2 ms·
> and frankly, most usb devices are pretty boring & isolated. yes you can hurt a usb flash drive if you do the wrong things to it, you can install an autorun.in
by cesarb 6y ago
> and frankly, most usb devices are pretty boring & isolated. yes you can hurt a usb flash drive if you do the wrong things to it, you can install an autorun.inf nasty malware. yes you can play gross sounds or listen on a usb sound card. but few devices are going to do anything to the system. mostly it's a bunch of mice & keyboards.
With Thunderbolt/USB4, a USB device is not only a USB device; it's also a PCIe device. Upgrading its firmware (USB is commonly used for firmware update, but it could also be done through exploits on non-firmare-update endpoints) means the attacker now has control of not only a USB device, but also a PCIe device.
- corty 6y agoAnd control of a PCIe device (with the usual lazy broken drivers that just ignore IOMMU) means full read and write access to all physical memory adresses, including OS kernel, firmware and NMI RAM areas and all applications. This gives an attacker the capability to compromise the hardware in very permanent ways. Nothing to take lightly or brush off as security absolutism.