oss-sec mailing list archives
Re: BadUSB discussion
From: Willy Tarreau <willy () haproxy com>
Date: Fri, 8 Aug 2014 16:35:14 +0200
On Fri, Aug 08, 2014 at 06:36:12AM -0700, Greg KH wrote:
On Fri, Aug 08, 2014 at 02:20:21PM +0300, Dan Carpenter wrote:I'm surprised we haven't had any discussion about the recent BadUSB articles. http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/ http://security.stackexchange.com/questions/64524/how-to-prevent-badusb-attacks-on-linux-desktop We could put a popup if there is a second keyboard attached to check that the person controlling the existing keyboard is aware of the second one."popup" where? Multi-seat machines wouldn't like that very much, as would yubikeys (as was pointed out), or a raft of other USB devices that export a keyboard device for the buttons they control (video cameras, external speakers, barcode scanners, etc.)
Also, keyboards are one aspect of the problem. The biggest aspect is not new and has been abused for years, which is the main reason why so many large companies physically remove (stick or desolder) USB ports : you're connecting a *device* to your system and there's no way to make that 100% safe using software only. With a bogus driver and a DMA-capable device, you can end up accessing kernel locations and causing a lot more discrete harm such as unlocking displays, changing UIDs of running processes, etc. And that's much harder to detect, especially in closed drivers or with closed systems. So I'd rather not clobber keyboard drivers for 100% of the users in order to improve safety by a few percent for a few percent of users. One more efficient solution could be to have a sysctl to disable hotplugging of USB devices, all of them. Software would then detect the new devices, and decide to load the drivers among a whitelist associated to a given port. The administrator could add new rules, and it could be the user for personal desktop PCs. But even then you still have the risk of the user not understanding what's happening and bindly clicking "OK". Just my 2 cents, Willy
Current thread:
- Re: BadUSB discussion, (continued)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion Yves-Alexis Perez (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion Yves-Alexis Perez (Aug 09)
- Re: BadUSB discussion Vincent Lefevre (Aug 14)
- Re: BadUSB discussion gremlin (Aug 08)
- Re: BadUSB discussion gremlin (Aug 08)
- Re: BadUSB discussion Rich Felker (Aug 08)
- Re: BadUSB discussion Willy Tarreau (Aug 09)
- Re: BadUSB discussion Yves-Alexis Perez (Aug 09)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion gremlin (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)
- Re: BadUSB discussion gremlin (Aug 08)
- Re: BadUSB discussion (GalaxyMaster) (Aug 08)
- Re: BadUSB discussion gremlin (Aug 08)
- Re: BadUSB discussion Greg KH (Aug 08)