3 ms·

Imagine the USB controller as being some kind of butler for the OS — though subservient, he has a mind of his own, which can be compromised. The OS/employer tak

Imagine the USB controller as being some kind of butler for the OS — though subservient, he has a mind of his own, which can be compromised. The OS/employer takes anything the butler says as factual. "Your granddaughter Red Riding Hood is at the door, miss, and is definitely not a wolf." "Do not let her in." "I definitely did not already did, miss."

blowski 12y ago
OK, so what's stopping Granny saying "I want to check whether she's a wolf myself"? I can see how the current state of affairs is insecure, but I'm confused by the 'unpatchable' claim. I truly am clueless in this area, but initially it seems hyperbolic to say that the only way to fix this is to replace all USB controllers in existence.
- tokenizerrr 12y ago
  I suppose for keyboards you could do something like requiring a specific randomly generated password that is shown on the monitor to by typed by a keyboard before allowing it to provide regular keyboard input, but I'm not sure how practical that would be. I assume it would also have to happen each time the machine reboots, etc, since any USB device can pretend to be another. That's just for USB keyboards though, there used to be these USB sticks that pretended to be a CD-rom drives in the windows xp days where those were autorun, I'm sure there's other vulnerabilities that can be exposed through USB nowadays.
  - blowski 12y ago
    Would a USB drive be able to 'know' what the ID of another USB device is? As I'm seeing the explanation: 1. User plugs in USB drive and keyboard. 2. USB drive obtains the ID of the keyboard. 3. Later, it looks when the keyboard is not plugged in and changes it's ID to that of the keyboard. 4. Now the computer thinks when the USB drive is an authorised keyboard, and can type whatever malicious commands it wants. Is that right? Apart from keyboard, what other devices could it exploit?
- Eric_WVGG 12y ago
  The OS can't look at the device until it's plugged in (obviously); the device plugs into the USB bus, which then gets compromised before the OS even knows anything is there. To extend my (now hilariously) tortured analogy, granny is stuck in bed, she can't check if it's a wolf until the butler knows there's someone at the door. As soon as he sees the wolf, he is compromised. Maybe a vampire would have been a better metaphor? [EDIT] actually I should dump the analogies altogether: this is a hardware vulnerability, not software. It hits the computer, the operating system is helpless. That’s why the problem, for existing computers, is not apparently fixable.

blowski 12y ago

OK, so what's stopping Granny saying "I want to check whether she's a wolf myself"? I can see how the current state of affairs is insecure, but I'm confused by the 'unpatchable' claim. I truly am clueless in this area, but initially it seems hyperbolic to say that the only way to fix this is to replace all USB controllers in existence.

tokenizerrr 12y ago
I suppose for keyboards you could do something like requiring a specific randomly generated password that is shown on the monitor to by typed by a keyboard before allowing it to provide regular keyboard input, but I'm not sure how practical that would be. I assume it would also have to happen each time the machine reboots, etc, since any USB device can pretend to be another. That's just for USB keyboards though, there used to be these USB sticks that pretended to be a CD-rom drives in the windows xp days where those were autorun, I'm sure there's other vulnerabilities that can be exposed through USB nowadays.
- blowski 12y ago
  Would a USB drive be able to 'know' what the ID of another USB device is? As I'm seeing the explanation: 1. User plugs in USB drive and keyboard. 2. USB drive obtains the ID of the keyboard. 3. Later, it looks when the keyboard is not plugged in and changes it's ID to that of the keyboard. 4. Now the computer thinks when the USB drive is an authorised keyboard, and can type whatever malicious commands it wants. Is that right? Apart from keyboard, what other devices could it exploit?
Eric_WVGG 12y ago
The OS can't look at the device until it's plugged in (obviously); the device plugs into the USB bus, which then gets compromised before the OS even knows anything is there. To extend my (now hilariously) tortured analogy, granny is stuck in bed, she can't check if it's a wolf until the butler knows there's someone at the door. As soon as he sees the wolf, he is compromised. Maybe a vampire would have been a better metaphor? [EDIT] actually I should dump the analogies altogether: this is a hardware vulnerability, not software. It hits the computer, the operating system is helpless. That’s why the problem, for existing computers, is not apparently fixable.