Recently I read a few things about the BadUSB exploit, for example:
My understanding is that a device connected to USB can change its appearance (drive, keyboard, network card, ...), which opens the opportunity for an infected USB drive (or other device for that matter) to simulate things like a keyboard and submit malicious commands or a network card and connect to web adresses to download programs. The problem appears to be that the computer automatically trusts USB devices. However, the power of the infected chip is probably very limited, which makes it difficult to simulate more complex hardware like network cards:
Anyhow, I am interested if it is principally possible to prevent such behavior:
- Is my understanding of the exploit correct?
- If so: Wouldn't it be possible to implement a software "firewall" that asks the user for permission if new USB devices are connected and especially throws a warning if the "type" of the device changes? By that I mean not simply clicking ok (which a malicious USB device may do on its own), but use something like a CAPTCHA.
- If that is not possible, because the software may not be able prevent the usage of a USB device (or for some reason): Would a hardware solution be possible, that forwards USB data, but for example only allows USB drives and not keyboards? How does a USB device tell the computer its "type"?