6 ms·
Shouldn't it be quite okay if using secureboot and the embedded system has locked down keys? I have no idea if they did that, but mailing USB keys should be fi
by SahAssar 6y ago
Shouldn't it be quite okay if using secureboot and the embedded system has locked down keys?
I have no idea if they did that, but mailing USB keys should be fine with the right encryption or validation
- shakna 6y agoIf all you're looking to do is verify the USB storage, sure. But USB doesn't have to only be a storage device. You can include all sorts of other evils in a USB payload.
- deleted 6y ago[deleted]
- SahAssar 6y agoI read it as that Integrity and Confidentiality was the only factors here, so USBKill-style stuff (Availability) would just mean the machine was replaced, Integrity should handled by the boot process and Confidentiality should be handled by the embedded OS itself.
- xwdv 6y agoIt's not okay at all. You should not be plugging in a USB someone sent you in the mail straight into a machine on your corporate network. There is no chain of custody, an attacker could do many things to make it seem like the USB is legit as possible, until it isn't. Just a bad idea all around. There should not even be USB ports IMO.
- SahAssar 6y agoWho said anything about a corporate network? You seem to be thinking that I said that it's okay to take random USB's and plug them into your laptop which I definitely do not. I read it as that Integrity and Confidentiality was the only factors here, so USBKill-style stuff (Availability) would just mean the machine was replaced, Integrity should handled by the boot process and Confidentiality should be handled by the embedded OS itself.