Massive, undetectable security flaw found in USB
http://www.extremetech.com/computing/187279-undetectable-indefensible- security-flaw-found-in-usb-its-time-to-get-your-ps2-keyboard-out-of-the-
cupboard
"This flaw, dubbed BadUSB by Security Research Labs in Berlin, leverages
the fact that every USB device has a controller chip. Whether it’s your
PC,
smartphone, external hard drive, or an audio breakout box, there’s a USB
controller chip in every device that controls the USB connection to
other devices. It turns out, according to SR Labs, that these
controllers have firmware that can be reprogrammed to do a whole host of
malicious things —
and, perhaps most importantly, this reprogramming is almost impossible
to detect."
I would like to raise two issues, one minor one major.
The minor one was that this was known to anyone who thought to look.
Perhaps we didn't know that you could just feed the device a faulty
firmware, but the idea that you could reprogram USB's was well known.
The major one is the alarm that *someone* may be trying to make matters
worse. The fact the feature-turned-flaw got a name with a non-trivial
capitalization is the first red flag. But the real proof of maliciousness
is in the proposal given by SR Labs about the way to "solve" the problem.
Their suggestion is cryptographic signing of the firmware which can only
possibly make the problem worse. As the things are today, you can compile
your own - known to be secure - firmware and upload it to the USB device,
thus solving the problem. If you don't have the know-how, you can pay a
consultant to do that for you. In other words, this is one of those lucky
few hardware problems that are solvable by the populace at large, with
zero effort (and zero money) required on the part of corporations.
Cryptographically signing the firmware, however, makes it impossible for
the people to solve the problem themselves, leaves the problem wide open
because to USB-peripheral-making corporation is going to spend money
fixing this (see addenum) and exposes everyone to NSA & friends which
will ofcouse have access to the secret keys one way or the other.
Addenum: USB peripherals that are important are cheap. Dime-a-dozen
cheap. That means the only way for a multinational to make a
notable profit is by making many of them. Which means any
problem (like this one) will be overwhelming. Additionally,
the only way to turn a profit when making these things is to
have a razor-thin margin. Which means the company has
insufficient reserves to deal with these problems.
Couple an overwhelming problem with barely any reserves for
solving it and you end up with no solution to speak of.
Addenum 2: the issue is actually detectable (with no extra equipment),
you just need to know what you are doing.
