Hacker News Reader

Comment by nly | Hacker News Reader

What are the fundamental flaws in the USB protocol that make it insecure? I know firewire allows for DMA, but I didn't think USB, besides being a complex serial protocol, had any intrinsically unsafe features?

View on HN

-firmware errors

-lack of authentication

-stack errors (root on PS2 at one point)

-physical silicon bugs ( I have a broken mouse that WILL make any windows computer act funny/crash apps/crash whole Intel usb hub)

It's not the protocol but the fact that USB devices are just too trusting. Plug your phone into a USB socket and you've little protection against it communicating with whoever is on the other end of the USB connection.

Is this not why my phone asks me what I want to do when I plug it into the computer? USB debugging mode, charge only, and another option or two that I can't remember right now. If I select "charge only" will I be secure in the same way?

Unfortunately, this isn't universal.

This really varies from phone to phone, sadly. When I plug mine in I am only given a choice of which protocol to use to give the host computer access to all my files (and it connects using the default one as soon as you plug it in).

There's not a fundamental flaw with the USB protocol per se.

It's more about USB being implicitly trusted by the software/OS - in addition to that there's driver bugs to be exploited. Here's a few fun things you can do https://www.youtube.com/watch?v=x-7ezoFju6I

It's the fact that you're using the same cable to charge and for data (which is also one of the things that makes USB really useful), now add that the devices tend to not to be hugely secure and to just trust whatever they've plugged into (or at least trust after popping up an easy to miss dialog) and you have a (potential) problem.

Do a search for "Facedancer". The USB hardware can be attacked as well as the host operating system over the USB interface. All of the same kinds of bounds-checking and parsing errors that can happen in the network stack can also happen in device drivers.

It's not a pure USB risk. That plug on a phone can usually do a whole swath of protocols including serial consoles and they're probably not secured.

Reply on news.ycombinator.com