Hacker News Reader

Comment by extension | Hacker News Reader

My laptop has a built-in keyboard and trackpad, so why doesn't it just ask my permission to use any USB device I plug in? I don't know if there's a way to uniquely fingerprint a USB device, but if there is then I could tell the OS to always trust particular devices to make it more convenient.

View on HN

Why would it ask? If you didn't want the computer to access the drive, then why did you plug it in? The mere act of plugging in a drive is a signal to the computer that you want the drive to be made available.

Note, however, that this is NOT a signal that you want the computer to start running arbitrary software on the drive.

And what if you've plugged in a USB keyboard at the same time as that drive?

And that USB keyboard has said "hey yes I want to run the software on this drive"?

And how does the USB Keyboard have the permission to go ahead and launch software on the user's behalf? It's precisely the same issue as autorun on a thumb drive.

This is assuming the hardware is as presents itself.

There are plenty of times in which what the computer is told to do (and consequently does, as is their wont) is not the same as what the user might WANT it to do. Compare the computer: "The user runs this program, the program tells me to wipe the hard drive, I wipe the hard drive", and the user: "I just downloaded Medal of Honor and I want to play it".

Another example: the computer: "The user entered 'rm -rf doc', I delete ./doc/", and the user: "I want to get rid of 'Documents/' for the 23rd time today and execute 'rm -rf doc<tab>'".

The discrepancy between "do what I say" and "do what I mean" is part of where security lives. In the above cases, that would be a virus scanner and your favourite *nix command line trash utility, respectively. Other examples can easily be imagined. Just because a user tells you to do something doesn't mean they want you to do it.

Each USB device has it's own unique ID, so yeah, it should be possible.

When you're dealing with a malicious attacker, you can't assume that they're playing by the rules.

All an attacker would have to do is find the ID of a device that you have used in the past.

If an attacker can get the USB ID of a device physically attached to your computer then he probably already has access to your computer.

Reply on news.ycombinator.com