G+_George Kozi Posted October 6, 2014 Share Posted October 6, 2014 Mike Elgan Originally shared by BBC News Code that turns USB devices into cyber-attack platforms has been released online http://bbc.in/1xWins6 Link to comment Share on other sites More sharing options...
G+_Paul Dail Posted October 6, 2014 Share Posted October 6, 2014 We are all Dooooooomed.. Link to comment Share on other sites More sharing options...
G+_Joshua “Wizdum” Burgess Posted October 6, 2014 Share Posted October 6, 2014 "Code that turns USB devices into cyber-attack platforms has been released online 10 years ago" Link to comment Share on other sites More sharing options...
G+_Fr. Robert Ballecer, SJ Posted October 7, 2014 Share Posted October 7, 2014 Chris Fixsen Are you sure about that? Can you trust that your "new" USB devices haven't been intercepted and "improved"? -- or even compromised at the factory? Furthermore, can you trust that your computer/phone/printer/etc. haven't been compromised? The insidiousness of this exploit is that it isn't correctable without destroying all current USB devices and changing the USB standard to not allow the updating of the firmware. (which is an exploit waiting to happen in itself.) In other words... there IS no simple solution. Link to comment Share on other sites More sharing options...
G+_Fr. Robert Ballecer, SJ Posted October 7, 2014 Share Posted October 7, 2014 Joshua Burgess You're talking about using the autorun feature of USB to compromise systems they're connected to. -- This is far worse. If I reformat a USB drive it destroys that 10-year-ago attack. If I own the firmware on a USB drive, not only will reformatting not destroy the exploit, but you can't even SEE the exploit. USB was designed to trust whatever the controller reports about the devices. In other words, I have no visibility of the USB device past the controller... and past that controller is the firmware and whatever else the device does. Soooo... If I were using this attack, the first thing I would do is to make sure that the controller would report itself as a non-vulnerable USB chipset and automatically report the version number of any firmware that you attempted to upload into the controller. Since you have no visibility past the controller, any test you run will only show you what the controller tells you. - In my example, it would show you that the USB device is NOT vulnerable to attack, and that it's running the latest firmware. In other words... sooooooo not the attack of 10 years ago. :) Link to comment Share on other sites More sharing options...
Recommended Posts