4 ms·

How will you prevent a USB device to present itself as both a keyboard and mass storage and then type commands that copy data?

by tjader 5y ago

marcodiego 5y ago
Keyboard and mouse plugged in after the system boots should only become effective after user permission is given using previously available devices. For more safety: any plugged usb device should lock your screen so that a password is required before it can be used.
sildur 5y ago
With QubesOS. I just tried adding a keyboard and it simply showed me a pop up saying a USB keyboard has been attached. It won’t work until I attach it to a qube.
- goodpoint 5y ago
  usbguard does that without the need for Qubes.
Karliss 5y ago
If the computer is locked, typing commands will not do nothing. If computer is unlocked a person could do it manually without USB by just sending them over internet or storage device of choice, no fancy keyboard+mass storage device required.
DarylZero 5y ago
An OS doesn't even need to implement USB support. Of course it can offer access controls to enable the USB devices.
- tjader 5y ago
  Of course not, but then you're saying USB is a security flaw. My point is that given how universal USB as long as a device can do both input and output it's going to be very hard to stop some exfiltration from being possible. Do you really think a bug report should be filed on all OS's for allowing USB drives and keyboards to be plugged on a running system?
  - matheusmoreira 5y ago
    > you're saying USB is a security flaw It is. > Do you really think a bug report should be filed on all OS's for allowing USB drives and keyboards to be plugged on a running system? Automatically trusting input devices is as bad as trusting user input. It's trivial to pass off a programmable USB keyboard as a mass storage device.
  - DarylZero 5y ago
    I was saying that the existence of the non-implementation of USB proves the possibility of access controls on USB. Convoluted way to put it I guess. For some reason was intuitive to me (proof of existence by example, more trivial example better). Having access controls on USB-HID is just a local policy choice where most people would choose convenience over security.
    - tjader 5y ago
      I agree, and it makes sense for some security oriented OS. But the comment I replied to seemed to suggest that the possibility of data exfiltration via USB is a bug in any OS.

How will you prevent a USB device to present itself as both a keyboard and mass storage and then type commands that copy data?

by tjader 5y ago

How will you prevent a USB device to present itself as both a keyboard and mass storage and then type commands that copy data?

marcodiego 5y ago

Keyboard and mouse plugged in after the system boots should only become effective after user permission is given using previously available devices. For more safety: any plugged usb device should lock your screen so that a password is required before it can be used.

sildur 5y ago

With QubesOS. I just tried adding a keyboard and it simply showed me a pop up saying a USB keyboard has been attached. It won’t work until I attach it to a qube.

goodpoint 5y ago
usbguard does that without the need for Qubes.

Karliss 5y ago

If the computer is locked, typing commands will not do nothing. If computer is unlocked a person could do it manually without USB by just sending them over internet or storage device of choice, no fancy keyboard+mass storage device required.

DarylZero 5y ago

An OS doesn't even need to implement USB support. Of course it can offer access controls to enable the USB devices.

tjader 5y ago
Of course not, but then you're saying USB is a security flaw. My point is that given how universal USB as long as a device can do both input and output it's going to be very hard to stop some exfiltration from being possible. Do you really think a bug report should be filed on all OS's for allowing USB drives and keyboards to be plugged on a running system?
- matheusmoreira 5y ago
  > you're saying USB is a security flaw It is. > Do you really think a bug report should be filed on all OS's for allowing USB drives and keyboards to be plugged on a running system? Automatically trusting input devices is as bad as trusting user input. It's trivial to pass off a programmable USB keyboard as a mass storage device.
- DarylZero 5y ago
  I was saying that the existence of the non-implementation of USB proves the possibility of access controls on USB. Convoluted way to put it I guess. For some reason was intuitive to me (proof of existence by example, more trivial example better). Having access controls on USB-HID is just a local policy choice where most people would choose convenience over security.
  - tjader 5y ago
    I agree, and it makes sense for some security oriented OS. But the comment I replied to seemed to suggest that the possibility of data exfiltration via USB is a bug in any OS.