Everything is an input device (fun with barcodes) [video]

behnamoh wrote: post #5

Can't wait to see equivalent NFC tricks misused at stores. Imagine doing an NFC which sends malicious instructions to your phone.

NFC is a bit different - it doesn't try to pretend to be an input device. There are specific protocols that NFC devices can speak and the device can parse and then display (such as for NDEF tags), but short of exploiting a vulnerability in the parser, this kind of attack isn't possible.

The vulnerabilities outlined here are:

1) the barcode reader itself is configured over the untrusted channel via specific barcodes, instead of out-of-band via the USB interface

2) the barcode reader is either already emulating a keyboard, or can be configured to do so via the (untrusted) configuration mechanism described above.

This vulnerability can be mitigated by making sure the barcode scanner can't be reconfigured in the field and by talking to the barcode scanner over a specific interface (serial) instead of keyboard emulation, so that data from the barcode scanner has no chance of being interpreted by the OS as keyboard input.

Re: Everything is an input device (fun with barcodes) [video]

#8

Post by victorp13 » Thu, Sep 01, 2022, 5:39 PM UTC

Note how these folks are moving to the next slide using a barcode scanner. Like an absolute boss!