Date: Fri, 8 Aug 2014 16:35:14 +0200 From: Willy Tarreau <willy@...roxy.com> To: oss-security@...ts.openwall.com Subject: Re: BadUSB discussion On Fri, Aug 08, 2014 at 06:36:12AM -0700, Greg KH wrote: > On Fri, Aug 08, 2014 at 02:20:21PM +0300, Dan Carpenter wrote: > > I'm surprised we haven't had any discussion about the recent BadUSB > > articles. > > > > http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/ > > http://security.stackexchange.com/questions/64524/how-to-prevent-badusb-attacks-on-linux-desktop > > > > We could put a popup if there is a second keyboard attached to check > > that the person controlling the existing keyboard is aware of the second > > one. > > "popup" where? Multi-seat machines wouldn't like that very much, as > would yubikeys (as was pointed out), or a raft of other USB devices that > export a keyboard device for the buttons they control (video cameras, > external speakers, barcode scanners, etc.) Also, keyboards are one aspect of the problem. The biggest aspect is not new and has been abused for years, which is the main reason why so many large companies physically remove (stick or desolder) USB ports : you're connecting a *device* to your system and there's no way to make that 100% safe using software only. With a bogus driver and a DMA-capable device, you can end up accessing kernel locations and causing a lot more discrete harm such as unlocking displays, changing UIDs of running processes, etc. And that's much harder to detect, especially in closed drivers or with closed systems. So I'd rather not clobber keyboard drivers for 100% of the users in order to improve safety by a few percent for a few percent of users. One more efficient solution could be to have a sysctl to disable hotplugging of USB devices, all of them. Software would then detect the new devices, and decide to load the drivers among a whitelist associated to a given port. The administrator could add new rules, and it could be the user for personal desktop PCs. But even then you still have the risk of the user not understanding what's happening and bindly clicking "OK". Just my 2 cents, Willy
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ