[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 08 Aug 2014 09:21:19 -0700
From: lazytyped <lazytyped@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: BadUSB discussion
On 08/08/2014 09:17, Greg KH wrote:
> There is a USB firmware download spec, which is quite easy to use, if
> manufacturers actually followed it (side note, I was one of the authors
> of that spec...) And if USB device manufacturers actually required
> signed firmware to run in their devices, that would solve this issue
> instantly as long as the signing keys don't leak.
Or, for cheap devices like USB dongles, just keep the firmware
read-only. Who's going to update it anyway.
But yes, either the update should be signed and verified, or
hardware-switch controlled or impossible to begin with (read-only). Not
only for USB devices.
- twiz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
