Wired, and others are reporting on a research paper by Karsten Nohl and Jakob Le

Question

Wired, and others are reporting on a research paper by Karsten Nohl and Jakob Lell. The paper apparently shows how any USB device (not just memory sticks) can be infected with malware at the firmware level. This can then be used to attack any device the USB device is attached to. As the malware resides in the firmware, even wiping the memory stick of data is insufficient, as the firmware remains untouched.

USB is such an entrenched standard; can this be fixed in the next version?

Bruce Schneier suggests that this is the kind of attack the NSA would favour.

Note: There will be a presentation at BlackHat 2014 by the authors.

Explanation / Answer

I think this WIRED story is way out of proportion. While it's true that a USB device can act as a keyboard, or mouse, or a hub with both, it would only act with the privileges of the current user, and the attack wouldn't be stealthy: the device would have to open a command window, type commands, etc. with no way to read commands output.

You absolutely don't need to assume that a computer is potentially compromised just because a USB device was attached to it once.

The proposed solution "only allow a specific brand" is ridiculous too (how can you reliably measure that when the USB stick is lying?). A much simpler, more robust solution would be to block additional keyboards and point device, unless the user confirm that a wants to have two keyboards or two point devices.

Being able to reprogram any device firmware without a user manipulation (good old jumper...) is still a serious security issue, obviously.

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.