5

This question is based off of a TempleOS question here on Super User. The gist is that PS/2 support seems to be disabled from many modern BIOS’es due to a possible security flaw in the protocol. Specifically from this section on the TempleOS site explaining “Why Not More?”:

I don't stand a chance working on native hardware, anymore. I could install and run natively on hardware from about 2005-2010. It requires BIOS's being nice enough to write USB mode PS/2 legacy keyboard/mouse support. As it turns-out, sometimes the BIOS has PS/2 drivers but purposely disables them, just to be mean. The CIA and whole industry is trying to mess everything up, on purpose. Perhaps, at a point of sale in a store, a thief could hack a credit card machine. Therefore, the BIOS companies actually want it difficult to make drivers and purposely make it broken.

This seems confusing to me. The casual claim here is that PS/2 protocol is somehow weaker and more prone to—what I believe would be—man in the middle attacks on a hardware level on point of sale devices. But is that really the case with PS/2 protocol? Isn’t it the case that USB protocols are actually more risky for point of sale devices because of USB’s inherent flexibility?

Can anyone provide solid info on how/why PS/2 might be less—or more—risky to data leakage on a device level?

Improve this question
7
  • 1
    Any security aspects would not be about the PS/2 protocol itself but rather about the need to run emulation code at a protection layer beneath the the operating system kernel. The existence of that layer is the real issue. But I cannot answer whether disabling PS/2 emulation actually provides a security improvement.
    – kasperd
    Jun 3, 2018 at 8:42
  • 5
    I find this claim somewhat dubious. Information Security is the mandate of the NSA, not the CIA. Credit Card Fraud is the mandate of the Secret Service. Maybe the FBI is also involved. The CIA is pretty much the only three-letter agency that has nothing to do with this. Also, the majority of the "whole industry" is in Asia and as such not subject to any US government agency.
    – Jörg W Mittag
    Jun 3, 2018 at 8:58
  • 3
    many barcode and magstripe readers are PS2 "wedges". More interesting, it's possible to form barcodes that trigger keys that are normally blocked or not present on the physical hardware. Sanitize all input guys, ALL input. USB is more granular in permissions (ex: needing a custom driver), being a newer technology, as well as a more obscure one. related defcon vid
    – dandavis
    Jun 3, 2018 at 10:02
  • 1
    I also find this claim dubious. Have you read the TempleOS page? This just seems a rant of the creator of an amateur project that can't keep up with the changes of technology.
    – Margaret Bloom
    Jun 3, 2018 at 14:38
  • 1
    @JakeGould I'm was only talking from a technical standpoint :) FWIW, from the HW pov both USB and PS2 are vulnerable to a MiTM attack. From a SW pov, USB drivers are more complex so they expose a wider attack surface but that's not really an argument in favor of PS2 IMHO.
    – Margaret Bloom
    Jun 3, 2018 at 16:06

1 Answer 1

Reset to default
6

TempleOS is a hobbyist OS designed to be God's temple developed by the late Terry Davis, a man who had severe schizophrenia.* Despite being an excellent programmer with a deep understanding of hardware, almost nothing he said was rooted in reality. Many of his design features came from his belief that God wanted it that way. He also believed that the CIA (in addition to glow-in-the-dark space aliens and African Indians) were out to get him. I would not take any of his claims seriously.

sometimes the BIOS has PS/2 drivers but purposely disables them, just to be mean

This is untrue. A BIOS disabling its PS/2 driver is completely irrelevant to the vast majority of people. It is only relevant to hobbyist OS developers who use the built-in BIOS drivers, instead of writing their own as they should. A BIOS disabling its PS/2 driver will not impact any contemporary operating system that wishes to directly interact with the hardware (and no modern OSes use BIOS calls).

Perhaps, at a point of sale in a store, a thief could hack a credit card machine.

The PS/2 protocol is not authenticated, but neither is USB. Any man-in-the-middle between the PS/2 device and port would be able to sniff and inject keystrokes, but this is not considered an issue as it requires physical access to a computer to pull off (inserting a hardware keylogger). However, it is illogical to conclude that this allows someone to hack a PoS system using PS/2.

* I have personally witnessed him, on IRC, spend more than 12 hours straight talking to a markov bot he created with text from the Bible. It was a highly surreal experience.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .