4 ms·

To some extent, this feels like the old "if you have physical access…"¹ rule. It is good to see more awareness of the fact that USB devices can be quite arbitr

To some extent, this feels like the old "if you have physical access…"¹ rule. It is good to see more awareness of the fact that USB devices can be quite arbitrary things. I remember trying (hard) to convince people that a cell phone was a computer years ago. It's basically the same thing: a USB device can certainly house a computer, for some definition of that. It would seem that page 11's attack would require that the machine is unlocked and just sitting there. If not, how would it install the keylogger? (It'd be at the password screen, and input would go there.) Otherwise, this is simply a shortcut to install a keylogger and capture sudo. (Which again brings us back to "physical access".) Page 13: Are there really that many distros that just DHCP any interface? Gentoo (at least mine, I suppose? it is configured by the user, but I thought I chose the defaults here?) doesn't? Page 17: are there boot orders that put USB first? I feel like HDD is almost always first, given the number of times I need to beg for a prompt in BIOSes, but again, maybe just me? However, if anything, the above does show how much of a minefield this is… ¹then it's really hard to be secure.

dspillett 12y ago
> are there boot orders that put USB first? There was a time when I noticed it was getting more common and looked to be destined to be the default option, I assume it went back to being less common as people complained about it being inconvenient when they left a stick in that just happened to have a valid boot signature. Modern chipsets have a nice convenient "press <key> for boot menu" which makes having the boot order right for anything other than the business-as-usual option (SATA first) easy to access anyway.
- danelectro 12y ago
  On most PC's in BIOS (or UEFI) you can set the default boot order however you want, to prioritize USB, HDD, CDROM, Network, even floppy still. This has been the norm for about 10years at least, so that way you get the boot order best for your usage.
  - dspillett 12y ago
    Aye, I was saying the need to go in and change it has fallen away (unless you always want something different) as there is generally an easier short-cut to make a change just for this boot.
deleted 12y ago
[deleted]
Nanzikambe 12y ago
> To some extent, this feels like the old "if you have physical access…"¹ rule. Do you completely trust the manufacturer, previous owners and every person that ever had opportunity to touch any of your USB devices for more than a couple seconds? (Including before you purchased them) > It would seem that page 11's attack would require that the machine is unlocked ... No, many Linux distributions have a daemon that will auto mount USB mass storage devices.
- gpvos 12y ago
  ...but how will it install the keylogger then? The USB device can do that if it's a keyboard, but not if it's a mass storage device.
  - cnvogel 12y ago
    ...keep in mind that a USB device can be both, or more...
    - deathanatos 12y ago
      > ...keep in mind that a USB device can be both, or more... Fine: let's assume the device can fake being both, or more (which it can), and that my machine will automount any USB mass storage device. (I actually think this is accurate.) So it automounts the USB mass storage device somewhere… and then what? The machine is still locked, and I presume it would need to run something off that mass storage device to do any real harm, but how would it accomplish that?
rasz_pl 12y ago
>To some extent, this feels like the old "if you have physical access…"¹ rule. not if you 'lose' couple of those pendrives labelled payroll in the parking lot - this is old cd/dvd attack vector, but this time its interactive courtesy of smarts in the firmware.

dspillett 12y ago

> are there boot orders that put USB first? There was a time when I noticed it was getting more common and looked to be destined to be the default option, I assume it went back to being less common as people complained about it being inconvenient when they left a stick in that just happened to have a valid boot signature. Modern chipsets have a nice convenient "press <key> for boot menu" which makes having the boot order right for anything other than the business-as-usual option (SATA first) easy to access anyway.

danelectro 12y ago
On most PC's in BIOS (or UEFI) you can set the default boot order however you want, to prioritize USB, HDD, CDROM, Network, even floppy still. This has been the norm for about 10years at least, so that way you get the boot order best for your usage.
- dspillett 12y ago
  Aye, I was saying the need to go in and change it has fallen away (unless you always want something different) as there is generally an easier short-cut to make a change just for this boot.

deleted 12y ago

[deleted]

Nanzikambe 12y ago

> To some extent, this feels like the old "if you have physical access…"¹ rule. Do you completely trust the manufacturer, previous owners and every person that ever had opportunity to touch any of your USB devices for more than a couple seconds? (Including before you purchased them) > It would seem that page 11's attack would require that the machine is unlocked ... No, many Linux distributions have a daemon that will auto mount USB mass storage devices.

gpvos 12y ago
...but how will it install the keylogger then? The USB device can do that if it's a keyboard, but not if it's a mass storage device.
- cnvogel 12y ago
  ...keep in mind that a USB device can be both, or more...
  - deathanatos 12y ago
    > ...keep in mind that a USB device can be both, or more... Fine: let's assume the device can fake being both, or more (which it can), and that my machine will automount any USB mass storage device. (I actually think this is accurate.) So it automounts the USB mass storage device somewhere… and then what? The machine is still locked, and I presume it would need to run something off that mass storage device to do any real harm, but how would it accomplish that?

rasz_pl 12y ago

>To some extent, this feels like the old "if you have physical access…"¹ rule. not if you 'lose' couple of those pendrives labelled payroll in the parking lot - this is old cd/dvd attack vector, but this time its interactive courtesy of smarts in the firmware.