Re: BadUSB discussion

[gremlin () gremlin ru]

On 08-Aug-2014 09:21:02 -0700, Greg KH wrote:

> > > Oh, and if you want, you can disable all USB devices on your
> > > Linux system by default, and only "authorize" them explicitly
> > > if you programatically think they should be enabled. We have
> > > had support in the kernel for that for years now, but very few
> > > people actually use it.
> > I've faced that only once, and my solution was straightforward:
> > those two servers were running a kernel built with only basic
> > USB HID support (keyboard+mouse, IIRC) and without module load
> > support. That appeared to be quite enough.
> That doesn't prevent any other USB HID device from being plugged
> in and instantly working. Which again, you can prevent if you
> want to, but no one seems to do that...

Hmmm... To avoid possible confusion: that was CONFIG_USB_KBD - 
"USB HIDBP Keyboard (simple Boot) support", and CONFIG_USB_HID
was turned off.

> > > So the tools to do this are already there, why aren't you using
> > > them? :)
> > You could guess: sometimes I'm developing USB devices and have
> > to test them. That formed a good habit of connecting my devices
> > to a hub instead of directly to BB :-)
> A USB hub doesn't do anything special except slow things down and
> add complexity to the overall USB system, and does nothing for
> "security" at all.

Sometimes they may hang when plugged device misbehaviors. Pulling
out the cable and then plugging it back resumes normal operation.

With direct connection, I sometimes ended up with all USB devices
being inaccessible. Now, I keep a mouse plugged into the hub to
detect these situations.

Look here, I had some experiments recently:

Bus 002 Device 063: ID 05e3:0606 Genesys Logic, Inc. USB 2.0 Hub
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 064: ID 046d:c016 Logitech, Inc. Optical Wheel Mouse

Device IDs tell us the hub was reset several times :-)


-- 
Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru>
GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://keys.gnupg.net