Posted on 07/06/2010 3:36:38 PM PDT by oc-flyfish
Wonderful, just one more way for our benevolent federal government to spy on us.
fyi
Hey, I just sent in my donation to FR. You should do the same thing too!
And what do we get if we donate? A FR cap?
I know an It guy (really great) who cleans my puter every so often.
He said I had some really bad stuff on it this time.
Do you know anything about a trojan called BHO-AM? I get hit every morning around 4:30.
It is really PMO.
I wonder if this is unique to Windows systems...the article doesn’t say.
The ability to keep FR online for another 3 months. :-)
The article does not say. I think it would work across systems but the trojan would have to be written to “understand” the system calls used by a Mac, versus Linux, versus Windows.
Gee, I have the same BHO one as well! I hear it self destructs in 2012.
OK!:)
I cleaned my USB drive, but after I got it out of the dryer, it no longer worked.
>>Let’s no forget Red China.
Hey, I know... let’s outsource the manufacturing of vlsi chips critical to economic and military industrial infrastructures to our “former” enemies and current competitors. What could possibly go wrong?
"The ability to keep FR online for another 3 months. :-)"
...and quite possibly........
Bah.
no, the knowledge you're no longer a freeloader...
From the penultimate (and it should have been a lot closer to the front of the paper) page:
3.4.1. Observability. Someone with direct observation of compromise a network endpoint, without attempting access the network endpoint would be able to notice the uploading through the network. of applications, as the text entered by the Hardware Trojan Horse device would appear on the display as text being entered by the keyboard. A user at the network endpoint could also disrupt the uploading of the applications because any characters entered on the legitimate keyboard would be passed to the file containing the uploaded application.
I skimmed the paper, and I believe that a short summary is that a USB keyboard can be programmed to capture keystrokes and also can be setup to automatically type commands that can lead to compromise of data stored the system.
(There's a whole elaborate bit about using audio and keyboard LEDs that I fail to see much use for, but I didn't spend a great deal of time with this paper since the overall attack doesn't seem very covert.)
Most USB keyloggers out there already use the HID of a keyboard, been doing that for years. What’s new here?
Jeez, that’s pretty serious, particularly since usb drives are so small - you’d have to carefully inspect the back-end of any computer you used that other people have had access to, like your computer at work, for instance.
It's not just USB keyboards, it's any USB device:
Because the USB protocol relies on devices to properly identify themselves during enumeration, a USB Meta-Device could be programmed to identify itself as any USB device [9]. In this way, the USB Meta-Device could be configured to represent itself as a device associated with a vulnerable driver loaded on the network endpoint.
This is what happens when dumb devices get smart enough to be convenient. These days, the toaster wants its own static IP.
Not to worry, we'll soon be able to upgrade to the New Improved USB 4.0, Now With Fewer Unintended Channels!
Bah.
like using the cd caddie as a cup holder
What??? You mean the cup holder is supposed to be used for CDs??? Ya learn something new every day.
Did you see anywhere in the paper where that subversion of USB identification is suggested for anything else useful? I didn't, although I haven't read it closely.
Funny, mine survived the dryer.
yep makes a great cup holder.dont make em like they used to snap real easy have to buy new sometimes
It keeps a guy from rolling out of bed and falling onto the floor. Look at it as a blessing.
It keeps us guys from rolling out of bed and falling onto the floor. Look at it as a blessing.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.