're being individually targeted, making it harder often is what lets you know you're being attacked. Raise the bar to fend off attackers!
- amluto 10y ago> Please authenticate on your boot keyboard to accept this new keyboard. There's an IMO nicer protocol to use: have the display say "Please type 'foo bar baz' into the keyboard to activate it" where 'foo bar baz' is some random challenge. This doesn't depend on having a trusted keyboard or mouse with which to answer.