A fuzzy issue of responsible disclosure [LWN.net]

A fuzzy issue of responsible disclosure

Posted Aug 30, 2022 16:56 UTC (Tue) by fenncruz (subscriber, #81417)
In reply to: A fuzzy issue of responsible disclosure by anarcat
Parent article: A fuzzy issue of responsible disclosure

If your security depends on your users always doing everything right and never skipping any part of a 10 part checklist, they you've already lost and your system is compromised.

to post comments

A fuzzy issue of responsible disclosure

Posted Aug 30, 2022 21:53 UTC (Tue) by tytso (✭ supporter ✭, #9993) [Link] (12 responses)

If your security depends on your users always doing everything right and never skipping any part of a 10 part checklist, they you've already lost and your system is compromised.

Some 10-15 years ago I visited the Banco du Brasil, where they had the good taste to migrate the majority of their desktop. They also had the good sense to do a security upgrade of all of the USB ports on their desktops using epoxy. If you want to run a high security facility, such as in a major financial institution or a government secure facility, the only smart answer is "Just Say No". No complicated checklists are required; you just make it physically impossible for any of your users from using the USB ports.

A fuzzy issue of responsible disclosure

Posted Aug 31, 2022 10:38 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (11 responses)

The keyboards are typically USB these days. Ban keyboards as well?

A fuzzy issue of responsible disclosure

Posted Aug 31, 2022 13:39 UTC (Wed) by anton (subscriber, #25547) [Link] (10 responses)

If you take security seriously, buy hardware that accepts PS/2 keyboards, and use PS/2 keyboards and mice. No USB needed.

A fuzzy issue of responsible disclosure

Posted Sep 1, 2022 0:46 UTC (Thu) by pabs (subscriber, #43278) [Link] (4 responses)

Hmm, I wonder if anyone has fuzzed the PS/2 code in Linux.

A fuzzy issue of responsible disclosure

Posted Sep 1, 2022 13:24 UTC (Thu) by anton (subscriber, #25547) [Link]

PS/2 does not support mass storage devices, so an attack through a corrupt file system image is not possible through PS/2. Looking beyond the topic at hand, the attacker will have a harder time seducing a naive user to plug something into the PS/2 ports (which are used up by keyboard and mouse).

A fuzzy issue of responsible disclosure

Posted Sep 1, 2022 13:36 UTC (Thu) by anarcat (subscriber, #66354) [Link] (2 responses)

Blast from the past... Are there *any* computers still shipping with PS/2 ports nowadays? I haven't seen those in a while on new computers. Certainly not in any laptop for years, at least.

Also, PS/2, is that the thing that would fry your motherboard if you plugged (or unplugged? I forgot) it after boot? Seems like they fixed that at some point, but I guess it's pointless to fuzz a stack where "plugging it in" crashes the *hardware* in the first place...

A fuzzy issue of responsible disclosure

Posted Sep 1, 2022 19:47 UTC (Thu) by james (guest, #1325) [Link] (1 responses)

Laptops, no, but if you buy a separate motherboard for a desktop PC, it's likely to have PS/2. Apparently some gamers like it because USB involves polling, which implies the dreaded latency -- and it seems that mass-market motherboards are all aimed at gamers, judging by the prevalence of RGB headers and snazzy colour schemes.

I actually got a bit emotional this week, retiring a Proper Green board (Intel brand) for a black and white ASUS one. But both of them had PS/2 and VGA (which was also introduced with the PS/2).

A fuzzy issue of responsible disclosure

Posted Sep 2, 2022 13:19 UTC (Fri) by geert (subscriber, #98403) [Link]

Yeah, mass-market PCs seem to target only two user bases: light office work, or heavy gaming.
That's how I ended up with a large case with a window, and RGB LEDs lighting up the void around the PCIe slots. The DIMM slots are maxed out, though, which was the key factor dictating motherboard size.

Oh yes, it has a PS/2 keyboard/mouse combo port, but no VGA connector.

A fuzzy issue of responsible disclosure

Posted Sep 1, 2022 12:56 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

And a PS/2 mouse?

Epoxying USB ports looks like they're doing "something", but it only deters the really simplest attacks and shows the incompetence of the sysadmins.

Windows (which I assume they're using) supports USB port lockdown that can simply disables ports, and enables them for trusted devices only. It can also work in tandem with secure boot to prevent bootloader attacks.

A fuzzy issue of responsible disclosure

Posted Sep 2, 2022 7:46 UTC (Fri) by daenzer (subscriber, #7050) [Link]

> Windows (which I assume they're using) supports USB port lockdown that can simply disables ports, and enables them for trusted devices only.

FWIW, this is possible with Linux as well, e.g. using https://github.com/USBGuard/usbguard .

A fuzzy issue of responsible disclosure

Posted Sep 1, 2022 13:34 UTC (Thu) by mathstuf (subscriber, #69389) [Link] (2 responses)

You could epoxy the keyboard and mouse ports after they're plugged in too.

A fuzzy issue of responsible disclosure

Posted Sep 1, 2022 15:31 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

Why not turn the whole computer into a solid block of epoxy? Let's stop with half-measures.

A fuzzy issue of responsible disclosure

Posted Sep 1, 2022 16:23 UTC (Thu) by anton (subscriber, #25547) [Link]

What is the attack scenario this measure should help against?

One reason not to do that is that (cheap) keyboards fail relatively often. So if your attack scenario makes it necessary, use durable keyboards.