3 ms·
Not to understate the severity of this issue, but how is this any different than if I built a custom device that contained a USB hub + emulated HID keyboard to
by aus_ 12y ago
Not to understate the severity of this issue, but how is this any different than if I built a custom device that contained a USB hub + emulated HID keyboard to fire off a malicious macro + flash storage housed inside a plastic shell that looked like a normal flash drive? I guess that would require developing and manufacturing custom hardware.
So maybe it's not different. And this just significantly lowers the barriers to entry to an extremely easy process using only off the shelf hardware. And now the malicious device can be anything from flash drives to keyboards to USB Missile Launchers.
That seems like a problem the manufacturers need to resolve, however inconvenient it is to have read-only firmware.
- InclinedPlane 12y agoIt's very different because your device is just one device. "BadUSB" type malware can spread like a virus/worm by infecting other devices. In your scenario the specially crafted device is the only infection point. With BadUSB an infected device is just patient zero. It infects computers, which in turn infect other devices plugged into it, which infect other computers, and so on and so forth.
- aus_ 12y agoAh! Got it now. Thanks. Ok. Now I'm concerned.