News for hackers. Stuff that matters.

A comment on “We have obtained fully functional JTAG for Intel CSME via USB DCI”. Parent comment

Re:“We have obtained fully functional JTAG for Intel CSME vi... by blhack on Friday November 10, 2017 @06:04PM (#15673837)
Is it still true that USB devices can be used to execute code on a target's system without user interaction?

I thought this behavior disappeared ~10 years ago.

[ Parent | on HN ]
Re:“We have obtained fully functional JTAG for Intel CSME vi... by IshKebab on Sunday November 12, 2017 @05:36PM (#15682972)
They shouldn't be able to. Firewire devices can because they used DMA without memory protection. I don't think Thunderbolt has the same flaw.

However there are bugs in USB stacks, especially now you can do so many alternate protocols over USB-C.

https://www.jefftk.com/p/malicious-usb-sticks

There's nothing fundamental in the USB spec that lets devices execute code on the host.

[ Parent | on HN ]