CIRCLean – USB key sanitizer

Re:CIRCLean – USB key sanitizer by leni536 on Tuesday March 14, 2017 @03:56AM (#13865802)

They can mitigate against badUSB by only whitelisting the generic USB mass storage class driver. No keyboard, no mouse, etc... I am not confident they do this though.

[ Parent | on HN ]

Re:CIRCLean – USB key sanitizer by A1kmm on Tuesday March 14, 2017 @05:26AM (#13866135)

Looks like they don't, but they turn off usbhid on that particular port: https://github.com/CIRCL/Circlean/blob/master/circlean_fs/ro...

However, that could be bypassed if the USB key acted like a USB hub with a keyboard attached.

If you do get a keyboard working, it looks like you can just log in with raspberry / raspberry and then full privileged access since sudo from the raspberry user, and /dev/kmem from root is enabled. That would allow arbitrary content to be copied on to the user supplied USB, and depending on the device, possibly firmware reprogramming.

[ Parent | on HN ]

Re:CIRCLean – USB key sanitizer by leni536 on Tuesday March 14, 2017 @05:43AM (#13866185)

Huh, at least it seems that they care about this attach vector. Blacklisting seems to be the wrong approach.

[ Parent | on HN ]

Re:CIRCLean – USB key sanitizer by lucb1e on Tuesday March 14, 2017 @06:06AM (#13866272)

> They can mitigate against badUSB by only whitelisting

I'd say just don't run a graphical environment or, if you do, lock it. With a normal password, good luck to the USB thumb drive that pretends to be a keyboard.

As for booting, well, don't have it in there at boot time.

As for malware in the files itself -- I don't think that's the point of this project. It says "if you don't trust the transport medium (i.e. USB)", it's not about the contents.

[ Parent | on HN ]