Re:Unpatchable Malware That Infects USBs
by jedunnigan on Thursday October 02, 2014 @12:12PM
(#8401356)
Perhaps some kind of time lapse would solve that problem. The USB won't execute anything for x minutes while you inspect what it is really doing (if it's your keyboard or mouse, do nothing). If nothing is done, allow the USB to load its drivers, etc...
Would it be possible to:
1. Connect innocently as a plain storage device 2. Wait a period of time or even monitor voltage fluctuations to guess when the user is not at the computer. 3. Disconnect and reconnect (or a new side-connection?) as a HID device
Users often won't mentally associate the long-delayed attack with the USB stick, and if it attacks when they are AFK the timer might hit 0 in total secrecy.
Re:Unpatchable Malware That Infects USBs
by jedunnigan on Thursday October 02, 2014 @02:04PM
(#8402111)
Absolutely true. The time lapse is only to allow the user to inspect the drive before it is allowed to execute arbitrarily. That may not actually be possible now that I think about it, so the idea is bunked anyway.
Re:Unpatchable Malware That Infects USBs
by Someone1234 on Thursday October 02, 2014 @12:14PM
(#8401366)
I just have to add Sleep(60 minutes) to my fake HID device and it will bypass this. You cannot blackhole HID input for an hour.
Re:Unpatchable Malware That Infects USBs
by Nacraile on Thursday October 02, 2014 @12:23PM
(#8401440)
I'm not sure what that accomplishes. In order to provide input, the HID device must register itself with the OS, in order for the driver to be set up, etc. Sending HID messages without actually enumerating a HID device isn't going to work. Waiting 60 seconds to provide input doesn't change the fact that it has to tell the OS it can provide input in the first place. Yeah, it could wait 60 seconds to say "hey, a HID device just got plugged in", but that doesn't actually bypass the safety mechanism...
It can always tell the OS that it is a USB hub, so nothing precludes it from being seen as two USB devices (HID and storage)
Re:Unpatchable Malware That Infects USBs
by linuxlizard on Thursday October 02, 2014 @01:21PM
(#8401821)
Why not something like a USB Firewall?
Black/white list vid/pid (which are easily faked, yes). Closes the door a small amount.
But can also blacklist all HID.
I think this should already be possible under linux via udev rules.
It just needs to be wrapped in a convenient tool.
Might be worth it to at least extend the time span that an attacker would need if he had physical access to your laptop/smartphone.
Re:Unpatchable Malware That Infects USBs
by linuxlizard on Friday October 03, 2014 @12:22PM
(#8406174)
I smell a software product opportunity for OSX / Windows.
In the worst-case scenario, why not use connect/disconnect events themselves as a form of user input?
The only downside being that many users add a new HID as their only interface to the machine.