1

I recently bought a HDMI to VGA + Audio Out adapter on the internet for the purpose to playing Xbox on an old monitor. It came just inside a plastic bag, so I don't have any guarantees that the equipment have not been opened before.

The adapter is working fine, but now I'm wondering if I could safely plug it into my video card to use my PC on that old monitor, since an evil equipment is much more likely to be built to explore vulnerabilities on PC/Windows. How viable would it be to tamper with an adapter of such type and what type of attacks could it perform?

I took a look at the topic VGA/HDMI Based Attack, but it's pretty old and there could be something new that is not there.

Improve this question

2 Answers 2

Reset to default
1

This question seems to come up about once a month, and the answer still has not changed.

The bidirectional protocol in VGA and DVI is very very limited, and basically is only used to identify the monitor and exchange video resolution and timing information. It's too primitive to be used as an exploitable channel unless your video card has very specific hardware bugs. A quick survey of the several dozen CVEs for VGA all list either host side device driver bugs or bugs in virtual VGA devices for VMs. This just isn't a real world issue for vga hardware.

HDMI actually has fewer CVE's listed. However, some of these do include device side exploits, including two where corrupt EDID data could cause a buffer overflow in linux (on android). Also, HDMI includes specs for ethernet and usb, although I am not aware of any video cards that implement that. Also, the HDMI CEC protocol allows transmission of remote buttons, which some hosts that support CEC translate to keystrokes. However, CEC generally does not show up as a keyboard device, an application has to explicitly support CEC to use it that way.

USB C is actually a bigger danger, as this inherently can include arbitrary devices like keyboards, mice, and disks.

In short, it seems extremely unlikely that an HDMI adapter could be a security issue, as long as your video card doesn't show up as a usb hub with a network interface. (Most do show up as a sound card.)

Improve this answer
0

Depending on the price and location you payed for the item, I would not be to worried about any kind of infection or hidden dongle inside the cable, but theoretically, it is not impossible.

The security risk would be most likely regarding data exfiltration from VGA and/or HDMI via RF, which is covered in these articles.

Improve this answer
1
  • I agree. But I'm sure that's not intentional -- some of those devices are just poorly made and shielded and they leak RF like a sieve.
    – user10489
    Dec 15, 2021 at 12:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .