4 ms·

> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions? For linux you can actually require USB devices to be authorize

by lawl 8y ago

> It's 2019. Why the f haven't Windows, MacOS and Linux all implemented these basic precautions? For linux you can actually require USB devices to be authorized first by changing a few kernel settings. A friend of mine wrote a few shellscripts a few years ago to do exactly that: https://git.quitesimple.org/usbfilter/tree/ https://git.quitesimple.org/usbfilter/tree/ As you can see it's something that's very simple to do, there's just no good "normal user" UI for it.

Reelin 8y ago
Better late than never? https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.1-USB-Auth-Default-2 https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.... https://usbguard.github.io https://usbguard.github.io
- jimrandomh 8y ago
  That's definitely progress, but there's more work needed to make it usable enough to be on by default.
  - Reelin 8y ago
    As far as I understand it, this already is on by default for ChromeOS. The kernel patches make it possible to utilize internal USB devices during the boot process without disabling protection - ie there's no vulnerability window prior to user space being up and running. I believe the major missing piece for desktop Linux at this point is that many input devices (including my own) are USB based. Without a way for the device to cryptographically attest its identity, you either have to accept vulnerability from wired external devices during boot or do without input until user space has been started. Edit: My mistake. It appears that it was opt-in as of January, will become on-by-default at some point in the future, and only blocks devices during boot and while the screen is locked. It appears to trust all devices plugged into it once you've logged in. (https://www.forbes.com/sites/leemathews/2019/01/07/google-shields-chromebooks-from-sneaky-usb-attacks https://www.forbes.com/sites/leemathews/2019/01/07/google-sh...)
    - hopler 8y ago
      The only reason your laptop is trusted is because you trust the person who gave you the laptop. The same threat model applies to the first keyboard you get for your desktop. Neither laptop/desktop nor keyboard is inherently more trustworthy.
      - Reelin 8y ago
        I'm not worried about the keyboard I purchased or my hardware vendor. Well I am, but far less so than the prospect of a foreign USB device being plugged in and managing to execute malicious code. Think someone quickly inserting a device as they walk by, secretly swapping out one of my peripherals while I'm not around, or similar. Authorization on first use is more than sufficient to mitigate this type of attack, and if you add end-to-end encryption you can also prevent USB keyloggers.
shittyadmin 8y ago
Definitely a good start but in a targeted attack scenario that's pretty trivial to bypass, if someone brags about having the latest Das Keyboard or something that's all it'd take... we need cryptographic authentication in the USB specification or at least a randomized serial that'd be unique per device so an attacker would need physical access to clone your keyboard. I believe modern Thunderbolt already has this sort of cryptographic device authentication, which means not only physical access but at least a bit of reverse engineering skill, a much higher barrier than knowing their keyboard model.
- Reelin 8y ago
  It's particularly frustrating because of how trivial the solution appears to be. Trust on first use is more than sufficient in this case, so asymmetric cryptography with a randomized key would be fine. I realize mass produced electronics can be very cost sensitive and that a PKI chip might add a whole $0.70 to your product (https://www.digikey.com/en/product-highlight/a/atmel/atsha204a-full-turnkey-security-device https://www.digikey.com/en/product-highlight/a/atmel/atsha20...), but still. I paid ~$50 for my keyboard! I would not have begrudged the manufacturer an extra dollar or two in order to ensure my system's security.

by lawl 8y ago

Reelin 8y ago

Better late than never? https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.1-USB-Auth-Default-2 https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.... https://usbguard.github.io https://usbguard.github.io

jimrandomh 8y ago
That's definitely progress, but there's more work needed to make it usable enough to be on by default.
- Reelin 8y ago
  As far as I understand it, this already is on by default for ChromeOS. The kernel patches make it possible to utilize internal USB devices during the boot process without disabling protection - ie there's no vulnerability window prior to user space being up and running. I believe the major missing piece for desktop Linux at this point is that many input devices (including my own) are USB based. Without a way for the device to cryptographically attest its identity, you either have to accept vulnerability from wired external devices during boot or do without input until user space has been started. Edit: My mistake. It appears that it was opt-in as of January, will become on-by-default at some point in the future, and only blocks devices during boot and while the screen is locked. It appears to trust all devices plugged into it once you've logged in. (https://www.forbes.com/sites/leemathews/2019/01/07/google-shields-chromebooks-from-sneaky-usb-attacks https://www.forbes.com/sites/leemathews/2019/01/07/google-sh...)
  - hopler 8y ago
    The only reason your laptop is trusted is because you trust the person who gave you the laptop. The same threat model applies to the first keyboard you get for your desktop. Neither laptop/desktop nor keyboard is inherently more trustworthy.
    - Reelin 8y ago
      I'm not worried about the keyboard I purchased or my hardware vendor. Well I am, but far less so than the prospect of a foreign USB device being plugged in and managing to execute malicious code. Think someone quickly inserting a device as they walk by, secretly swapping out one of my peripherals while I'm not around, or similar. Authorization on first use is more than sufficient to mitigate this type of attack, and if you add end-to-end encryption you can also prevent USB keyloggers.

shittyadmin 8y ago

Definitely a good start but in a targeted attack scenario that's pretty trivial to bypass, if someone brags about having the latest Das Keyboard or something that's all it'd take... we need cryptographic authentication in the USB specification or at least a randomized serial that'd be unique per device so an attacker would need physical access to clone your keyboard. I believe modern Thunderbolt already has this sort of cryptographic device authentication, which means not only physical access but at least a bit of reverse engineering skill, a much higher barrier than knowing their keyboard model.

Reelin 8y ago
It's particularly frustrating because of how trivial the solution appears to be. Trust on first use is more than sufficient in this case, so asymmetric cryptography with a randomized key would be fine. I realize mass produced electronics can be very cost sensitive and that a PKI chip might add a whole $0.70 to your product (https://www.digikey.com/en/product-highlight/a/atmel/atsha204a-full-turnkey-security-device https://www.digikey.com/en/product-highlight/a/atmel/atsha20...), but still. I paid ~$50 for my keyboard! I would not have begrudged the manufacturer an extra dollar or two in order to ensure my system's security.