3 ms·

Is using an IOMMU with a USB peripheral really enough? If my PC satisfies those and I plug in a random USB device am I safe?

jrockway 8y ago
The drivers on your PC are the issue. The USB controller isn't going to let a USB device directly access memory, at least from my understanding of the spec.
- _emacsomancer_ 8y ago
  I believe USB presents a much smaller attack surface since it has no direct memory access, apparently in contrast to SATA.
  - monocasa 8y ago
    SATA doesn't allow for DMA from the target device. SATA controllers can DMA, but that's not different from how NICs and USB controllers typically typically DMA. The target addresses are ultimately controlled by the device on the host side. Like USB it feels more like a traditional network protocol than a traditional bus protocol. PCI-E does DMA, and AFAIU was inspired by Infiniband (another RDMA protocol).
    - _emacsomancer_ 8y ago
      My understanding is that it was easier for SATA controllers to do DMA than it was for USB controllers, but I have a fairly limited understanding.
monocasa 8y ago
You don't need a IOMMU with USB. USB isn't an RDMA protocol like firewire and PCI-E, so an IOMMU doesn't really even make sense in that context. But no, you're not safe because crappy USB drivers can probably be exploited if they're expecting the USB device to be playing nice.
- tptacek 8y ago
  You're not necessarily safe, but obviously no matter how isolated you make the cell baseband, you can't get past "crappy glue code can still bone you". The reality is that the HSIC interface between the AP and the baseband is --- conceptually, at least --- about the best you can possibly do.
  - monocasa 8y ago
    Sure, I was mainly addressing "If my PC satisfies those and I plug in a random USB device am I safe?" rather than the constrained case of a known baseband and single driver.
    - bri3d 8y ago
      The basic USB protocol does not allow for direct peripheral mastering of DMA (unlike IEEE 1394 or PCIe for example). So, barring a protocol exploit in the USB host controller, which is certainly a theoretical possibility given the enormous size of the specification, fencing off the USB host controller using the IOMMU is just an additional layer of protection, rather than a necessary boundary like it is for a PCIe or 1394 device which has access to memory natively. A USB-C/USB3 physical port makes things a bit more complicated, as it also could be attached to a controller supporting Thunderbolt, which is PCIe. The unsafe part of plugging in a USB device is probably at the OS level rather than the protocol level - in my opinion you're much more likely to be owned by something like connecting a device with a buggy or compromised driver, mounting a filesystem containing an FS exploit, or reading a file containing an application exploit than by a USB-level protocol exploit.
      - monocasa 8y ago
        Right, that's why I said "but no, you're not safe because crappy USB drivers can probably be exploited if they're expecting the USB device to be playing nice." Finding a USB protocol level exploit would be like finding an exploitable bug in how a NIC does scatter/gather of packets. Like, notings impossible, but damn. You still shouldn't stick random unknown USB devices into your computer though.
Buge 8y ago
You're not safe plugging a random USB into your computer. It can pretend to be a keyboard and install malware.

jrockway 8y ago

The drivers on your PC are the issue. The USB controller isn't going to let a USB device directly access memory, at least from my understanding of the spec.

_emacsomancer_ 8y ago
I believe USB presents a much smaller attack surface since it has no direct memory access, apparently in contrast to SATA.
- monocasa 8y ago
  SATA doesn't allow for DMA from the target device. SATA controllers can DMA, but that's not different from how NICs and USB controllers typically typically DMA. The target addresses are ultimately controlled by the device on the host side. Like USB it feels more like a traditional network protocol than a traditional bus protocol. PCI-E does DMA, and AFAIU was inspired by Infiniband (another RDMA protocol).
  - _emacsomancer_ 8y ago
    My understanding is that it was easier for SATA controllers to do DMA than it was for USB controllers, but I have a fairly limited understanding.

monocasa 8y ago

You don't need a IOMMU with USB. USB isn't an RDMA protocol like firewire and PCI-E, so an IOMMU doesn't really even make sense in that context. But no, you're not safe because crappy USB drivers can probably be exploited if they're expecting the USB device to be playing nice.

tptacek 8y ago
You're not necessarily safe, but obviously no matter how isolated you make the cell baseband, you can't get past "crappy glue code can still bone you". The reality is that the HSIC interface between the AP and the baseband is --- conceptually, at least --- about the best you can possibly do.
- monocasa 8y ago
  Sure, I was mainly addressing "If my PC satisfies those and I plug in a random USB device am I safe?" rather than the constrained case of a known baseband and single driver.
  - bri3d 8y ago
    The basic USB protocol does not allow for direct peripheral mastering of DMA (unlike IEEE 1394 or PCIe for example). So, barring a protocol exploit in the USB host controller, which is certainly a theoretical possibility given the enormous size of the specification, fencing off the USB host controller using the IOMMU is just an additional layer of protection, rather than a necessary boundary like it is for a PCIe or 1394 device which has access to memory natively. A USB-C/USB3 physical port makes things a bit more complicated, as it also could be attached to a controller supporting Thunderbolt, which is PCIe. The unsafe part of plugging in a USB device is probably at the OS level rather than the protocol level - in my opinion you're much more likely to be owned by something like connecting a device with a buggy or compromised driver, mounting a filesystem containing an FS exploit, or reading a file containing an application exploit than by a USB-level protocol exploit.
    - monocasa 8y ago
      Right, that's why I said "but no, you're not safe because crappy USB drivers can probably be exploited if they're expecting the USB device to be playing nice." Finding a USB protocol level exploit would be like finding an exploitable bug in how a NIC does scatter/gather of packets. Like, notings impossible, but damn. You still shouldn't stick random unknown USB devices into your computer though.

Buge 8y ago

You're not safe plugging a random USB into your computer. It can pretend to be a keyboard and install malware.