Barcode-as-a-keyboard was one of the vectors that researchers at last CCC used to hack ATMs. End result: show two barcodes, cash gets out.

https://media.ccc.de/v/35c3-9761-truly_cardless_jackpotting_...

USB is trash for security.

Don’t think that’s a vector per se. The ATM accepts untrusted USB keyboard input (THAT is the bug)—the barcode reader is just a product that happens to make it easy to type in the right series of characters. You could have done the same thing with a normal keyboard (or an Arduino, if you wanted the convenience)

I wouldn't be terribly surprised if you could create a barcode that caused a barcode reader to send <windows key>+r and run some arbitrary command. So perhaps it wasn't a vector for an ATM, but maybe some other barcode reader where workers scan in arbitrary things they are handed...TSA maybe?

As far as I remember that's roughly how that exploit against an ATM worked:

https://xlab.tencent.com/badbarcode/

Also, perhaps folks working in data centers can and confirm/deny, but from what I know it's usually strictly forbidden to bring any USB devices into a data center area.

We use USB drives as installers and, in some cases, as boot volumes. (And of course keyboards and mice on crash carts and USB serial ports for laptops.)

We’re not a cloud provider, but I’ve been in lots of DCs and seen plenty of USB devices.

I'd love to have a crash cart. I'd spend all day crashing it into other carts.

Before chip embedded credit/debit cards were prevalent, most magnetic strip reader (MSR) peripherals would often operate as a USB keyboard. It allows them to work with web app based POS systems without requiring things like ActiveX.

Same but different... I was working to get a Hotel property management web application running on iPad so host could check in people away from desk. The web application supported MSR swipe keyboard entry, but you can’t plug in a generic USB MSR device into iPad. I wrote a custom iOS keyboard that interfaces with lightning MSR and its API and the “typed” the characters into Safari. It was nice to be able to use generic Safari and not some App wrapper. And it wasn’t too difficult on host to change keyboards to swipe.

In high school we messed around with this in the crappy P.O.S. system at the place I worked (windowed app, running on Windows) to see what data was recorded on all our various student ID cards, gift certificates etc.

I was delighted about this when a client wanted a barcode scanner integrated with a web app. I envisioned major difficulties but instead it only took 5 minutes to implement.

Yep! I have a webapp that's been handling physical print-based photography awards for 7 years now. It generates a PDF label with barcode that the entrant sticks on the back of their print, and then they're shipped to the judging location and the award staff scan 4000+ entries over a couple of days. The barcode scanning was the easiest part of the whole project.

Emulate a MTP device (often used by cameras) and mount with a fuse driver. Since the content on the remote device can change the driver shouldn't be caching it.

Or emulate a network, generate a DHCP response for your favorite /31 and don't send a router, and point a public domain name at the other address in that /31.

I'm not sure if you are serious. My goal was to use an USB device standard for which open source drivers exist and which doesn't open security holes by allowing it into your system.

MTP devices are ~mostly harmless~ and relatively easy to trust. Network devices are not.

Can you elaborate? I understand the concept of RNDIS or CDC devices, but if you've sent an IP address only without a router, how is any traffic going to make it back to the other IP in that subnet? I figure it will go back over the default route, but how are you in control of the traffic itself?

The subnet mask determines the size of the connected network, which is in itself a route in your routing table.

It's the same mechanism used to reach your router. Subnet-local / connected routes are routes in themselves. Routers let you leave your subnet.

at that point you might as well just use the real drivers.

this is how they've always worked. How else should a barcode be entered by a scanner?

The driver could read data from the device and clamp the results to a reasonable number of non control code characters.