4 ms·

"immediately terminates the connection" Reminds me of some old Firewalls that would actively poll active connections, and when one is made that violates their

"immediately terminates the connection" Reminds me of some old Firewalls that would actively poll active connections, and when one is made that violates their rules, "immediately" terminate it. Often times, an attacker can embed a lot in just a single URL in the query string (stolen passwords etc) that would be done in < 5ms, faster than the firewall can act (if not even faster than the polling interval itself), specially if there is plenty of rules and active connections and/or the machine is slow (e.g playing games). That's like choosing to not have a door on your house, because you know you can run fast and shoot the thief when they enter. Maybe its not as bad for hardware due to the inherit latencies involved, but I am always skeptic about things that use polling vs sitting in the middle at the kernel before a USB connection is allowed to happen to the OS in the first place. The default (aka the one that nobody will change) connection-polling interval for this thing is 250ms, which doesn't seem too small for me for many conceivable attack scenarios. For Mac, it runs this: os.system("killall Finder ; killall loginwindow ; halt -q") This won't prevent windows from reopening after a reboot. A possible exploit for this could be the USB pretending to be a keyboard, opening an exploit website or an app with malicious argument values, then you immediately shutdown the Mac, reboot manually and boom, the website/app opens up and the machine gets owned anyway post-reboot! Also, lack of Windows support is upsetting, considering there isn't much code change required to do so. The "melt" feature is one I really like and respect the thought they put to make it.

bausano_michael 6y ago
I think it's aimed at scenarios in which the attacker is not aware of this utility running. Otherwise they could just kill it before inserting the USB.
- sn_master 6y ago
  Well, for attack vectors like Mouse Jiggler (I have one, very cheap on Amazon) or polymorphic USB devices, it would work if the attack is unaware of the utility's existence. For polymorphics specifically, I checked the code, and it does indeed validate the Ids of the devices, not just their count. For others, even if the attacker is unaware of the utility, those shortcomings are still serious enough (e.g. rapid keyboard typing).

bausano_michael 6y ago

I think it's aimed at scenarios in which the attacker is not aware of this utility running. Otherwise they could just kill it before inserting the USB.

sn_master 6y ago
Well, for attack vectors like Mouse Jiggler (I have one, very cheap on Amazon) or polymorphic USB devices, it would work if the attack is unaware of the utility's existence. For polymorphics specifically, I checked the code, and it does indeed validate the Ids of the devices, not just their count. For others, even if the attacker is unaware of the utility, those shortcomings are still serious enough (e.g. rapid keyboard typing).