[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120108220818.353d2a1f@fb6vu8j9i2>
Date: Sun, 8 Jan 2012 22:08:18 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: Malicious devices & vulnerabilties
Am Sun, 8 Jan 2012 09:07:25 -0800
schrieb Greg KH <greg@...ah.com>:
> They should be considered buggy, yes, and as such, the kernel
> developers will fix any reported problems (or we should, if not,
> please let me know.)
>
> But note, as these almost always fall under the "you have physical
> access" category, their security impact is generally considered low.
As far as publicly known, it's likely that Stuxnet was originally
spread via a security problem with USB.
Also, I'd doubt the "physical access" category. It may just require a
bit of social engineering ("I have the file you requested on this usb
stick").
Considering that I'd strongly disagree classifying such issues "low
impact".
At least for pluggable devices, I'd consider such issues rather
serious. It's another thing with PCI or other devices that require
significant work to attach to a piece of hardware.
--
Hanno Böck mail/jabber: hanno@...eck.de
GPG: BBB51E42 http://www.hboeck.de/
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
