Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 08 Aug 2014 09:21:19 -0700
From: lazytyped <>
Subject: Re: BadUSB discussion

On 08/08/2014 09:17, Greg KH wrote:
> There is a USB firmware download spec, which is quite easy to use, if
> manufacturers actually followed it (side note, I was one of the authors
> of that spec...)  And if USB device manufacturers actually required
> signed firmware to run in their devices, that would solve this issue
> instantly as long as the signing keys don't leak.

Or, for cheap devices like USB dongles, just keep the firmware
read-only. Who's going to update it anyway.

But yes, either the update should be signed and verified, or
hardware-switch controlled or impossible to begin with (read-only). Not
only for USB devices.

      -  twiz

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.