11–20 of 41 posts
Earlier quoted context omitted.
If there is a USB port and a power port a super parinoid person could never use the USB port, or even fill it with glue. Not an option here. This is also talking about how combining them also allows for the potential of charger based attacks, a charger is something that absolutely has to be plugged in at some point.
I guess the paranoid user can use an usb condom if so.
This is a mostly useless article. Every computer with USB ports has this problem. If you want to use it as, you know, a computer, you're probably gonna need to plug some stuff into it at one time. You could make the argument that now that it has one port, it's easier to secure because you only have to secure one side of the computer instead of two.
The article (especially the headline) implies that the new Macbook is somehow more at risk because of its reliance on one USB port. But if the root of the problem is USB more generally, wouldn't the only "secure" design preclude the inclusion of any USB ports whatsoever? My issue with the article is that by singling out the Macbook (due to its single port) they are not actually contributing any useful information bac…
The only USB issue which REALLY isn't solvable is the fact that USB devices can simulate a USB hub and then attach fictional human interface devices (i.e. keyboards and mice) which they can then use to take over the computer and or otherwise cause problems.
USB Type C does not support DMA as the article states. I think there might be some confusion on the attack vector here. BadUSB requires cooperation from the OS/BIOS/a driver.
This certainly requires some host cooperation, but I imagine that the fear is that these drivers start to be distributed in the OS by default.
One of the BadUSB vectors is a USB keyboard, which is a fairly well expected driver to be included with the OS.
This is a mostly useless article. Every computer with USB ports has this problem. If you want to use it as, you know, a computer, you're probably gonna need to plug some stuff into it at one time. You could make the argument that now that it has one port, it's easier to secure because you only have to secure one side of the computer instead of two.
Are you kidding? It means that if you go to a coffes hop and plug your laptop, you can become compromised. Sure, random people in a starbucks won't, but it's a boon for industrial espionage!
We need a way to give us assurance that port is in just power mode.
This is a mostly useless article. Every computer with USB ports has this problem. If you want to use it as, you know, a computer, you're probably gonna need to plug some stuff into it at one time. You could make the argument that now that it has one port, it's easier to secure because you only have to secure one side of the computer instead of two.
Are you kidding? It means that if you go to a coffes hop and plug your laptop, you can become compromised. Sure, random people in a starbucks won't, but it's a boon for industrial espionage!
I've never seen a coffee shop that supplied power adapters, it's always just a bunch of power outlets. I think your safe for now.
USB Type C does not support DMA as the article states. I think there might be some confusion on the attack vector here. BadUSB requires cooperation from the OS/BIOS/a driver.
One of the suggested alternate modes in the specification is a PCIe bus. This would most likely support bus mastering, and thus a full DMA engine. This certainly requires some host cooperation, but I imagine that the fear is that these drivers start to be distributed in the OS by default. One of the BadUSB vectors is a USB keyboard, which is a fairly well expected driver to be included with the OS.
It is fairly common for me to connect a USB keyboard, but it is pretty rare for me to connect an unknown keyboard.
I've seen several articles on HN in the past year that detail serious compromises that are possible via just plugging in a Thunderbolt cable.
This is written like it is a novel situation. Smart phones have had this problem almost since inception. Would be nice to see a hardware switch to deactivate the pins that aren't needed for power.
That switch sounds like a tech' support nightmare. Even WiFi switches are a massive PITA that are almost more trouble than they're worth. I'd suggest that if people want safe USB that they just buy a USB "condom" (i.e. an adapter that goes between the power and port, and disconnects the data wires). Although does USB-C use any of the data pins to determine if it is safe to transmit power? I just ask because Apple's U…