9 ms·

Reposting from 4 months ago (https://news.ycombinator.com/item?id=19609745 https://news.ycombinator.com/item?id=19609745): It's a severe discredit to the major

Reposting from 4 months ago (https://news.ycombinator.com/item?id=19609745 https://news.ycombinator.com/item?id=19609745): It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system. If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until either that keyboard has typed the user's login password, or the user uses a different input device to authorize it. If it identifies itself as a storage device, the filesystem driver should be hardened. If it identifies itself as an obscure 90s printer with a buggy driver written in C, it should prompt the user to confirm the device type before it loads the driver. It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions?

gitgud 7y ago
>If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until either that keyboard has typed the user's login password, or the user uses a different input device to authorize it. An interesting solution, it would definitely prompt the user to understand what the device is trying to do. But I'm sure that it's extremely hard to prevent something malicious, once it has physical access to a port on your computer...
- josephg 7y ago
  Except for running wacky voltages through your computer, there's no fundamental reason why USB devices should be harder to protect against than malicious network traffic. The model is very similar - in both cases they're serial data transports. USB just uses devices instead of services, and drivers instead of programs.
- squarefoot 7y ago
  "An interesting solution, it would definitely prompt the user to understand what the device is trying to do." But then it could simply wait for the user to enter the password (1), then read it by sniffing the traffic from the keyboard and store it internally for later use, since it's all in clear ad it cannot be encrypted before entering the machine unless most (all) USB consumer hardware get some heavy modifications. 1- very simple algorithm: store in the internal flash memory whatever the user enters between connecting the keyboard and hitting the 2nd enter key; if it's mostly the same words, then it's very likely an user/password pair. "But I'm sure that it's extremely hard to prevent something malicious, once it has physical access to a port on your computer... " Very true. Malicious plug in hardware was just a matter of time; we badly need some active protection for these things, or it would be a mess. This is the perfect weapon in the hands of people with a thing for vandalism, I hope mainstream media won't cover that story.
  - jimrandomh 7y ago
    You're assuming the malicious device is a keyboard, or is on the signal path between the motherboard and a keyboard. That's not the common case, nor is it the case here. No one types their password into an iPhone cable, because the cable has no keys to type with.
thunderbong 7y ago
Probably because the keyboard can be plugged in and has to be recognized even before the operating system boots?

gitgud 7y ago

>If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until either that keyboard has typed the user's login password, or the user uses a different input device to authorize it. An interesting solution, it would definitely prompt the user to understand what the device is trying to do. But I'm sure that it's extremely hard to prevent something malicious, once it has physical access to a port on your computer...

josephg 7y ago
Except for running wacky voltages through your computer, there's no fundamental reason why USB devices should be harder to protect against than malicious network traffic. The model is very similar - in both cases they're serial data transports. USB just uses devices instead of services, and drivers instead of programs.
squarefoot 7y ago
"An interesting solution, it would definitely prompt the user to understand what the device is trying to do." But then it could simply wait for the user to enter the password (1), then read it by sniffing the traffic from the keyboard and store it internally for later use, since it's all in clear ad it cannot be encrypted before entering the machine unless most (all) USB consumer hardware get some heavy modifications. 1- very simple algorithm: store in the internal flash memory whatever the user enters between connecting the keyboard and hitting the 2nd enter key; if it's mostly the same words, then it's very likely an user/password pair. "But I'm sure that it's extremely hard to prevent something malicious, once it has physical access to a port on your computer... " Very true. Malicious plug in hardware was just a matter of time; we badly need some active protection for these things, or it would be a mess. This is the perfect weapon in the hands of people with a thing for vandalism, I hope mainstream media won't cover that story.
- jimrandomh 7y ago
  You're assuming the malicious device is a keyboard, or is on the signal path between the motherboard and a keyboard. That's not the common case, nor is it the case here. No one types their password into an iPhone cable, because the cable has no keys to type with.

thunderbong 7y ago

Probably because the keyboard can be plugged in and has to be recognized even before the operating system boots?