1

I have a laptop with 4 USB ports, and I have an external 4 port splitter that I purchased off amazon. Plugged into that is an external USB audio card. The audio card has a line-in port and an audio output. But, when I run lsusb, an HID (human interace device) is also detected:

/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/6p, 480M
|__ Port 2: Dev 15, If 0, Class=Hub, Driver=hub/4p, 480M
    |__ Port 3: Dev 16, If 0, Class=Audio, Driver=snd-usb-audio, 12M
    |__ Port 3: Dev 16, If 1, Class=Audio, Driver=snd-usb-audio, 12M
    |__ Port 3: Dev 16, If 2, Class=Audio, Driver=snd-usb-audio, 12M
    |__ Port 3: Dev 16, If 3, Class=Human Interface Device, Driver=usbhid, 12M

So I have three questions.. Why are their 3 different audio interfaces showing up, and what legitamate use would an HID server on an audio card? I thought that HID controllers were for devices like keyboards, mice, or perhaps cameras. I also know that they are an attractive attack vector (like the rubber ducky). Is this normal?

Secondly, listed on port 1, and also when all usb devices are removed from my computer, I see this in output of the lsusb -t

/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/6p, 480M
|__ Port 5: Dev 2, If 0, Class=Video, Driver=uvcvideo, 480M
|__ Port 5: Dev 2, If 1, Class=Video, Driver=uvcvideo, 480M

I do have a webcam and microphone inside the laptop, but not inserted in anything USB. However, lspci does not report any other video controllers, so I assume that's just the internal camera.

Finally, why would a wireless mouse show up as a keyboard? I assume it's because this mouse has a couple other buttons on them (although none actually work in linux):

          *-usb
               description: Keyboard
               product: 2.4G Wireless Mouse
               vendor: MOSART Semi.
               physical id: 1
               bus info: usb@8:1
               version: 1.11
               capabilities: usb-1.10
               configuration: driver=usbhid maxpower=100mA speed=12Mbit/s

Is any of this abnormal? What legitamate uses do USB HID controllers serve?

1
  • 1
    I'm not sure this is an InfoSec question.
    – schroeder
    Jun 19, 2015 at 4:17

1 Answer 1

0

Assuming your mystery USB audio device is based on the CMedia CM108 chipset (or even if it isn't, since there's not much variation in cheap USB audio devices), the HID device is for optional volume-control buttons; the manufacturer of your device decided not to hook the relevant chip pins up to actual buttons. The other three interfaces are audio in, audio out, and device control.

Your webcam is probably USB. It may not have any external wires or use a conventional plug, but USB is a convenient way to hook things up inside a computer.

I don't know why your mouse is describing itself as a keyboard, but it's not unusual for manufacturers to not get things exactly right when configuring USB.

1
  • Yep, it's the Cmedia. That all makes sense. Regarding the mouse, do you know if wireless mouses generally use any form of encryption between the controller and the mouse? Given the randomness of computer part integrity, I wonder how easy it is to snoop on wifi keyboard/mouse traffic? Thanks for helping to put my mind at ease.
    – nemister
    Jun 19, 2015 at 20:23

Not the answer you're looking for? Browse other questions tagged .