3 ms·

> To some extent, this feels like the old "if you have physical access…"¹ rule. Do you completely trust the manufacturer, previous owners and every person that

> To some extent, this feels like the old "if you have physical access…"¹ rule. Do you completely trust the manufacturer, previous owners and every person that ever had opportunity to touch any of your USB devices for more than a couple seconds? (Including before you purchased them) > It would seem that page 11's attack would require that the machine is unlocked ... No, many Linux distributions have a daemon that will auto mount USB mass storage devices.

gpvos 12y ago
...but how will it install the keylogger then? The USB device can do that if it's a keyboard, but not if it's a mass storage device.
- cnvogel 12y ago
  ...keep in mind that a USB device can be both, or more...
  - deathanatos 12y ago
    > ...keep in mind that a USB device can be both, or more... Fine: let's assume the device can fake being both, or more (which it can), and that my machine will automount any USB mass storage device. (I actually think this is accurate.) So it automounts the USB mass storage device somewhere… and then what? The machine is still locked, and I presume it would need to run something off that mass storage device to do any real harm, but how would it accomplish that?