oss-sec mailing list archives
Re: BadUSB discussion
From: Greg KH <greg () kroah com>
Date: Fri, 8 Aug 2014 07:34:22 -0700
On Fri, Aug 08, 2014 at 10:05:11AM -0400, Daniel Kahn Gillmor wrote:
On 08/08/2014 10:00 AM, Greg KH wrote:On Fri, Aug 08, 2014 at 09:56:34AM -0400, Daniel Kahn Gillmor wrote:For example, you could register keyboards by serial number with the system,Most USB keyboards in the system do not have a unique serial number. Heck, most USB devices in the system do not have a unique serial number, the only USB device that is required to do so is a USB printer, everything else is free to not have one at all, or have the same serial number for all devices made of that type. Never treat a USB serial number as "unique", except for a USB printer, sorry.ugh, that's a shame. are there any other characteristics we could use to gin up a phony serial number for this kind of use? Even making an allowlist by model number would raise the bar a little bit for a generic attacker.
You can do what Windows does, which is to have a list of devices and the "location" they were plugged into in the past and check that. But it's really annoying to just move your keyboard from one plug to another and have to deal with pop-up windows asking about your drivers.
Though i suppose you could create a device that claims to be 400 different keyboards at once -- or in a rapid hotplug succession until it finds the common model that you've already allowed :(
I don't understand what you are trying to solve here. Step back, what is the real "problem" that BadUSB shows? Files being copied to places they shouldn't be, or, rebooting your machine and booting from a different media. Why not go after the root cause here, don't be paranoid about trying to detect a new keyboard being plugged in. Again, we have had devices like this out there for quite a while, the USB Rubber Ducky as one example. Others are things like the Teensy device[1], which has been used in "pen testing" for a very long time. Don't try to defend against a random keyboard device, try to defend against a user doing bad things, be it input from a "real" keyboard, or a "fake" one, it shouldn't matter. The only thing "new" about the BadUSB hack, is it shows how to turn a "normal" device into a USB Rubber Ducky, which will save you a few dollars (and shows just how insecure a number of USB devices are.) Not that the attack vector is somehow new and novel or unknown at all. thanks, greg k-h [1] Highly recommended if you want to do things with USB from a device side. Easily programmable, very cheap, and very tiny, you can have loads of "fun" with these things...
Current thread:
- BadUSB discussion Dan Carpenter (Aug 08)
- Re: BadUSB discussion Florian Weimer (Aug 08)
- Re: BadUSB discussion Daniel Kahn Gillmor (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion Daniel Kahn Gillmor (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion Eddie Chapman (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion Eddie Chapman (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion Eddie Chapman (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion Eddie Chapman (Aug 08)
- Re: BadUSB discussion Daniel Kahn Gillmor (Aug 08)
- Re: BadUSB discussion lazytyped (Aug 09)
- Re: BadUSB discussion Florian Weimer (Aug 08)
- Re: BadUSB discussion Dean Pierce (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)