I don't know... I can replace the batteries in my $5 calculator every year, or I can have a solar cell in my $5 calculator and never replace the batteries, because there aren't any. That's just one practical application where they're quite economical; there are many others, but I'm not up to the task of wasting my time doing your research for you, so you can seek them out yourself if you're interested.
It's not a derivative work, though; at the very least the mold they made of the disc is a direct (even if inverse) copy that can be used to make other direct (and not inverse) copies.
Okay, now that I got my somehow-relevant first post...
This is a really cool development and I hope they have very-near-future plans to develop this further and commercialize it. Every little bit of efficiency we can squeeze out of solar cells makes them practical for a wider variety of uses.
To both you and the poster directly before you, I say this:
If I just say "viruses", some dumb chump chimes in to tell me it's "virii". In attempting to avoid that exchange, it seems I've brought the attention of two even dumber chumps.
That is true, the closest thing I have to a manager at my current job (the CEO of the company) can't code worth shit and gets viruses (virii?) all the damn time.
No. Just no. You see, I don't care if someone else has intolerant thoughts or opinions, and neither should you; after all, who the hell am I (and who the hell are you) to judge what's in someone's head, when only they know how it got there? So let them vocalize, let them write, let them scream. You don't have to listen to it and you don't have to read it. We have laws for a reason and, if someone's intolerance reaches a level that causes them to violate one or more of those laws, well, that's what the laws are there for. Likewise, there is a reason we don't have laws against holding certain thoughts and opinions, and why free speech is not only not deemed illegal, but an integral part of the US Constitution. If you live elsewhere, of course, that does not apply, but you should still be able to see my point.
And no, you've got that logically backwards: saying it's hypocritical not to eat people just because you eat potatoes is like saying it's hypocritical not to tolerate murder just because you tolerate speeding. Intolerance is a negative, tolerance is a positive; take (and pass) a logic 101 course and you'll learn why that matters.
It's extremely brilliant, actually. It's useful to have your employees be able to follow the workflow for as many aspects of your company as possible, which often means getting them to work in as many departments as possible. How do you get someone to willingly move from engineering to accounting? A promotion, of course!
The point is that this shows the depth of what can be done given the current implementation and spec design short-comings
Except that these aren't shortcomings of the spec and, in fact, are never presented as such by Nohl and Lell. Quite the opposite, it is stated in their presentation that you (as a user) want these design features, the ability for a device to be multiple things (e.g. a video and audio device, a-la a webcam) and the ability for a device that can't talk to its driver to reattach itself to the bus as a CD-ROM drive to provide the driver. They referred to these as features, not flaws, and very clearly placed the blame on the devices, stating that the fix is to make the devices themselves not reprogrammable. I'm not arguing these points, as Nohl and Lell have already done so.
I think we've addressed everything else, so I'll clarify this one: the reference to DMA was to FireWire et al security issues
I was actually referring to you saying the following:
There is a DMA component, a quick search reveals they haven't fixed that either yet. Bah.
And, in any case, the OS providing virtualized DMA for Firewire (and it is an OS feature, though I'd genuinely love to be wrong about that, so please point me to a source that says I am) does nothing to stop a Firewire device from injecting a rootkit into RAM during the boot process. Virtualized DMA is also no longer Direct, nor is it as fast, so it's really not an ideal solution. Firewire keyboards also exist (the PowerBook Pismo's keyboard was connected via Firewire), as do Firewire webcams (e.g. a Firewire device that's actually two devices), and you can get Firewire ethernet controllers. What that means is that, from a technical standpoint, the only thing I can't confirm without testing devices directly is whether or not I'd be able to find a Firewire device I could reprogram to do exactly what Nohl and Lell did with USB. If one can be found that can be reprogrammed, one can be found to host something akin to BadUSB; let's call it BadWire.
And, that says nothing of Thunderbolt, which many people use for permanently-connected displays and drives. That also uses DMA (in fact, it exposes one or more PCI-Express lanes, depending on which revision of the spec is implemented). A Thunderbolt controller could emulate a flash drive, ethernet controller, and a USB controller with a keyboard attached, and do these very same things. And I think you've missed that, for any of these attacks (via USB, Firewire, or Thunderbolt), an infected device need not be the initial route of infection; that could, instead, be the method of persistence (and re-infection), which negates your argument regarding the Firewire devices you use being more or less permanent.
Of course, that assumes, as Nohl and Lell said, "that [the] devices can be reprogrammed", which, really, is the crux of the attack.
As an aside, you can flash the firmware of a hard disk or SDD via SATA, as well, while the system is booted and operational; while it can't act as a keyboard, it can store a rootkit. And the attack principle is the same: modify the device's firmware.
All of that said, yes, I think we did both learn things here.
Cox ain't half bad in Ohio, where available. From the sound of things, I should be glad we have Comcast (as much as I have them) in Walnut Creek, though; I haven't heard anything good about Astound, either.
They built our network for us, using our tax dollars, and our parents', and our grandparents'. They're only able to claim it as their own because there aren't enough of us who both know that fact and care enough to do anything about it to actually accomplish the task of reclaiming it from them. They should have to lease space on it from the public, just like any other provider wishing to use it.
No, those are both very good sources for information on the problem SRLabs discovered. In fact, I referenced their presentation (one of the links on Bruces post that I suggested you review). Your understanding if the issue at hand is still way off, which is why I referred you to the USB spec, so you can educate yourself. The only way in which a BadUSB "infection" can persist on a host is if that "infection" modifies files on the host, just as with any other infection. It's persistent on the affected USB device, and there's no way to tell if a device is affected by the issue (well, there is, I've mentioned it, but we'll assume you didn't identify the affected device prior to wiping the system it was connected to), which acts as an avenue for continued attack, or re-modification of the same files on the host even after the host has been cleaned up. That's not host persistence through any special means unique to BadUSB; host persistence, again, come from files being modified on the host, as with any persistent infection, while the device remains affected by the issue in order to repeat its attack should the host be cleaned up at a later date. That means the following is incorrect
there is no persistence nor propagation of the threat once the bad hardware has been removed, unlike with the USB
as it implies that the threat necessarily persists after the hardware is removed. This is only the case is the modified firmware on the USB device (again, this is a flaw in the device, and not all devices allow their firmware to be rewritten) modifies files on the host to make it so.
nor does DMA allow for BIOS/EFI corruption
I haven't seen where BadUSB does, either, but I may be wrong about this. Can I get a direct quote, since it's clearly eluding my eyes? It would be most appreciated. (nay, I have indeed found the quote and will discuss it below)
This line, from the BadUSB homepage (linked from your post) would seem to support your claim of host persistence:
To make matters worse, cleanup after an incident is hard: Simply reinstalling the operating system – the standard response to otherwise ineradicable malware – does not address BadUSB infections at their root.
However, when you read the rest of the paragraph, Nohl and Lell go on to elaborate that this is because:
The USB thumb drive, from which the operating system is reinstalled, may already be infected, as may the hardwired webcam or other USB components inside the computer.
Ah, and there it is, actually, I do see a quote for the claim I questioned just a few lines above:
A BadUSB device may even have replaced the computer’s BIOS – again by emulating a keyboard and unlocking a hidden file on the USB thumb drive.
However, given the understanding of how a BIOS of EFI image would be replaced (this isn't something that can generally be done while a system is booted into an OS; on systems where this is possible, that is a flaw in the BIOS/EFI and not in USB), it becomes clear why keyboard emulation is required; the device would have to emulate a keyboard during boot and send the correct key sequence to enter the BIOS/EFI flash utility, then flash a correct BIOS or EFI image, lest the system fail to boot afterward. Either, or both, of us could be wrong on this point, and we won't know until they release further details, but I'm basing my position on knowledge built over nearly 3 decades of experience, and having read and understood the specifications for the technologies involved.
It bears repeating that a BIOS or EFI that can be written from within a live OS is, itself, flawed, and that is not a flaw in USB. To clarify, on such systems (for example, a Sony VAIO laptop I own, which uses a Windows-based utility for BIOS updates*[1]), malicious software running within the OS can rewrite the BIOS or EFI. That includes a binary stored in "a hidden file on
Really, familiarize yourself with the USB spec, then apply that knowledge to what you already know of the security vulnerabilities discussed in the articles we've both linked to. For the record, Wired isn't exactly a first-class source.
in fact, several attack vectors occur before the OS is even in play
In fact, only one theoretical attack, based on a host controller violating the USB spec, occurs before the OS is in play (for purpose of a USB keyboard, the BIOS or EFI is the OS). This was discussed earlier in this very post and it is not BadUSB.
Finally, most systems will enable the keyboard USB device, so any claims of the original device not being supported are moot, since it can spoof itself as anything at any time, including the keyboard.
Wow! Now that is BadUSB! And if it spoofs a keyboard, it can do anything a keyboard can do. Nothing more. You can do some pretty awful things with a keyboard (as you've shown), but nothing on the level you're freaking out about. Spoofing a network adapter and sniffing and logging network traffic (think 3TB external drive with a reprogrammed controller, plenty of potential storage space) is a much more effective means of attack, also possible via BadUSB. But, again, it requires cooperation from the host and the network interface would be a listed device. You could sniff bus traffic, as well, I suppose, but at that point, why not just spoof a device whose driver implements DMA and rifle through RAM looking for the data you're after?
So I say that your claim,
A USB device without a driver does nothing. Period.
is wholly incorrect in context of BadUSB.
Actually, it's wholly incorrect in the context of reprogramming a host controller that violates the USB spec, or a device that sniffs bus traffic between insertion and timeout. It's spot on in the context of BadUSB.
I suggest you shed some of that hubris you're carrying around, apparently it is interfering with your reading comprehension.
Unless I'm misinterpreting this:
Their central finding is that USB firmware, which exists in varying forms in all USB devices, can be reprogrammed to hide attack code.
you, sir, are wrong. That's what BadUSB is, reprogramming a device to behave as another device. Nothing more. Does it enable a variety of attack vectors that were previously impractical? Yes. But it doesn't do so entirely silently. I suggest you familiarize yourself with the USB spec to further your understanding on this matter.
The controller on the host can still be reprogrammed, for instance
In theory. In practice, it is the controllers on the devices that are being left in a programmable state; host controllers conforming to the spec aren't programmable from the USB bus, so a system susceptible to such an attack would be so in spite of the USB spec, not as a result of it. This is not BadUSB.
and the bus communications can be sniffed
Yes, as with any serial bus. However, the spec allows for shutting down ports with no recognized device connected, so the device would have to be recognized, or the host controller not compliant with the spec, for this attack to work. This is not BadUSB.
Nothing anywhere states that these are only done once the OS finally recognizes the device
Indeed, a device can come up on the bus and sniff traffic until the host shuts it down after a timeout. It'll take a few removals and reinsertions to get the data your after, having to sniff in 500ms increments. Theoretically, this could work, but it's not practical as it requires an immense amount of cooperation from your victim; though, retrieval of the sniffed data would be as simple as picking the device out of their trash when they throw it away, thinking it's broken. Also, this is not BadUSB.
Slashdot doesn't like posts with too many quote blocks in them, so I have to break up this reply.
I reviewed them more carefully. I get the following: if the USB bus is active and in use, at least some of the attack vectors work.
BadUSB, by name, is a specific attack that requires cooperation of the host.
Perhaps part of the miscommunication is that BadUSB isn't just 1 attack, but many different potential ones. I wrap them all up (perhaps incorrectly for this discussion) as a single attack vector.
And there's our problem, yes. Perhaps, now that we've identified that, it's worth continuing this conversation.
While being a supported device certainly expands the range of attack possibilities, being unsupported by no means eliminates the threat.
But it does eliminate the threat we're discussing here.
Financing a group isn't intolerance, it's quite the opposite, you're showing tolerance and acceptance of that group. Financing a group that promotes intolerance may be an intolerant action toward who- or what- ever that group is intolerant of, and that may be rightly actionable. In general, I think I agree with the point you were attempting to make, but I can't be sure as you didn't really succeed in making that point.
There is no need to be tolerant of the views of murderous dictators, rabid extremists, or any other group which opposes freedom and tolerance.
Their views, actually, yes; their actions, no. There's no need to adopt their views, yourself, but by what course of action do you make your intolerance known? Are you any better than them for taking that action? Their views are hurting nobody. But go ahead and stand up against their actions, I think we can both agree that is only right.
Victims should just stand there quietly and let the bully beat them up, otherwise they're just as bad, dammit!
Really? That's what you got out of my post? You just go looking for fights, don't you? There's a far cry from intolerance, which is an opinion, and beating someone up, which is an action. Getting up and leaving the room, and peacefully protesting are also actions which arise from intolerance. I have the right to do both of those and I'd love to see you stop me from doing either.
There is nothing hypocritical of being intolerant of intolerance. Rejecting someone else's claim to authority over how you live is not the same as claiming authority over them.
It's amusing that you conflate authority with intolerance while, at the same time, implying that those are the only two things one should not simply tolerate. Someone smoking a cigarette in the same room as me isn't being intolerant of me, nor are they enforcing any authority over me; are you saying that makes it wrong for me to be intolerant of their actions? I should just sit there and deal with it? Nope, I'm intolerant of smokers (in general, though I have a few friends who smoke around me, but only after asking it it's okay, and only outside) and I'll ask them to snuff it or I'll leave the room.
You see, "tolerance" is simply a shorthand for a vision of the world where people are free to live as they will, while intolerance is ultimately about excersizing power over them.
No. I'm not going to argue your incorrect definition of tolerance as it's suitable in this context; however, intolerance is just what the word says, the inability to tolerate something. For example, I'm intolerant of ignorant posts like the one I'm currently replying to; as a result, I attempt to correct the ignorance. I'm not telling you you have to believe what I believe, but I would like to point out that what you say in the first line of your post applies here; twisting the words I wrote in an attempt to make them into something more sinister yo either force me to reply to defend myself or accept looking like an asshole is a bully tactic. It's also a dick move and I'm intolerant of actions that fall under either of those classifications, regardless of the opinions those actions stem from.
In other words, tolerance is about liberty and intolerance is about authoritarianism.
No, intolerance is about acceptance and intolerance is, well, the opposite. There are intolerant opinions and intolerant speech, which everyone should have the right to (in the US, that's the First Amendment to the Constitution); after all, the only other way to find out your coworker is violently intolerant of people who wear red shirts is when he's bashing your skull in for wearing one. Which, of course, would be an intolerant action; and a violent one, at that. I wouldn't step in to stop it because it's intolerant, but that doesn't mean I wouldn't step in to stop it; a violent act is still a violent act.
And no amount of rhetoric bullshit is going to put those fighting for tyranny and those fighting against it on even moral footing.
Finally, something we agree on!
So basically, it's okay for a homophobe to use whatever power is in his disposal to harm other people based on his beliefs
No. It's okay for them to hold their own opinion, though. Hell, it's okay for them to voice their opinion. Imagine a world where it wasn't okay to hold or voice unpopular opinions; are you sure you wouldn't run afoul of those in power? I'd imagine you'd be put to death in short order in such a society.
but it's not okay for his victims or their allies to fight back?
Got-damn you're dense. Since when is holding an opinion an attack on someone? And where did I say violence and authoritarianism were tolerable? Go right ahead and be intolerant of whatever you
Actually, no. See, people have the right to be intolerant, and begrudging them that right is, plain and simple, as bigoted as denying any other right for any other reason. That, of course, is on top of being entirely hypocritical, being intolerant of intolerance, and such. You don't have to agree with someone else's opinion in order to allow them to have it.
You're welcome to hang on to your logical fallacy, though. Have fun with it.
Have you reviewed the two links Bruce added to his post on the issue? I suggest you do. The attack works by a USB device being reprogrammed to behave as a different device; logically, that would require that the host system recognize it as that device. A USB device without a driver does nothing. Period.
running multiple connections on a single bus drop performance way way down
Not nearly to the levels you claimed. I have not disputed that there is a performance impact; in fact, I discussed that in one of my posts.
USB can be compromised with merely plugging in an infected USB device.
It cannot. You need to actually read up on BadUSB. I've pointed you to a few references, and you've pointed out a few, yourself, that you've clearly not read, or at least not understood. It's either willful ignorance, you not being willing to adming you might be wrong and go back and actually read, or you simply are incapable of understanding the subject matter. In either case, there is no point arguing with you about it.
Because I keep moving back to these points...
each of which I have acknowledged and addressed, repeatedly.
BTW, I did learn that Macs since 2012 are no longer subject to the DMA attacks.
Yes, by way of disabling DMA for the Firewire bus. In short, any device that relies on it does not work on a Mac never than 2012, or works with reduced performance. For example, the LaCie Firewire drive that's been around my workplace for a few years now, consistently sees read speeds of 90MB/s and write speeds of 60MB/s on the 2010 and 2011 Macs in the office, because it is able to make use of DMA during transfers. On the 2013 Mac used by our designer, it struggles to keep up 40MB/s in either direction. Our designer ended up switching to a USB3 drive that's capable of sustaining over 100MB/s reads and 90MB/s writes.
Notice how I'm now only pointing out flaws in your arguments, and no longer arguing the points. That is because I have said what I needed to say and provided references where applicable, and you have shown that you are not capable of following the conversation, as you think I've gone off topic when I most certainly have not.
Slashdot Mirror
I don't know... I can replace the batteries in my $5 calculator every year, or I can have a solar cell in my $5 calculator and never replace the batteries, because there aren't any. That's just one practical application where they're quite economical; there are many others, but I'm not up to the task of wasting my time doing your research for you, so you can seek them out yourself if you're interested.
It's not a derivative work, though; at the very least the mold they made of the disc is a direct (even if inverse) copy that can be used to make other direct (and not inverse) copies.
Okay, now that I got my somehow-relevant first post...
This is a really cool development and I hope they have very-near-future plans to develop this further and commercialize it. Every little bit of efficiency we can squeeze out of solar cells makes them practical for a wider variety of uses.
Cue copyright infringement suit in 3..2..1...
To both you and the poster directly before you, I say this:
If I just say "viruses", some dumb chump chimes in to tell me it's "virii". In attempting to avoid that exchange, it seems I've brought the attention of two even dumber chumps.
That is true, the closest thing I have to a manager at my current job (the CEO of the company) can't code worth shit and gets viruses (virii?) all the damn time.
Interesting, indeed. And a positive outcome, karma at work.
No. Just no. You see, I don't care if someone else has intolerant thoughts or opinions, and neither should you; after all, who the hell am I (and who the hell are you) to judge what's in someone's head, when only they know how it got there? So let them vocalize, let them write, let them scream. You don't have to listen to it and you don't have to read it. We have laws for a reason and, if someone's intolerance reaches a level that causes them to violate one or more of those laws, well, that's what the laws are there for. Likewise, there is a reason we don't have laws against holding certain thoughts and opinions, and why free speech is not only not deemed illegal, but an integral part of the US Constitution. If you live elsewhere, of course, that does not apply, but you should still be able to see my point.
And no, you've got that logically backwards: saying it's hypocritical not to eat people just because you eat potatoes is like saying it's hypocritical not to tolerate murder just because you tolerate speeding. Intolerance is a negative, tolerance is a positive; take (and pass) a logic 101 course and you'll learn why that matters.
Ah, the Wounded Gazelle Gambit, aka playing a victim.
Wherein did I claim to be victimized by anything? And that's where I stopped reading your post.
It's extremely brilliant, actually. It's useful to have your employees be able to follow the workflow for as many aspects of your company as possible, which often means getting them to work in as many departments as possible. How do you get someone to willingly move from engineering to accounting? A promotion, of course!
The point is that this shows the depth of what can be done given the current implementation and spec design short-comings
Except that these aren't shortcomings of the spec and, in fact, are never presented as such by Nohl and Lell. Quite the opposite, it is stated in their presentation that you (as a user) want these design features, the ability for a device to be multiple things (e.g. a video and audio device, a-la a webcam) and the ability for a device that can't talk to its driver to reattach itself to the bus as a CD-ROM drive to provide the driver. They referred to these as features, not flaws, and very clearly placed the blame on the devices, stating that the fix is to make the devices themselves not reprogrammable. I'm not arguing these points, as Nohl and Lell have already done so.
I think we've addressed everything else, so I'll clarify this one: the reference to DMA was to FireWire et al security issues
I was actually referring to you saying the following:
There is a DMA component, a quick search reveals they haven't fixed that either yet. Bah.
And, in any case, the OS providing virtualized DMA for Firewire (and it is an OS feature, though I'd genuinely love to be wrong about that, so please point me to a source that says I am) does nothing to stop a Firewire device from injecting a rootkit into RAM during the boot process. Virtualized DMA is also no longer Direct, nor is it as fast, so it's really not an ideal solution. Firewire keyboards also exist (the PowerBook Pismo's keyboard was connected via Firewire), as do Firewire webcams (e.g. a Firewire device that's actually two devices), and you can get Firewire ethernet controllers. What that means is that, from a technical standpoint, the only thing I can't confirm without testing devices directly is whether or not I'd be able to find a Firewire device I could reprogram to do exactly what Nohl and Lell did with USB. If one can be found that can be reprogrammed, one can be found to host something akin to BadUSB; let's call it BadWire.
And, that says nothing of Thunderbolt, which many people use for permanently-connected displays and drives. That also uses DMA (in fact, it exposes one or more PCI-Express lanes, depending on which revision of the spec is implemented). A Thunderbolt controller could emulate a flash drive, ethernet controller, and a USB controller with a keyboard attached, and do these very same things. And I think you've missed that, for any of these attacks (via USB, Firewire, or Thunderbolt), an infected device need not be the initial route of infection; that could, instead, be the method of persistence (and re-infection), which negates your argument regarding the Firewire devices you use being more or less permanent.
Of course, that assumes, as Nohl and Lell said, "that [the] devices can be reprogrammed", which, really, is the crux of the attack.
As an aside, you can flash the firmware of a hard disk or SDD via SATA, as well, while the system is booted and operational; while it can't act as a keyboard, it can store a rootkit. And the attack principle is the same: modify the device's firmware.
All of that said, yes, I think we did both learn things here.
Cox ain't half bad in Ohio, where available. From the sound of things, I should be glad we have Comcast (as much as I have them) in Walnut Creek, though; I haven't heard anything good about Astound, either.
They built our network for us, using our tax dollars, and our parents', and our grandparents'. They're only able to claim it as their own because there aren't enough of us who both know that fact and care enough to do anything about it to actually accomplish the task of reclaiming it from them. They should have to lease space on it from the public, just like any other provider wishing to use it.
there is no persistence nor propagation of the threat once the bad hardware has been removed, unlike with the USB
as it implies that the threat necessarily persists after the hardware is removed. This is only the case is the modified firmware on the USB device (again, this is a flaw in the device, and not all devices allow their firmware to be rewritten) modifies files on the host to make it so.
nor does DMA allow for BIOS/EFI corruption
I haven't seen where BadUSB does, either, but I may be wrong about this. Can I get a direct quote, since it's clearly eluding my eyes? It would be most appreciated. (nay, I have indeed found the quote and will discuss it below)
This line, from the BadUSB homepage (linked from your post) would seem to support your claim of host persistence:
To make matters worse, cleanup after an incident is hard: Simply reinstalling the operating system – the standard response to otherwise ineradicable malware – does not address BadUSB infections at their root.
However, when you read the rest of the paragraph, Nohl and Lell go on to elaborate that this is because:
The USB thumb drive, from which the operating system is reinstalled, may already be infected, as may the hardwired webcam or other USB components inside the computer.
Ah, and there it is, actually, I do see a quote for the claim I questioned just a few lines above:
A BadUSB device may even have replaced the computer’s BIOS – again by emulating a keyboard and unlocking a hidden file on the USB thumb drive.
However, given the understanding of how a BIOS of EFI image would be replaced (this isn't something that can generally be done while a system is booted into an OS; on systems where this is possible, that is a flaw in the BIOS/EFI and not in USB), it becomes clear why keyboard emulation is required; the device would have to emulate a keyboard during boot and send the correct key sequence to enter the BIOS/EFI flash utility, then flash a correct BIOS or EFI image, lest the system fail to boot afterward. Either, or both, of us could be wrong on this point, and we won't know until they release further details, but I'm basing my position on knowledge built over nearly 3 decades of experience, and having read and understood the specifications for the technologies involved.
It bears repeating that a BIOS or EFI that can be written from within a live OS is, itself, flawed, and that is not a flaw in USB. To clarify, on such systems (for example, a Sony VAIO laptop I own, which uses a Windows-based utility for BIOS updates*[1]), malicious software running within the OS can rewrite the BIOS or EFI. That includes a binary stored in "a hidden file on
Really, familiarize yourself with the USB spec, then apply that knowledge to what you already know of the security vulnerabilities discussed in the articles we've both linked to. For the record, Wired isn't exactly a first-class source.
in fact, several attack vectors occur before the OS is even in play
In fact, only one theoretical attack, based on a host controller violating the USB spec, occurs before the OS is in play (for purpose of a USB keyboard, the BIOS or EFI is the OS). This was discussed earlier in this very post and it is not BadUSB.
Finally, most systems will enable the keyboard USB device, so any claims of the original device not being supported are moot, since it can spoof itself as anything at any time, including the keyboard.
Wow! Now that is BadUSB! And if it spoofs a keyboard, it can do anything a keyboard can do. Nothing more. You can do some pretty awful things with a keyboard (as you've shown), but nothing on the level you're freaking out about. Spoofing a network adapter and sniffing and logging network traffic (think 3TB external drive with a reprogrammed controller, plenty of potential storage space) is a much more effective means of attack, also possible via BadUSB. But, again, it requires cooperation from the host and the network interface would be a listed device. You could sniff bus traffic, as well, I suppose, but at that point, why not just spoof a device whose driver implements DMA and rifle through RAM looking for the data you're after?
So I say that your claim,
A USB device without a driver does nothing. Period.
is wholly incorrect in context of BadUSB.
Actually, it's wholly incorrect in the context of reprogramming a host controller that violates the USB spec, or a device that sniffs bus traffic between insertion and timeout. It's spot on in the context of BadUSB.
I suggest you shed some of that hubris you're carrying around, apparently it is interfering with your reading comprehension.
Unless I'm misinterpreting this:
Their central finding is that USB firmware, which exists in varying forms in all USB devices, can be reprogrammed to hide attack code.
you, sir, are wrong. That's what BadUSB is, reprogramming a device to behave as another device. Nothing more. Does it enable a variety of attack vectors that were previously impractical? Yes. But it doesn't do so entirely silently. I suggest you familiarize yourself with the USB spec to further your understanding on this matter.
The controller on the host can still be reprogrammed, for instance
In theory. In practice, it is the controllers on the devices that are being left in a programmable state; host controllers conforming to the spec aren't programmable from the USB bus, so a system susceptible to such an attack would be so in spite of the USB spec, not as a result of it. This is not BadUSB.
and the bus communications can be sniffed
Yes, as with any serial bus. However, the spec allows for shutting down ports with no recognized device connected, so the device would have to be recognized, or the host controller not compliant with the spec, for this attack to work. This is not BadUSB.
Nothing anywhere states that these are only done once the OS finally recognizes the device
Indeed, a device can come up on the bus and sniff traffic until the host shuts it down after a timeout. It'll take a few removals and reinsertions to get the data your after, having to sniff in 500ms increments. Theoretically, this could work, but it's not practical as it requires an immense amount of cooperation from your victim; though, retrieval of the sniffed data would be as simple as picking the device out of their trash when they throw it away, thinking it's broken. Also, this is not BadUSB.
I reviewed them more carefully. I get the following: if the USB bus is active and in use, at least some of the attack vectors work.
BadUSB, by name, is a specific attack that requires cooperation of the host.
Perhaps part of the miscommunication is that BadUSB isn't just 1 attack, but many different potential ones. I wrap them all up (perhaps incorrectly for this discussion) as a single attack vector.
And there's our problem, yes. Perhaps, now that we've identified that, it's worth continuing this conversation.
While being a supported device certainly expands the range of attack possibilities, being unsupported by no means eliminates the threat.
But it does eliminate the threat we're discussing here.
Financing a group isn't intolerance, it's quite the opposite, you're showing tolerance and acceptance of that group. Financing a group that promotes intolerance may be an intolerant action toward who- or what- ever that group is intolerant of, and that may be rightly actionable. In general, I think I agree with the point you were attempting to make, but I can't be sure as you didn't really succeed in making that point.
There is no need to be tolerant of the views of murderous dictators, rabid extremists, or any other group which opposes freedom and tolerance.
Their views, actually, yes; their actions, no. There's no need to adopt their views, yourself, but by what course of action do you make your intolerance known? Are you any better than them for taking that action? Their views are hurting nobody. But go ahead and stand up against their actions, I think we can both agree that is only right.
Victims should just stand there quietly and let the bully beat them up, otherwise they're just as bad, dammit!
Really? That's what you got out of my post? You just go looking for fights, don't you? There's a far cry from intolerance, which is an opinion, and beating someone up, which is an action. Getting up and leaving the room, and peacefully protesting are also actions which arise from intolerance. I have the right to do both of those and I'd love to see you stop me from doing either.
There is nothing hypocritical of being intolerant of intolerance. Rejecting someone else's claim to authority over how you live is not the same as claiming authority over them.
It's amusing that you conflate authority with intolerance while, at the same time, implying that those are the only two things one should not simply tolerate. Someone smoking a cigarette in the same room as me isn't being intolerant of me, nor are they enforcing any authority over me; are you saying that makes it wrong for me to be intolerant of their actions? I should just sit there and deal with it? Nope, I'm intolerant of smokers (in general, though I have a few friends who smoke around me, but only after asking it it's okay, and only outside) and I'll ask them to snuff it or I'll leave the room.
You see, "tolerance" is simply a shorthand for a vision of the world where people are free to live as they will, while intolerance is ultimately about excersizing power over them.
No. I'm not going to argue your incorrect definition of tolerance as it's suitable in this context; however, intolerance is just what the word says, the inability to tolerate something. For example, I'm intolerant of ignorant posts like the one I'm currently replying to; as a result, I attempt to correct the ignorance. I'm not telling you you have to believe what I believe, but I would like to point out that what you say in the first line of your post applies here; twisting the words I wrote in an attempt to make them into something more sinister yo either force me to reply to defend myself or accept looking like an asshole is a bully tactic. It's also a dick move and I'm intolerant of actions that fall under either of those classifications, regardless of the opinions those actions stem from.
In other words, tolerance is about liberty and intolerance is about authoritarianism.
No, intolerance is about acceptance and intolerance is, well, the opposite. There are intolerant opinions and intolerant speech, which everyone should have the right to (in the US, that's the First Amendment to the Constitution); after all, the only other way to find out your coworker is violently intolerant of people who wear red shirts is when he's bashing your skull in for wearing one. Which, of course, would be an intolerant action; and a violent one, at that. I wouldn't step in to stop it because it's intolerant, but that doesn't mean I wouldn't step in to stop it; a violent act is still a violent act.
And no amount of rhetoric bullshit is going to put those fighting for tyranny and those fighting against it on even moral footing.
Finally, something we agree on!
So basically, it's okay for a homophobe to use whatever power is in his disposal to harm other people based on his beliefs
No. It's okay for them to hold their own opinion, though. Hell, it's okay for them to voice their opinion. Imagine a world where it wasn't okay to hold or voice unpopular opinions; are you sure you wouldn't run afoul of those in power? I'd imagine you'd be put to death in short order in such a society.
but it's not okay for his victims or their allies to fight back?
Got-damn you're dense. Since when is holding an opinion an attack on someone? And where did I say violence and authoritarianism were tolerable? Go right ahead and be intolerant of whatever you
Actually, no. See, people have the right to be intolerant, and begrudging them that right is, plain and simple, as bigoted as denying any other right for any other reason. That, of course, is on top of being entirely hypocritical, being intolerant of intolerance, and such. You don't have to agree with someone else's opinion in order to allow them to have it.
You're welcome to hang on to your logical fallacy, though. Have fun with it.
Have you reviewed the two links Bruce added to his post on the issue? I suggest you do. The attack works by a USB device being reprogrammed to behave as a different device; logically, that would require that the host system recognize it as that device. A USB device without a driver does nothing. Period.
Typo... adming == admit
there were performance issues with the USB bus
Were. Moving on.
running multiple connections on a single bus drop performance way way down
Not nearly to the levels you claimed. I have not disputed that there is a performance impact; in fact, I discussed that in one of my posts.
USB can be compromised with merely plugging in an infected USB device.
It cannot. You need to actually read up on BadUSB. I've pointed you to a few references, and you've pointed out a few, yourself, that you've clearly not read, or at least not understood. It's either willful ignorance, you not being willing to adming you might be wrong and go back and actually read, or you simply are incapable of understanding the subject matter. In either case, there is no point arguing with you about it.
Because I keep moving back to these points...
each of which I have acknowledged and addressed, repeatedly.
BTW, I did learn that Macs since 2012 are no longer subject to the DMA attacks.
Yes, by way of disabling DMA for the Firewire bus. In short, any device that relies on it does not work on a Mac never than 2012, or works with reduced performance. For example, the LaCie Firewire drive that's been around my workplace for a few years now, consistently sees read speeds of 90MB/s and write speeds of 60MB/s on the 2010 and 2011 Macs in the office, because it is able to make use of DMA during transfers. On the 2013 Mac used by our designer, it struggles to keep up 40MB/s in either direction. Our designer ended up switching to a USB3 drive that's capable of sustaining over 100MB/s reads and 90MB/s writes.
Notice how I'm now only pointing out flaws in your arguments, and no longer arguing the points. That is because I have said what I needed to say and provided references where applicable, and you have shown that you are not capable of following the conversation, as you think I've gone off topic when I most certainly have not.