3 ms·
Stop repeating unsubstantiated rumors as facts. PoC||GTFO
by c0pium 3y ago
Stop repeating unsubstantiated rumors as facts. PoC||GTFO
- lucideer 3y agoBadUSB-C[0] builds upon the original 2014 BadUSB's HID emulation approach but takes advantage of USB 3.x DisplayPort to process video stream to make decisions & validate the success of the HID emulation steps. It's too esoteric & expensive to be viable at any scale, but it's definitely functional. [0] https://ieeexplore.ieee.org/document/9474274 https://ieeexplore.ieee.org/document/9474274
- c0pium 3y agoIf you bother to read more than the abstract, you’d realize this isn’t an attack. It’s a framework for possibly creating new attacks, which after extensive research yielded precisely zero code execution bugs. Gotta print something after wasting a whole semester I suppose. When I say unsubstantiated rumor, this is what I’m talking about.
- lucideer 3y ago> this isn’t an attack I'm aware. As I said above: > any documented cases of juice jacking happening are [...] PoCs
- c0pium 3y agoThen you should learn what a PoC is. This is not a PoC. It’s a “we tried this and failed”. It’s a disproof(by exhaustion)-of-concept.
- lucideer 3y agoI'm curious about what you think they "tried and failed", and what exactly success looks like for you. You mentioned "code execution bugs" - what is that exactly to you? I presume you don't count HID emulation, so I'd be interested in what exactly does count.
- c0pium 3y agoCode refers to computer code, sometimes called “shell code”. Execution refers to getting that code to run. They didn’t get anything unexpected to happen on the device. You really should read the paper, it’s a masterclass in making nothing sound like something.