Re:Should the Web Expose Hardware Capabilities?
by cesarb on Wednesday January 06, 2021 @12:07PM
(#25659629)
> and frankly, most usb devices are pretty boring & isolated. yes you can hurt a usb flash drive if you do the wrong things to it, you can install an autorun.inf nasty malware. yes you can play gross sounds or listen on a usb sound card. but few devices are going to do anything to the system. mostly it's a bunch of mice & keyboards.
With Thunderbolt/USB4, a USB device is not only a USB device; it's also a PCIe device. Upgrading its firmware (USB is commonly used for firmware update, but it could also be done through exploits on non-firmare-update endpoints) means the attacker now has control of not only a USB device, but also a PCIe device.
Re:Should the Web Expose Hardware Capabilities?
by corty on Wednesday January 06, 2021 @12:38PM
(#25660050)
And control of a PCIe device (with the usual lazy broken drivers that just ignore IOMMU) means full read and write access to all physical memory adresses, including OS kernel, firmware and NMI RAM areas and all applications. This gives an attacker the capability to compromise the hardware in very permanent ways. Nothing to take lightly or brush off as security absolutism.
Re:Should the Web Expose Hardware Capabilities?
by sfink on Wednesday January 06, 2021 @02:46PM
(#25661385)
The Web has certain properties that it relies on for its existence. This isn't "clawing for absolute security", it's recognition that if you push the Web just a little too far, it's dead. As in, it's not the Web anymore, will gradually become useless for many existing purposes, and will have to be replaced by something else borne out of its ashes.
"The Web but without worrying quite as much about its security/privacy characteristics" is simply not the Web. Same as "the Web but without stressing so much about backwards compatibility". It would be a great thing, perhaps, but it's something different and would evolve very differently. (In particular, it would lack some of the core reasons why the Web has competed successfully with native apps.)
in contrast, the author presents Mozilla's view,
> “Because many USB devices are not designed to handle potentially-malicious interactions over the USB protocols and because those devices can have significant effects on the computer they’re connected to, we believe that the security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent.”
while i do not disagree with the risks, i for one think this clawing for absolute security, this idea that the web must only allow a narrow enough path that nothing ever goes wrong, is death. there is indeed great cause for Fear Uncertainty and Doubt (FUD)[3], but we have to do it anyways.
and frankly, most usb devices are pretty boring & isolated. yes you can hurt a usb flash drive if you do the wrong things to it, you can install an autorun.inf nasty malware. yes you can play gross sounds or listen on a usb sound card. but few devices are going to do anything to the system. mostly it's a bunch of mice & keyboards.
there's such amazing tension between those who want to secure & lock things down, & those who still have hope, who see the web as one of the few remaining ways to keep doors open, to leave something neutral & available & capable about for humanity to use, without endless gatekeeping rigamarole. nothing comes close to the web for being able to get your idea out there, the web is the epitome of online, and in spite of much danger & scariness, it seems obvious- my soul yearns to amplify & enhance & empower ourselves more with this amazing, unique, utterly special system.
[1] https://www.youtube.com/watch?v=IpfZ8Nj3uiE#t=20m
[2] https://github.com/noopkat/avrgirl
[3] https://en.wikipedia.org/wiki/Fear,_uncertainty,_and_doubt