4 ms·
I realize you're being facetious, but for arguments sake: * Keyboards do not have enough bandwidth to allow an attack unless your physical security is incredib
by groby_b 15y ago
I realize you're being facetious, but for arguments sake:
* Keyboards do not have enough bandwidth to allow an attack unless your physical security is incredibly lax.
* Monitors make a really bad attack vector, since they're not really an input device :) They are, to some extent, a possible route of filtering data out, so make sure access is indeed limited. (I.e. don't put them in front of windows :)
* HDDs are presumably (if you really care about security) inside the case only, and the case is locked. Also, hopefully hard-erased before installation.
* Even though processors make for a decent attack vector (read "Trusting Trust" by Ken Thompson, if you haven't yet), enforcing the air gap makes it very hard to actually communicate that data to the outside world.
Of course, all this depends on what level of security you want/need. Sealing of IO ports for your home machine is fairly silly. (And if autorun is disabled, you're probably safe plugging items in - you're most likely not a high enough value target). But if you indeed do have items that MUST be kept secret on your machine, batten down the (IO) hatches.
- zachrose 15y ago> Keyboards do not have enough bandwidth to allow an attack unless your physical security is incredibly lax. What does this mean? What's to stop someone from building a fake keyboard with an internal USB hub that connects the original keyboards USB connection and a thumbdrive to a normal-looking outgoing USB cable?
- LaGrange 15y agoDisable all keyboard shortcuts -- text entry only in text areas. No tabbing between controls. Keyboard shortcuts considered harmful. Also, for the sake of completeness, randomize all on-screen forms to make it impossible to exploit a fake mouse. Muscle memory considered harmful. For added security, display an authorization code on the display every half an hour, and expect the user to do a XOR with a one-time pad, then enter it on the keyboard. Or morse-code it with the mouse.
- groby_b 15y agoAssume that required devices are hardwired when you remove IO ports. It's kind of stupid to remove all IO ports except one :)
- mentat 15y agoKeyboards can be hubs with hostile code implanted in them. They can also have built in key loggers.