I found a used docking station for my Dell laptop. The price is very interesting and the docking station seems to be in perfect shape. But I'm somehow worried about potential security risks. After all, you could install some kind of keylogger in the station's firmware. Am I being paranoid here or is it possible in any way?
asked Aug 1, 2020 at 22:39
-
4Almost anything is possible (including what you propose), but the likelihood likely approaches zero.– multithr3at3dCommented Aug 2, 2020 at 1:36
-
3And you could by a keyboard with a keylogger. Or any hardware could have some undetectable backdoor or malware. Even your Dell laptop. Here's the question back to you, if the answer was "yes", how would that help you make a decision?– schroeder ♦Commented Aug 2, 2020 at 7:44
Add a comment
|
3 Answers
While I have never looked into the hardware aspect of things, I am assuming that some docking stations - if not most - actually behave as a USB hub, thus they should be able to carry out BadUSB attacks, among others. OTOH reprogramming the firmware may not be that easy. But you could add an implant rather try to reprogram the whole thing. Shouldn't be too hard for someone who is good at DIY electronics and capable of soldering wires.
If you can, unmount the casing and visually inspect the inside to see if it has been tampered with in a visible manner.
Supply chain attacks are not new, but they are often targeted toward high-value targets. The risk is real albeit remote. A much bigger risk is the fact that we own equipment that is often riddled with security vulnerabilities and unpatch-able because vendors are not interested in long-term support.
This is especially true for consumer equipment like routers or IOT devices. Vendors would rather sell you new stuff than fix their bugs.
To be blunt, your operating system very likely is the biggest keylogger you'll ever own and the component you should trust the less.
As for docking station, I would check the power supply to make sure that it will not damage my laptop.
As always: do a risk analysis.
What is the likelihood that that a docking station contains a keylogger? According to @multithr3at3d: it is almost zero. There are easier ways of distributing keyloggers than selling docking stations.
You might look at the vendor. Is it a reputable vendor (good shop, good rep on ebay, things like that) or is it a shady man dressed in a raincoat in a dark alley? I exaggerate a bit here, but you'll get the picture.
If you're really paranoid, you can log the traffic that goes to the outside world (the logged keystrokes must be collected, otherwise they are useless). Netflow should be sufficient and you should be able to identify all the sites that you communicate with.
But if you're that paranoid, you shouldn't even look at second hand stuff.
In general, yes it is possible. Even if it is not possible with firmware, they could attach a device inside to the same affect.
If you're in a critical position in your company, go with new products that will be supported by the vendor in the next few years at least.
Otherwise, if this is personal, you'll just have to live with what you can afford. The risk is very minimal.
It's a waste of effort for malicious actors to try to go after the public with a slow-moving schema like selling used docking station when they could target corporate and make much more money much faster.
Bonus read:
Even with your best effort, you may not know what you have. There was a recent news about fake Cisco routers that has been sold by Cisco partners to US government.
https://www.zdnet.com/article/cisco-partners-sell-fake-routers-to-us-military/
F-Secure thinks they are harmless though (i.e regular counterfeit case) based on their review for one of their clients. Who knows?
