Date: Sun, 31 Jul 2016 06:39:56 -0700 From: Greg KH <greg@...ah.com> To: oss-security@...ts.openwall.com Subject: Re: badUSB exploit - affects all Linux distros On Sun, Jul 31, 2016 at 01:34:02PM +0200, פאי פי wrote: > Title: badUSB exploit - affects all Linux distros > --------------------------------------------------------- > > Dear oss-security mail list members, > > Please, I urge you to fix the known badUSB security exploit that exists in any Linux distro. First off, it is not an "exploit", is is "working as designed". :) > There is available (to the general public) a relatively cheap product > which does the "rubberducky" attack, it uses the badUSB exploit. Not really, that device just acts like the USB device it said it is (a keyboard). This device has been around for years and is very useful for development efforts. > 1. Copy-paste a bash script > 2. chmod it so that it will execute (under normal user - NOT root) > 3. malware is active... So can your USB keyboard :) Anyway, Linux (the kernel), provides you the abilities to disable all USB devices and only enable the ones you deem "safe", whenever you decide to. It is up to you how you determine this. By default, most Linux distros do not enable this option for obvious reasons. > Note that by default - Linux's firewall is disabled, therefore > allowing an easy access to the attacker via internet. No, that's your distro's decision, many enable it by default. Anyway, best of luck, but this is a distro-specific issue and I suggest working with your distro to enable that option by default if you so desire it. thanks, greg k-h
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ