5 ms·

> A Yubikey can be hacked to send arbitrary keystrokes - but that's of limited usefulness. I guess an attacker could force open a browser window to download mal

> A Yubikey can be hacked to send arbitrary keystrokes - but that's of limited usefulness. I guess an attacker could force open a browser window to download malicious software, but that would be fairly obvious to a user. If it can send arbitrary keystrokes, it's not just a "way in" (trying to download malicious software): it's also a way to exfiltrate the data (for example keylogged inputs) it collected. As for being fairly obvious to the user: what about waiting for command+t (or whatever the command is) plus something looking a website to be typed, then wait for 4 minutes of user inactivity (no keyboard input, no mouse input) before sneakily opening a tab and quickly closing it? Sure, some user may notice it but many won't for after 4 minutes of inactivity they won't be looking at their screen (and the screensaver won't have kicked in already).

rfoo 5y ago
Not to say such attack scenario does not exist, but: A USB HID device cannot listen on what other keyboards typed, except for NumLock/CapsLock/ScreenLock indicator.
- kevin_thibedeau 5y ago
  USB isn't a party-line bus. An HID can't see anything from other branches of the USB subsystem. State changes have to be explicitly relayed by the host.
elric 5y ago
Agreed. The OP is overly optimistic in their assessment. A rogue USB device which can enter input, is pretty much game over. It can do anything on your computer that a physical user can. Phoning home and installing a boatload of malware before you can even blink would be a good start. Windows users in particular have been conditioned to not react to evil things like autoplay when inserting USB devices. "Don't mind me, I'm just installing drivers". I've seen USB headphones (!) launch programs on first insert. By the time you click "cancel", any number of things could have happened.

rfoo 5y ago

Not to say such attack scenario does not exist, but: A USB HID device cannot listen on what other keyboards typed, except for NumLock/CapsLock/ScreenLock indicator.

kevin_thibedeau 5y ago
USB isn't a party-line bus. An HID can't see anything from other branches of the USB subsystem. State changes have to be explicitly relayed by the host.

elric 5y ago

Agreed. The OP is overly optimistic in their assessment. A rogue USB device which can enter input, is pretty much game over. It can do anything on your computer that a physical user can. Phoning home and installing a boatload of malware before you can even blink would be a good start. Windows users in particular have been conditioned to not react to evil things like autoplay when inserting USB devices. "Don't mind me, I'm just installing drivers". I've seen USB headphones (!) launch programs on first insert. By the time you click "cancel", any number of things could have happened.