Re:Employees are quitting instead of giving up working from ...
by bradlys on Tuesday June 01, 2021 @04:01PM
(#27360472)
Huh - I worked in health with HIPPA data issues as well - never had this hardware specific issue. But, we were a group of software engineers who weren't idiots - so... we understood that bringing our own monitor or keyboard/mouse wasn't likely to do anything and not a real risk.
[ Parent
| on HN ]
Re:Employees are quitting instead of giving up working from ...
by NateEag on Wednesday June 02, 2021 @09:00AM
(#27368176)
I have a keyboard that runs custom, open-source software.
It would be easy to figure that out about me, if you cared. Say if you found a list of employees and contractors.
A sufficiently-motivated attacker could backdoor my firmware with a timer-based exploit (e.g., start your keystroke payload after ten minutes without input events) and I might well not notice if it was a deft-enough change.
It might not be worth the cost, given that I might well notice it and it might not pay off even if I didn't.
Still - the point is that keyboards are not innocuous, harmless devices that it's a no-brainer to allow.