[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140808143514.GD20054@haproxy.com>
Date: Fri, 8 Aug 2014 16:35:14 +0200
From: Willy Tarreau <willy@...roxy.com>
To: oss-security@...ts.openwall.com
Subject: Re: BadUSB discussion
On Fri, Aug 08, 2014 at 06:36:12AM -0700, Greg KH wrote:
> On Fri, Aug 08, 2014 at 02:20:21PM +0300, Dan Carpenter wrote:
> > I'm surprised we haven't had any discussion about the recent BadUSB
> > articles.
> >
> > http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/
> > http://security.stackexchange.com/questions/64524/how-to-prevent-badusb-attacks-on-linux-desktop
> >
> > We could put a popup if there is a second keyboard attached to check
> > that the person controlling the existing keyboard is aware of the second
> > one.
>
> "popup" where? Multi-seat machines wouldn't like that very much, as
> would yubikeys (as was pointed out), or a raft of other USB devices that
> export a keyboard device for the buttons they control (video cameras,
> external speakers, barcode scanners, etc.)
Also, keyboards are one aspect of the problem. The biggest aspect is not new and
has been abused for years, which is the main reason why so many large companies
physically remove (stick or desolder) USB ports : you're connecting a *device*
to your system and there's no way to make that 100% safe using software only.
With a bogus driver and a DMA-capable device, you can end up accessing kernel
locations and causing a lot more discrete harm such as unlocking displays,
changing UIDs of running processes, etc. And that's much harder to detect,
especially in closed drivers or with closed systems.
So I'd rather not clobber keyboard drivers for 100% of the users in order to
improve safety by a few percent for a few percent of users.
One more efficient solution could be to have a sysctl to disable hotplugging
of USB devices, all of them. Software would then detect the new devices, and
decide to load the drivers among a whitelist associated to a given port. The
administrator could add new rules, and it could be the user for personal
desktop PCs. But even then you still have the risk of the user not understanding
what's happening and bindly clicking "OK".
Just my 2 cents,
Willy
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
