Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The new MacBook's single port comes with a security risk

theverge.com

Post reply on HN
Print view View original

31–40 of 41 posts

Re: The new MacBook's single port comes with a security risk

#31

Post by masklinn »

drakenot wrote: post #18
sharth wrote: post #14

Earlier quoted context omitted.

One of the suggested alternate modes in the specification is a PCIe bus. This would most likely support bus mastering, and thus a full DMA engine. This certainly requires some host cooperation, but I imagine that the fear is that these drivers start to be distributed in the OS by default. One of the BadUSB vectors is a USB keyboard, which is a fairly well expected driver to be included with the OS.

Is it possible to whitelist USB (or Thunderbolt for that matter) devices and prevent all others from connecting? It is fairly common for me to connect a USB keyboard, but it is pretty rare for me to connect an unknown keyboard.

It's possible to filter based on vendor ID and device ID, but deviceid is shared (it's more of a product id), and both can be faked of course. On Linux it's handled via udev, on Windows via group policies (since Server 2008/Vista), on OSX it might be possible via MDM, in the Server application (I'm not sure)

Re: The new MacBook's single port comes with a security risk

#32

Post by TylerE »

placeybordeaux wrote: post #6
adrianm wrote: post #3

The article (especially the headline) implies that the new Macbook is somehow more at risk because of its reliance on one USB port. But if the root of the problem is USB more generally, wouldn't the only "secure" design preclude the inclusion of any USB ports whatsoever? My issue with the article is that by singling out the Macbook (due to its single port) they are not actually contributing any useful information bac…

If there is a USB port and a power port a super parinoid person could never use the USB port, or even fill it with glue. Not an option here. This is also talking about how combining them also allows for the potential of charger based attacks, a charger is something that absolutely has to be plugged in at some point.

A paranoid user wouldn't use a power port, either. At least not without whipping out a multimeter first.

Re: The new MacBook's single port comes with a security risk

#33

Post by rimunroe »

drakenot wrote: post #19

Isn't USB-c more secure because it doesn't have DMA like Thunderbolt does? I've seen several articles on HN in the past year that detail serious compromises that are possible via just plugging in a Thunderbolt cable.

I think so, but I am reminded of this sage advice: https://twitter.com/jdub/status/575887350158372864 > Never plug in an unknown USB key or cable. Never plug in an unknown Lightning cable. Never touch computers. Everything is a computer. Run.

Re: The new MacBook's single port comes with a security risk

#34

Post by scott_karana »

sharth wrote: post #15
zzleeper wrote: post #12

Earlier quoted context omitted.

Are you kidding? It means that if you go to a coffes hop and plug your laptop, you can become compromised. Sure, random people in a starbucks won't, but it's a boon for industrial espionage!

So... bring your own charger? Does your coffee shop normally provide you a laptop charger?

Coffee shops and airports don't provide laptop chargers, but they do sometimes provide USB chargers, which are now the same thing!

Re: The new MacBook's single port comes with a security risk

#35

Post by coldtea »

TheLoneWolfling wrote: post #23
centizen wrote: post #17

Earlier quoted context omitted.

Just wondering, how does that mean that? The way I understand things that is only possible if you use someone else's compromised power adapter. I've never seen a coffee shop that supplied power adapters, it's always just a bunch of power outlets. I think your safe for now.

I see plenty of coffee shops with wall sockets with USB ports for charging. And they are typically being used. Same idea here.

USB-C wall sockets? For charging laptops? I don't think so.

You're worrying for a coffee shop that doesn't even exist.

Re: The new MacBook's single port comes with a security risk

#36

Post by mvid »

scott_karana wrote: post #34
sharth wrote: post #15

Earlier quoted context omitted.

So... bring your own charger? Does your coffee shop normally provide you a laptop charger?

Coffee shops and airports don't provide laptop chargers, but they do sometimes provide USB chargers, which are now the same thing!

Are the power requirements the same? My assumption would be that usb wall chargers wouldn't have the juice to keep your laptop battery at a steady state, let alone charge.

The provided iphone wall charger is 5 watts, the provided apple laptop charger is 60 watts.

Re: The new MacBook's single port comes with a security risk

#37

Post by Mindless2112 »

masklinn wrote: post #29
Animats wrote: post #22

Earlier quoted context omitted.

Right. A USB device can't do anything unless the OS lets it. We went through this with "autorun" on CDs and DVDs. For years, Windows would run anything that looked executable if you put it in the obvious place. That didn't end well. Those defaults were finally changed. What's needed is to turn off automatic hot plugging for USB devices. The era when you can plug in a USB device and have it go live without user intera…

> We're going to need clear OS dialogs - "The USB device you just plugged in claims to be a keyboard - did you just plug in a keyboard?" Of course there is the chicken-and-egg issue of allowing the first keyboard you plug into a machine which does not have any built-in input device.

"The USB device you plugged in claims to be a keyboard -- type the following randomly generated number to confirm."

Re: The new MacBook's single port comes with a security risk

#38

Post by AcerbicZero »

justinph wrote: post #7

This is a mostly useless article. Every computer with USB ports has this problem. If you want to use it as, you know, a computer, you're probably gonna need to plug some stuff into it at one time. You could make the argument that now that it has one port, it's easier to secure because you only have to secure one side of the computer instead of two.

I disagree. The author makes it clear they're referring to the added weakness of having a device charge via a non-secure port as compared to the inherent insecurity of USB ports.

The added vulnerability is based on the ease at which people will plug in a strangers power cable compared to plugging in a strangers USB stick.

Re: The new MacBook's single port comes with a security risk

#39

Post by loco5niner »

coldtea wrote: post #35
TheLoneWolfling wrote: post #23

Earlier quoted context omitted.

I see plenty of coffee shops with wall sockets with USB ports for charging. And they are typically being used. Same idea here.

USB-C wall sockets? For charging laptops? I don't think so. You're worrying for a coffee shop that doesn't even exist.

yet

Re: The new MacBook's single port comes with a security risk

#40

Post by scott_karana »

mvid wrote: post #36
scott_karana wrote: post #34

Earlier quoted context omitted.

Coffee shops and airports don't provide laptop chargers, but they do sometimes provide USB chargers, which are now the same thing!

Are the power requirements the same? My assumption would be that usb wall chargers wouldn't have the juice to keep your laptop battery at a steady state, let alone charge. The provided iphone wall charger is 5 watts, the provided apple laptop charger is 60 watts.

I suspect airport chargers are more like 1 watt, but the problem is whether end-users will hook their laptops up to the insecure charger, not the efficiency or lack thereof :)
Post reply on HN