9 ms·

It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is

It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the lines of "Acme WebCam XYZ wants to add a Camera and Microphone. Allow?" And while the computer is locked this should absolutely be impossible. I went looking for some commercial stuff, and there seems to be products aimed at businesses -- but seems these are centrally-managed, work by whitelisting specific devices ahead of time, and are more focused on data exfiltration than preventing a rogue keyboard, badusb or rubber ducky. Is there something that does this?

noobermin 5y ago
Seems like a recipe for severe headaches and cursing when devices fail while you're logged out and now you can't log in by just connecting a new keyboard.
- nitrogen 5y ago
  "Please press this key sequence, then type your password, on the newly attached keyboard to enable it for use."
  - ivegotnoaccount 5y ago
    Then you will (probably) get malwares that open a window in fullscreen that imitates that prompt and sends data to a server. You probably could add some kind of fingerprint that allow identifying the legit prompts, but since it is not done with login screens...
    - nitrogen 5y ago
      This is why Windows used to ask for Ctrl-alt-del before login. And if you have malware already on your system, it's already too late.
    - gregmac 5y ago
      Aside from already having malware making this irrelevant, if you didn't just physically attach a new keyboard, the message about a new keyboard is also going to seem very suspicious.
banana_giraffe 5y ago
Now I'm curious if there's some device that presents itself as a keyboard, types some Powershell script and "copies" files off of the computer using numlock/capslock/scrolllock signals.
- nightfly 5y ago
  That's a USB Rubber Ducky
  - banana_giraffe 5y ago
    Hah. Never played with one, but I just assumed it was a macro playback engine, not surprising, I suppose it would do more.
- schmorptron 5y ago
  Yes! Look into BadUSB, there's some really cool, but also scary, stuff out there.
tyingq 5y ago
>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on? For that matter, I don't think it needs to change. It can just emulate a hub and present both.
- numpad0 5y ago
  Current USB host controllers aren’t built in the way they can distinguish between physical removal and electronic self reset. Maybe if you’re NSA you could roll your own USB xHCI and a USB A receptacle that could characterize and identify individual units down to a machine in China used to assemble it, but that will be lightyears ahead of commercial USB host controllers.
- gruez 5y ago
  What you'd described would require each USB device to cryptographically sign its communications with an unique key. AFAIK USB doesn't have this, but thunderbolt does (it's called "secure connect"). Even if it does get implemented though, it probably won't help much because most users can be social engineered into trusting the new device.
  - ohazi 5y ago
    The common USB device classes (video device, HID keyboard/mouse, etc.) don't have this, but anybody can define a new device class that does. It seems like maybe Microsoft should have required something like this for Windows Hello cameras, if they intended for people to use the hardware as a single factor authenticator. i.e. the camera generates internal crypto keys and tells Windows about them when you set up Windows Hello, then Windows does a challenge/response to make sure it's getting an image from the authentic camera during login attempts. Apple did something like this with the fingerprint reader home buttons on iPhones, which is why you had to replace the motherboard + home button as a single unit on damaged devices. They could have provided a reprovisioning tool, but it's Apple, so they didn't.
lrvick 5y ago
> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. QubesOS does this by quarantining your USB controllers in a dedicated virtual machine. https://www.qubes-os.org/doc/usb-qubes/ https://www.qubes-os.org/doc/usb-qubes/ Usb-guard for Linux also uses kernel features to accomplish similar. I dont know of any methods to do this on MacOS or Windows though.
vladvasiliu 5y ago
> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the lines of "Acme WebCam XYZ wants to add a Camera and Microphone. Allow?" There's USBGuard on Linux that seems to do some of this. Can't vouch for it, as I've never used it, though. https://wiki.archlinux.org/title/USBGuard https://wiki.archlinux.org/title/USBGuard https://github.com/USBGuard/usbguard https://github.com/USBGuard/usbguard

noobermin 5y ago

Seems like a recipe for severe headaches and cursing when devices fail while you're logged out and now you can't log in by just connecting a new keyboard.

nitrogen 5y ago
"Please press this key sequence, then type your password, on the newly attached keyboard to enable it for use."
- ivegotnoaccount 5y ago
  Then you will (probably) get malwares that open a window in fullscreen that imitates that prompt and sends data to a server. You probably could add some kind of fingerprint that allow identifying the legit prompts, but since it is not done with login screens...
  - nitrogen 5y ago
    This is why Windows used to ask for Ctrl-alt-del before login. And if you have malware already on your system, it's already too late.
  - gregmac 5y ago
    Aside from already having malware making this irrelevant, if you didn't just physically attach a new keyboard, the message about a new keyboard is also going to seem very suspicious.

banana_giraffe 5y ago

Now I'm curious if there's some device that presents itself as a keyboard, types some Powershell script and "copies" files off of the computer using numlock/capslock/scrolllock signals.

nightfly 5y ago
That's a USB Rubber Ducky
- banana_giraffe 5y ago
  Hah. Never played with one, but I just assumed it was a macro playback engine, not surprising, I suppose it would do more.
schmorptron 5y ago
Yes! Look into BadUSB, there's some really cool, but also scary, stuff out there.

tyingq 5y ago

>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on? For that matter, I don't think it needs to change. It can just emulate a hub and present both.

numpad0 5y ago
Current USB host controllers aren’t built in the way they can distinguish between physical removal and electronic self reset. Maybe if you’re NSA you could roll your own USB xHCI and a USB A receptacle that could characterize and identify individual units down to a machine in China used to assemble it, but that will be lightyears ahead of commercial USB host controllers.
gruez 5y ago
What you'd described would require each USB device to cryptographically sign its communications with an unique key. AFAIK USB doesn't have this, but thunderbolt does (it's called "secure connect"). Even if it does get implemented though, it probably won't help much because most users can be social engineered into trusting the new device.
- ohazi 5y ago
  The common USB device classes (video device, HID keyboard/mouse, etc.) don't have this, but anybody can define a new device class that does. It seems like maybe Microsoft should have required something like this for Windows Hello cameras, if they intended for people to use the hardware as a single factor authenticator. i.e. the camera generates internal crypto keys and tells Windows about them when you set up Windows Hello, then Windows does a challenge/response to make sure it's getting an image from the authentic camera during login attempts. Apple did something like this with the fingerprint reader home buttons on iPhones, which is why you had to replace the motherboard + home button as a single unit on damaged devices. They could have provided a reprovisioning tool, but it's Apple, so they didn't.

lrvick 5y ago

> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. QubesOS does this by quarantining your USB controllers in a dedicated virtual machine. https://www.qubes-os.org/doc/usb-qubes/ https://www.qubes-os.org/doc/usb-qubes/ Usb-guard for Linux also uses kernel features to accomplish similar. I dont know of any methods to do this on MacOS or Windows though.

vladvasiliu 5y ago

> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the lines of "Acme WebCam XYZ wants to add a Camera and Microphone. Allow?" There's USBGuard on Linux that seems to do some of this. Can't vouch for it, as I've never used it, though. https://wiki.archlinux.org/title/USBGuard https://wiki.archlinux.org/title/USBGuard https://github.com/USBGuard/usbguard https://github.com/USBGuard/usbguard