Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 31 Jul 2016 06:39:56 -0700
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: badUSB exploit - affects all Linux distros

On Sun, Jul 31, 2016 at 01:34:02PM +0200, פאי פי wrote:
> Title: badUSB exploit - affects all Linux distros
> ---------------------------------------------------------
> 
> Dear oss-security mail list members,
> 
> Please, I urge you to fix the known badUSB security exploit that exists in any Linux distro.

First off, it is not an "exploit", is is "working as designed". :)

> There is available (to the general public) a relatively cheap product
> which does the "rubberducky" attack, it uses the badUSB exploit.

Not really, that device just acts like the USB device it said it is (a
keyboard).  This device has been around for years and is very useful for
development efforts.

>     1. Copy-paste a bash script
>     2. chmod it so that it will execute (under normal user - NOT root)
>     3. malware is active... 

So can your USB keyboard :)

Anyway, Linux (the kernel), provides you the abilities to disable all
USB devices and only enable the ones you deem "safe", whenever you
decide to.  It is up to you how you determine this.  By default, most
Linux distros do not enable this option for obvious reasons.

> Note that by default - Linux's firewall is disabled, therefore
> allowing an easy access to the attacker via internet.

No, that's your distro's decision, many enable it by default.

Anyway, best of luck, but this is a distro-specific issue and I suggest
working with your distro to enable that option by default if you so
desire it.

thanks,

greg k-h

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ