Re:No one, not even the Secret Service, should randomly plug...
by robertAngst on Monday April 08, 2019 @08:08PM
(#19610416)
>USB device was generally expensive
How expensive? USB is a protocol, a micro, and some power management.
How long ago was this 'out of scope'?
Re:No one, not even the Secret Service, should randomly plug...
by jolmg on Tuesday April 09, 2019 @11:30AM
(#19615645)
I imagine he means before the advent of 3d printing, services like PCBWay, products like Arduino, and online stores like DigiKey. It's probably much easier to make one's own devices today than it was when USB was first being designed.
He's also right about the physical access thing. Fundamentally, it doesn't make much sense to add protections against scenarios where the attacker apparently needs physical access, because there's no way to protect against all things he could possibly do then. It's not really obvious that the user needs protecting from himself as he plugs in a device of doubtful origins. We used to hold the user to higher standards.
Because up until 10 years ago, developing your own USB device was generally expensive and malicious devices ended up being out of scope in threat modelling. In addition, some models these days still define 'physical access == game over'...