Circlean seems to run on RPi - that won't boot off USB by default. In fact, you have to jump through extra hoops to get a similar effect, such as "bootloader runs from SD card, then explicitly switches to USB". So unless the makers of this have deliberately implemented this vulnerability, it's not there.
Agreed, but in this specific case, CIRCLean depends on the keys being inserted before boot (see steps 2 - 4).
Oh, you are right, this can be bad. But I doubt that CIRCLean does any of the badUSB mitigations. They could fix all of these including the instructions. But that they copy unrecognised binaries ("Octet-stream" in their readme) without marking them dangerous is the most worrisome for me [1]. It seems to be useful only for office documents.
Re:CIRCLean – USB key sanitizer
by SteveClement on Tuesday March 14, 2017 @05:46AM
(#13866195)
> They could fix all of these including the instructions.
Where "They" could be anyones pull-request
2. You can disable booting from USB in the BIOS. However I think you can't disable keyboards there, so a badUSB device can potentially enter the bios, enable USB booting then infect the machine by booting into the virus. Disabling USB booting and setting a strong BIOS password can be safe, I would still prefer the first option though.