4 ms·
But it's the assumption that is in itself inaccurate. Case #1 is about a modified firmware of the USB controller in the USB stick, case #2 assumes that a boot i
by jaclaz 10y ago
But it's the assumption that is in itself inaccurate.
Case #1 is about a modified firmware of the USB controller in the USB stick, case #2 assumes that a boot is initiated from the USB stick.
What the Circlean thingy does is more similar to an antivirus, it examines the contents (files) on the USB stick filesystem and only copies to the second stick those files of known type, according to the given rules.
Whether this is effective against everything is another thing, of course.
Only "plain" files are directly copied, other supported ones are analyzed and converted, some more detiled info is here:
https://github.com/CIRCL/Circlean/blob/master/README.md https://github.com/CIRCL/Circlean/blob/master/README.md
The thing is not really "new":
https://news.ycombinator.com/item?id=8216853 https://news.ycombinator.com/item?id=8216853
- leni536 10y agoNo, I think the assumption is entirely correct. If you can't trust a USB stick's contents then you probably can't trust its controller itself. But your OS doesn't have to say "Oh, you are a keyboard? Here, open a terminal and type arbitrary commands." It can say "Sorry, I only talk to USB mass storage class devices."
- ckastner 10y agoWhat about the pre-boot phase, before the OS is loaded?
- leni536 10y ago1. You can avoid inserting anything before the OS boots up. 2. You can disable booting from USB in the BIOS. However I think you can't disable keyboards there, so a badUSB device can potentially enter the bios, enable USB booting then infect the machine by booting into the virus. Disabling USB booting and setting a strong BIOS password can be safe, I would still prefer the first option though.
- ckastner 10y agoAgreed, but in this specific case, CIRCLean depends on the keys being inserted before boot (see steps 2 - 4).
- leni536 10y agoOh, you are right, this can be bad. But I doubt that CIRCLean does any of the badUSB mitigations. They could fix all of these including the instructions. But that they copy unrecognised binaries ("Octet-stream" in their readme) without marking them dangerous is the most worrisome for me [1]. It seems to be useful only for office documents. [1] https://github.com/CIRCL/Circlean https://github.com/CIRCL/Circlean
- SteveClement 10y ago> They could fix all of these including the instructions. Where "They" could be anyones pull-request
- Piskvorrr 10y agoCirclean seems to run on RPi - that won't boot off USB by default. In fact, you have to jump through extra hoops to get a similar effect, such as "bootloader runs from SD card, then explicitly switches to USB". So unless the makers of this have deliberately implemented this vulnerability, it's not there.
- jaclaz 10y agoYes, this is how I believe the RPi works, we are by now too used to the "automagic" features of the common OS's (and BIOSes/UEFI's), I presume that the same effect could be obtained by using an old DOS machine with (say) the Panasonic driver, or something like that.
- ckastner 10y ago> What the Circlean thingy does is more similar to an antivirus This is also how I would characterize it. > Whether this is effective against everything is another thing, of course. The homepage states: In the worst case, only the CIRCLean would be compromised, but not the computer reading the target (trusted) USB key/stick. which (at least to me) seems to imply complete effectiveness, which is what irks me.