Hacker News Reader

Comment by DaiPlusPlus | Hacker News Reader

This is something to worry about. USB hosts and devices identify themselves - malicious firmware embedded in the Xbox controller could check if it's connected to a real Xbox, compared to a Windows PC, or a submarine, and act (or misbehave) accordingly.

And what is the plan in 20-30 years' time when the submarines are still in action but the controllers stopped being made? I get the feeling we'll see Navy personnel bidding on "vintage" Xbox controller auctions on eBay the same way prices for original NES and Atari controllers are through the roof right now.

View on HN

> I get the feeling we'll see Navy personnel bidding on "vintage" Xbox controller auctions on eBay

Replace Ebay with flea market and this is how in the second half of 199x some spare parts for Soviet/Russian space station "Mir" (and for some other space projects, well into beginning of 200x) were procured. With USSR falling and economy tanking/changing/"privatized in all senses and at all scales" many typical sources for space parts just disappeared and/or stopped working.

USB hosts do not identify themselves to devices.

How does my iPhone know which PC I've plugged it into then? Even when iTunes isn't installed (so no "Apple Mobile Device" drivers) it seems to remember my privacy preferences on a per-host basis.

I'll concede that may be a feature of the allocation protocol running on top of USB (PictBridge?) but that still means that mutual identification over USB is still possible. I'm pretty sure it's in the USB HID spec that the Xbox controllers implement.

Make the periscope report to the controller that it's an Xbox.

Then you would just have to write the malware in such a way that it works fine on legitimate hardware but exploits a glitch that exists only on the military hardware. Maybe based on MS drivers VS Linux drivers (or whatever OS the navy uses).

simply install "an USB firewall" into the periscope controller (not the xbox, but the usb host).

but my thought exacty: put a prepared controller to "game room" (sure there is such a thing on a nuclear sub). sabotage controllers. wait until one in "game room" gets plugged into periscope. Profit.

Reply on news.ycombinator.com