4 ms·
First off, I think this is super cool. It's a novel and interesting take on a very boring but necessary concept, and he's taken the time to get the design looki
by wzdd 16y ago
First off, I think this is super cool. It's a novel and interesting take on a very boring but necessary concept, and he's taken the time to get the design looking nice as well -- he could easily have just soldered an attiny to a USB connector, and that wouldn't have had the same charm.
Secondly, it seems the security implications are very slightly more severe than one might think. The card only activates when you press caps lock three times. This means it must be able to receive key presses, as well as to send them. From my understanding of his description, keyboard HID devices which support the boot protocol profile also receive notification of key presses (http://frank.circleofcurrent.com/cache/usbbusinesscard_details.htm http://frank.circleofcurrent.com/cache/usbbusinesscard_detai... and search 'boot protocol'). So in theory this could record everything you typed, as well as do destructive things to your computer. And of course storage is not an issue as it's likely that the host is connected to the Internet.
It seems borderline paranoid to think like this w.r.t. someone's business card, though.
- mikeknoop 16y agoAccording to a comment on the parent article, all USB keyboards receive the standard 3 lock keys so they can toggle state (think LED lights): Caps Lock, Num Lock, Scroll Lock If true, this is why the author chose to use Caps Lock over a different key. I can't claim whether that is true or not but it puts a damper on the USB keyboard security concerns.
- zbanks 16y agoYou are correct. There are a few other small triggers that the keyboard can also potentially receive, but those 3 are the most common. HID in general can be set up to receive more data, but there aren't any "normal" devices with built-in drivers that utilize a lot of bi-directional data transfer. (I've been looking to create a "driverless" "serial port" using HID communication, tx is easy (keyboard type), but rx is hard (bitbanging using the 3 LEDs? eh....)
- follower 16y ago> I've been looking to create a "driverless" "serial port" using HID communication When you say "driverless" do you want it to act as an actual serial port or just provide bi-directional data transfer for a userland program? I think there's a standard V-USB example that provides driver-less bi-directional data transfer via reports. I adapted the example to work with the Arduino and a Python script. Some details are in the entry dated 22 October 2009 here: http://code.rancidbacon.com/ProjectLogArduinoUSB http://code.rancidbacon.com/ProjectLogArduinoUSB The code is online as the UsbStream example available in the download from here: http://code.google.com/p/vusb-for-arduino/downloads/list http://code.google.com/p/vusb-for-arduino/downloads/list
- tesseract 16y agoThis has been making the rounds and in every discussion I've seen about it so far, someone (or multiple people) have brought up security implications. Obviously it would be possible to use a device like this to do some nefarious stuff, but the same goes for any random no-name USB flash drive (for that matter there've been instances of name brand ones inadvertently shipping with viruses on them) or USB "toy" (keystroke logging coffee cup warmer, anyone?). I have to wonder why this thing is garnering such a reaction whereas it's not something that's brought up very often w.r.t. other USB products. Are people subconsciously afraid of it because it doesn't have a cute plastic enclosure?
- c3o 16y agoBy listening for Capslock presses, it has an unusual interface that people weren't consciously aware any USB device could have – that's what makes them think about security implications.