Re: BadUSB discussion

[Greg KH <greg () kroah com>]

On Fri, Aug 08, 2014 at 02:20:21PM +0300, Dan Carpenter wrote:
> I'm surprised we haven't had any discussion about the recent BadUSB
> articles.
>
> http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/
> http://security.stackexchange.com/questions/64524/how-to-prevent-badusb-attacks-on-linux-desktop
>
> We could put a popup if there is a second keyboard attached to check
> that the person controlling the existing keyboard is aware of the second
> one.

"popup" where?  Multi-seat machines wouldn't like that very much, as
would yubikeys (as was pointed out), or a raft of other USB devices that
export a keyboard device for the buttons they control (video cameras,
external speakers, barcode scanners, etc.)

> The attack looks like someone who says, "Can you copy some files from
> my USB flash drive which?" (not knowing it is infected) and then there
> is a popup, "This newly inserted USB device is trying to type commands,
> is that ok?  y/N?".

Shoudn't we just ensure that copying "bad" files to a location they
shouldn't be at is the thing to protect from instead?  This isn't a USB
thing explicitly at all, there have been loads of devices out there that
do this type of thing for a while (can't remember the name, one is
programmable to do this very thing with lots of fun scripts that come
with it).

Oh, and we should also ensure that if you plug in a "malformed" USB
device, we don't crash the kernel, like we have in the past, hopefully
all bugs there are now addressed, many thanks to Kees for that work.

thanks,

greg k-h