4 ms·
It is a bad idea to plug untrusted hardware into your computer. Many Windows users have autorun enabled, so could be infected with malware as soon as they plug
by sweis 16y ago
It is a bad idea to plug untrusted hardware into your computer. Many Windows users have autorun enabled, so could be infected with malware as soon as they plug it in. This has been exploited by people pretending to run promotions and handing out infected USB drives in front of targeted businesses.
Worse than autorun, there have been buffer overflows against USB drivers and proof-of-concept exploits that allowed Firewire devices to read arbitrary physical memory through DMA access. I haven't seen this used in practice, but the risk is there. Bruce Schneier wrote about these attacks a few years ago:
http://www.schneier.com/blog/archives/2006/06/hacking_compute.html http://www.schneier.com/blog/archives/2006/06/hacking_comput...
If you want to go down the Ken Thompson "Trusting Trust" hardware security rabbit hole, think about who manufactured your computer.
- alttab 16y agoThis was the first and only thing I thought about when reading the article. The idea is "neat" but completely impractical and extremely dangerous.
- anigbrowl 16y agoZzzzz. Old spare computer with no network connection, DVD burner, done.
- swolchok 16y agoI think USB-based DMA attacks were used against the Xbox 360, but I don't have a source off the top of my head.
- petercooper 16y agoNot even just that, but someone could rig up a USB plug that shorted out the power (or, worse, rammed 9V from a battery back up it) and cream your USB port..
- Osmose 16y agoIt's a similar risk to using a file sharing network though. It depends on the type of files you're downloading, of course, but lots of people don't check an EXE before running it. Although you often have the wisdom of the crowd when downloading files; if 1000 people are sharing/seeding, then the files are probably* safe. * Possibly a terrible assumption.