3 ms·
Security researchers have been saying since USB became popular that hot plugging should require confirmation from the user. The only downside being that many u
by Guvante 12y ago
Security researchers have been saying since USB became popular that hot plugging should require confirmation from the user.
The only downside being that many users add a new HID as their only interface to the machine.
- jedunnigan 12y agoPerhaps some kind of time lapse would solve that problem. The USB won't execute anything for x minutes while you inspect what it is really doing (if it's your keyboard or mouse, do nothing). If nothing is done, allow the USB to load its drivers, etc...
- Someone1234 12y agoI just have to add Sleep(60 minutes) to my fake HID device and it will bypass this. You cannot blackhole HID input for an hour.
- Nacraile 12y agoI'm not sure what that accomplishes. In order to provide input, the HID device must register itself with the OS, in order for the driver to be set up, etc. Sending HID messages without actually enumerating a HID device isn't going to work. Waiting 60 seconds to provide input doesn't change the fact that it has to tell the OS it can provide input in the first place. Yeah, it could wait 60 seconds to say "hey, a HID device just got plugged in", but that doesn't actually bypass the safety mechanism...
- deleted 12y ago[deleted]
- FreeFull 12y agoIt can always tell the OS that it is a USB hub, so nothing precludes it from being seen as two USB devices (HID and storage)
- Terr_ 12y agoWould it be possible to: 1. Connect innocently as a plain storage device 2. Wait a period of time or even monitor voltage fluctuations to guess when the user is not at the computer. 3. Disconnect and reconnect (or a new side-connection?) as a HID device Users often won't mentally associate the long-delayed attack with the USB stick, and if it attacks when they are AFK the timer might hit 0 in total secrecy.
- jedunnigan 12y agoAbsolutely true. The time lapse is only to allow the user to inspect the drive before it is allowed to execute arbitrarily. That may not actually be possible now that I think about it, so the idea is bunked anyway.
- linuxlizard 12y agoWhy not something like a USB Firewall? Black/white list vid/pid (which are easily faked, yes). Closes the door a small amount. But can also blacklist all HID.
- the8472 12y agoI think this should already be possible under linux via udev rules. It just needs to be wrapped in a convenient tool. Might be worth it to at least extend the time span that an attacker would need if he had physical access to your laptop/smartphone.
- linuxlizard 12y agoI smell a software product opportunity for OSX / Windows.
- Terr_ 12y agoIn the worst-case scenario, why not use connect/disconnect events themselves as a form of user input? https://news.ycombinator.com/item?id=8401924 https://news.ycombinator.com/item?id=8401924