I have to give a presentation at my university. In the room where I'm going to give the presentation, there is a projector with a HDMI, Display Port, or USB connection. I will have to plug one of them into my laptop.
My question: Could my laptop be infected with malware via one of these connectors? It should be noted that there are probably a lot of other students that have already used them, so the probability that they have already been connected to an infected device is probably quite high.
Yes, but it is probably irrelevant.
From the connectors, at least USB is dangerous. It does not only allow many different types of possibly dangerous access like DMA, but there are also devices which, for example, emulate a keyboard and start to type malicious commands as soon as you plug them in.
But it is very unlikely that the projector uses such an attack. The projector itself is probably harmless (when it was bought), otherwise other people would already have complained. I am also not aware of any projector that had malicious firmware.
The question if it can be infected is an interesting one as many modern devices run actual operating systems. It wouldn't be that unlikely that a projector may have an Android system that allows to present slides without plugging in a computer, and such a system can be vulnerable.
But I am also not aware of a malware that first infects an Android (on the device) and then tries to infect computers that are connected to the device. It could also be possible using USB-OTG mode, but very unlikely to find in the wild.
The bottom line is, that I would trust a projector in an university not to infect my device.
It is possible maybe, but I would rate the probability that it is indeed infected as very low. The USB is also probably the only viable attack vector. Also, I have never seen an infected projector.
This would be a highly custom attack. Which will have quite a bad cost/benefit to an attacker. To do such an attack, I would believe that you would need to buy the projector. Then create and test a Malware for it and then somehow be able to bring it to the installed projector. In the end, from the point of view of the attacker, he would just have created an expensive and time costly one time use malware. You can't easily spread it unless everybody uses said projector and you still need to go to every projector one by one as a human malware carrier (not efficient for infection rate over time).
Bottom-line I'd be more careful about usb-drives (thumb drives), random keyboards, maybe usb-cables in public. They can and are used for malicious purposes. But you can trust your projector at School.
Not all of these can spread malware, so I am not sure why others have not been clear about HDMI.
From the three pieces of tech you asked about.
If security is your concern go with HDMI.
USB
Yes USB is known to be dangerous [1], for a long time already - just think of the Windows Autorun-Feature combined with e.g. USB sticks. There are numerous attacks possible [2] using USB as a vector.
HDMI
The weaknesses just are not well known enough yet. This also is a possible explanation for why the answers before seemed to undervalue the potential risks originating from HDMI ports. Although it is not possible to infect your device using the HDMI cable, a malicious device could find alternate routes.
In average, you can say: The newer the displaydevice that's connected to it, the more dangerous it can be [3]. This is because many of the newer devicemodels (e.g. SmartTVs, or Monitors with fancy functionalities) today often have their own operating system shipped with them. That being said, it's easy to imagine what it means to infect such monitors using a HDMI connection - it's just infecting an ordinary computer - which in term might have a network cable or a WiFi connection, maybe not right now, but later... Or it might just as well infect the next computer it is plugged into in an ordinary way, e.g. by using the Displayport. Displayports can transfer data and thus are just another perfect vector for executing malicious code on 'remote' systems.
It will not be able to infect your computer using the HDMI Port as a vector. Also I don't know any projectors that run a dedicated operating system. On top of that, infections at universities are less likely than in most other public places.
Yet your question is an important one, since the danger of displaydevices is generally underestimated despite their high number of different connection they mostly can use to approach targets. It seems like most people wouldn't even consider the displaydevice to be part of the problem after security-related incidents that affected their system.
Used links in order of appearance:
[1]: https://kb.prohacktive.io/en/index.php?action=detail&id=CVE-2015-1769
[2]: https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/
[3]: https://news.fiu.edu/2021/cyberstalkers-can-hack-into-hdmi-ports-fiu-researchers-are-studying-a-way-to-detect-these-attacks
