oss-sec mailing list archives
Re: Malicious devices & vulnerabilties
From: Hanno Böck <hanno () hboeck de>
Date: Sun, 8 Jan 2012 22:08:18 +0100
Am Sun, 8 Jan 2012 09:07:25 -0800 schrieb Greg KH <greg () kroah com>:
They should be considered buggy, yes, and as such, the kernel developers will fix any reported problems (or we should, if not, please let me know.) But note, as these almost always fall under the "you have physical access" category, their security impact is generally considered low.
As far as publicly known, it's likely that Stuxnet was originally spread via a security problem with USB. Also, I'd doubt the "physical access" category. It may just require a bit of social engineering ("I have the file you requested on this usb stick"). Considering that I'd strongly disagree classifying such issues "low impact". At least for pluggable devices, I'd consider such issues rather serious. It's another thing with PCI or other devices that require significant work to attach to a piece of hardware. -- Hanno Böck mail/jabber: hanno () hboeck de GPG: BBB51E42 http://www.hboeck.de/
Attachment:
signature.asc
Description:
Current thread:
- Re: Malicious devices & vulnerabilties, (continued)
- Re: Malicious devices & vulnerabilties Alistair Crooks (Jan 09)
- Re: Malicious devices & vulnerabilties Xi Wang (Jan 08)
- Re: Malicious devices & vulnerabilties Eitan Adler (Jan 08)
- Re: Malicious devices & vulnerabilties Xi Wang (Jan 08)
- Re: Malicious devices & vulnerabilties Vasiliy Kulikov (Jan 09)
- Re: Malicious devices & vulnerabilties Kurt Seifried (Jan 08)
- Re: Malicious devices & vulnerabilties Florian Weimer (Jan 09)
- Re: Malicious devices & vulnerabilties Kurt Seifried (Jan 09)
- Re: Malicious devices & vulnerabilties Xi Wang (Jan 08)
- Re: Malicious devices & vulnerabilties Hanno Böck (Jan 08)
- Re: Malicious devices & vulnerabilties Eugene Teo (Jan 08)