Home page logo

oss-sec logo oss-sec mailing list archives

Re: Malicious devices & vulnerabilties
From: Hanno Böck <hanno () hboeck de>
Date: Sun, 8 Jan 2012 22:08:18 +0100

Am Sun, 8 Jan 2012 09:07:25 -0800
schrieb Greg KH <greg () kroah com>:

They should be considered buggy, yes, and as such, the kernel
developers will fix any reported problems (or we should, if not,
please let me know.)

But note, as these almost always fall under the "you have physical
access" category, their security impact is generally considered low.

As far as publicly known, it's likely that Stuxnet was originally
spread via a security problem with USB.

Also, I'd doubt the "physical access" category. It may just require a
bit of social engineering ("I have the file you requested on this usb

Considering that I'd strongly disagree classifying such issues "low

At least for pluggable devices, I'd consider such issues rather
serious. It's another thing with PCI or other devices that require
significant work to attach to a piece of hardware.

Hanno Böck              mail/jabber: hanno () hboeck de
GPG: BBB51E42           http://www.hboeck.de/

Attachment: signature.asc

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]