3 ms·
Yeah, I heard. Still the case of a badly configured device. Remember kids, it's a software driver configuration. Show me that BadUSB that works on the dumb DOS
by unnouinceput 4y ago
Yeah, I heard. Still the case of a badly configured device.
Remember kids, it's a software driver configuration. Show me that BadUSB that works on the dumb DOS operating system. No? Yeah, didn't think so. Only "clever" OS'es are pwned by this, and if you dumb them down then nothing gets to run automatically.
- Tepix 4y agoAny DOS is susceptible to Bad USB emulating a keyboard if the BIOS supports USB keyboards.
- toast0 4y agoBadUSB or similar could be setup to work on DOS if the system firmware does USB keyboard mapping. You can do copy con foo.exe or something with debug, and then stream the executable you want to run, then run it. A bit more work, and there's no standard networking and all that, but it's doable if you really want it done; but you'd need a target to make it worthwhile.
- unnouinceput 4y agoSooo... we go back to my initial point of a "badly configured system"?
- Tepix 4y agoIt's the old usability vs security compromise.
- toast0 4y agoWell, most of my recent computers don't have an option for keyboards that's not USB. But a system with no inputs is probably the most secure you can get. You can also hotglue unused ports and physically prevent unplugging the intended devices. But that's not realistic for most systems.
- 1R 4y agoAutorun/autoplay are only one possible vector for attack. No matter how well configured your device is it can still be destroyed by an electrical attack where a bad USB device charges capacitors and then zaps your device. Got it boomer?