4 ms·
Is this unsafe even on OS X or Linux?
by palish 15y ago
Is this unsafe even on OS X or Linux?
- cmelbye 15y agoI believe the main issue is that the stick can be configured so that Windows will automatically run an executable on the USB stick when it's plugged in, so OS X and Linux wouldn't be affected by that.
- palish 15y agoSorry, to be clear, I was asking whether Linux or OS X also have the same silly idea of "Let's execute an arbitrary program on the USB stick whenever it's plugged in!" I don't know the answer because I don't use Linux for day-to-day work (I work in gamedev, whose primary platform is Windows) and I'm too poor too afford a Macbook.
- technomancy 15y agoThis is only half the problem, and it is trivial to defeat. What we should really be worried about is malware that acts as a USB keyboard, since that's much harder to protect against. It's also much harder to reliably launch an attack from, but in the case of a targeted attack where the OS is known it wouldn't be too difficult to come up with something that could sneak some nasties in with a low chance of detection.
- amalcon 15y agoProbably. The exact vulnerability used here (autorun) is closed up on Linux, but that only protects against the one attack. Do we think there are no vulnerabilities in the USB code, the drivers for any particular USB device, filesystems, or any other pieces of code a USB device can invoke? I am very doubtful.