3 ms·
No, I think the assumption is entirely correct. If you can't trust a USB stick's contents then you probably can't trust its controller itself. But your OS does
by leni536 10y ago
No, I think the assumption is entirely correct. If you can't trust a USB stick's contents then you probably can't trust its controller itself.
But your OS doesn't have to say "Oh, you are a keyboard? Here, open a terminal and type arbitrary commands." It can say "Sorry, I only talk to USB mass storage class devices."
- ckastner 10y agoWhat about the pre-boot phase, before the OS is loaded?
- leni536 10y ago1. You can avoid inserting anything before the OS boots up. 2. You can disable booting from USB in the BIOS. However I think you can't disable keyboards there, so a badUSB device can potentially enter the bios, enable USB booting then infect the machine by booting into the virus. Disabling USB booting and setting a strong BIOS password can be safe, I would still prefer the first option though.
- ckastner 10y agoAgreed, but in this specific case, CIRCLean depends on the keys being inserted before boot (see steps 2 - 4).
- leni536 10y agoOh, you are right, this can be bad. But I doubt that CIRCLean does any of the badUSB mitigations. They could fix all of these including the instructions. But that they copy unrecognised binaries ("Octet-stream" in their readme) without marking them dangerous is the most worrisome for me [1]. It seems to be useful only for office documents. [1] https://github.com/CIRCL/Circlean https://github.com/CIRCL/Circlean
- SteveClement 10y ago> They could fix all of these including the instructions. Where "They" could be anyones pull-request
- Piskvorrr 10y agoCirclean seems to run on RPi - that won't boot off USB by default. In fact, you have to jump through extra hoops to get a similar effect, such as "bootloader runs from SD card, then explicitly switches to USB". So unless the makers of this have deliberately implemented this vulnerability, it's not there.
- jaclaz 10y agoYes, this is how I believe the RPi works, we are by now too used to the "automagic" features of the common OS's (and BIOSes/UEFI's), I presume that the same effect could be obtained by using an old DOS machine with (say) the Panasonic driver, or something like that.