4 ms·

But how do you know the write protect switch actually works? Maybe the manufacturer implemented it as a flag to the microcontroller. Maybe your 'trusted' USB st

But how do you know the write protect switch actually works? Maybe the manufacturer implemented it as a flag to the microcontroller. Maybe your 'trusted' USB stick was replaced by one that looks exactly the same but that has a different chip inside that mimics the vendor/device ID. So you are back to requiring trusted hardware and trusted handling, which is impractical except for strictly controlled systems.

kazinator 12y ago
The trusted USB stick being replaced by a lookalike is a breach of physical security somewhere in the delivery chain between manufacturer and you. In that case, the programmability issue is moot; neither the original USB stick nor the rogue one have to have field-programmable firmware. The rogue one is hard-coded at manufacture time to do harm. This is a different issue from white hat USB devices that turn black due to a remote exploit, and it is addressable by some form of trusted computing, like authenticating that USB devices are genuine. With this authentication in place, it's possible that there could be remote exploits that somehow retain the device's ability to authenticate while changing its behavior. As far as trusting the manufacturer to implement the switch: it is hard to get away from trusting the manufacturer. You're plugging in their hardware into your device. Under the assumption that the manufacturer is working in good faith to prevent rogue reprogramming, it is in their interest to implement the switch properly, so it cannot be overridden in software. Basically, the situation is that if someone wants to sell you, say, a rogue keyboard that steals your keystrokes, they can do that without even involving the USB protocol. A keyboard can have its own storage for keystrokes and its own channel for transmitting the information, not involving the USB interface. For instance, it could have on-board Wi-Fi, and a rogue firmware that finds a free hot-spot, makes a connection and sends its logged data to its "mother ship".
- angry_octet 12y ago
  Maybe its just me, but it seems vendors implement things the cheapest way possible, usually disregarding security. On the pack it will say 'Write Protect Switch! Protect yourself from HACKERS! Free trial of Symantec Bloat already loaded!' and the write protect will be easily bypassed. Also, its not about 'them' selling you specifically a keyboard with a radio in it, it is about turning one of the 50 million keyboards with the XYZ Inc chipset into a persistent bootkit.

kazinator 12y ago

The trusted USB stick being replaced by a lookalike is a breach of physical security somewhere in the delivery chain between manufacturer and you. In that case, the programmability issue is moot; neither the original USB stick nor the rogue one have to have field-programmable firmware. The rogue one is hard-coded at manufacture time to do harm. This is a different issue from white hat USB devices that turn black due to a remote exploit, and it is addressable by some form of trusted computing, like authenticating that USB devices are genuine. With this authentication in place, it's possible that there could be remote exploits that somehow retain the device's ability to authenticate while changing its behavior. As far as trusting the manufacturer to implement the switch: it is hard to get away from trusting the manufacturer. You're plugging in their hardware into your device. Under the assumption that the manufacturer is working in good faith to prevent rogue reprogramming, it is in their interest to implement the switch properly, so it cannot be overridden in software. Basically, the situation is that if someone wants to sell you, say, a rogue keyboard that steals your keystrokes, they can do that without even involving the USB protocol. A keyboard can have its own storage for keystrokes and its own channel for transmitting the information, not involving the USB interface. For instance, it could have on-board Wi-Fi, and a rogue firmware that finds a free hot-spot, makes a connection and sends its logged data to its "mother ship".

angry_octet 12y ago
Maybe its just me, but it seems vendors implement things the cheapest way possible, usually disregarding security. On the pack it will say 'Write Protect Switch! Protect yourself from HACKERS! Free trial of Symantec Bloat already loaded!' and the write protect will be easily bypassed. Also, its not about 'them' selling you specifically a keyboard with a radio in it, it is about turning one of the 50 million keyboards with the XYZ Inc chipset into a persistent bootkit.