Recent Features
| |||||||||||||
November: the month of kernel bugsNovember: the month of kernel bugsPosted Nov 16, 2006 9:53 UTC (Thu) by addw (guest, #1771)Parent article: November: the month of kernel bugs but users are hopefully savvy enough to be wary of mounting them if they do not know where they came from. Just find someone who is busy enough and present them with a USB memory stick and they will probably just plug it in. It happens, the vulnerability should not be there.
(Log in to post comments)
And why not read the media? Posted Nov 16, 2006 10:09 UTC (Thu) by eru (subscriber, #2753) [Link] Just find someone who is busy enough and present them with a USB memory stick and they will probably just plug it in. It happens, the vulnerability should not be there.Wasn't there a fairly recent report of an experiment by some security researchers who just left USB sticks lying on the street? A surprising number of people picked them up and plugged into their computers out of curiosity. In a sense this is not at all unreasonable behavour. People think USB is just a piece of media, like a CD record, or simply a leaflet. The idea that merely reading it causes bad things to happen is counterintuitive. I would argue that any system where you cannot safely insert a medium and mount it is seriously broken.
And why not read the media? Posted Nov 16, 2006 16:59 UTC (Thu) by ghelmling (guest, #4140) [Link] There was also the recent case of iPods infected with Windows virii by the manufacturer.
If you can compromise the point of origin for consumer devices, then you do have a potentially very large distribution network.
Of course, it would still probably be far more profitable to focus on Windows exploits than Linux exploits, given the relative size of the target audience, but the same principle applies. I agree that not being able to safely mount media is a serious problem.
And why not read the media? Posted Nov 16, 2006 20:08 UTC (Thu) by k8to (subscriber, #15413) [Link] Apologies in advance for my anal retentivity.
The word is viruses.
And why not read the media? Posted Nov 29, 2006 13:57 UTC (Wed) by rwmj (subscriber, #5474) [Link] Actually if the iPods were infected deliberately by a program that required the user to run, or ran automatically with an "autorun" mechanism, then the word would be 'trojan' or possibly 'worm' ...
Rich.
And why not read the media? Posted Nov 16, 2006 21:11 UTC (Thu) by ballombe (subscriber, #9523) [Link] If you plug an USB stick found on the street, a file systemvulnerability is the least of your worry. The USB stick can be a device with whatever hidden functionality (exploding when first plugged, transmit any bit passing throught via wifi to an attacker, etc.).
And why not read the media? Posted Nov 17, 2006 8:54 UTC (Fri) by eru (subscriber, #2753) [Link] The USB stick can be a device with whatever hidden functionality (exploding when first plugged, transmit any bit passing throught via wifi to an attacker, etc.).A good point. It actually applies to any modern solid-state media, like the various kinds of memory cards used in cameras and such, because they too are active (the system feeds elecricity in them that can run a processor etc.). So is the only kind of safe media the passive ones like tapes, diskettes and CD:s that spin in the drive and are read magnetically or optically? (And even these are not safe if file system code is buggy).
|
|||||||||||||