New answers tagged hardware
0
USB interface can give you access to the CPU if you have (or not?) the keys to sign the CPU firmware. Can't remember where I read this, some website for conspiracy theories maybe.
It's not impossible to obtain the keys, see how Microsoft allegedly collaborated with Stuxnet creators. Intel may collaborate with the malware creators too just like Microsoft. Or ...
1
Together with the great answers already provided, I want to add a first-hand experience relevant for Windows systems.
In my university a few years ago stared appearing some infected USB with a malware that worked like that:
When a key was infected, all files where moved to a hidden, system-protected folder.
A special link was created and renamed with the ...
19
Infamously, Stuxnet exploited a feature of Windows that automatically installs USB drivers on a USB stick when inserted as long as the drivers have appropriate digital signatures. The Stuxnet virus had drivers that were signed with a Microsoft-owned private key.It's not publicly known how that particular Microsoft private key was obtained -- whether it was ...
10
There's some other examples of USB-attacks, in addition to the ones mentioned above.
For example the PS3 was first jailbroken using a USB stick that presented itself as a USB hub with a lot of devices attached and specially crafted device identifiers. This allowed for code execution.
36
Besides all previous good answers, there's another one that nobody mentioned: USB-based Ethernet devices. Like the excelent PoisonTap.
One can make the device register as a Ethernet device, and change the default route for the IP of the device. This way, every cleartext request and every DNS request will be sent to it, and a request for important domains (...
18
In some cases, acting as a mass storage device will enable a lot of havoc.
Any operating system that will autoplay anything (no longer implemented for good reason these days) is vulnerable - this will at least enable the attacker to do a lot of things at the privilege level of the person logged in; in case any local privilege escalation is taken advantage ...
48
There were also attacks based on the autoplay-feature (other source), although I think this is a bit outdated with newer OS like Windows 10. There are also USB-Killers which operate on a hardware-level and kill your machine through sending high current shocks.
Here's a list of other attacks that might fall in the same category, including but not limited to:...
20
No, there are others.
USB Killer, for example, is a device that aims to damage your hardware by applying a high voltage to the data lines.
An attacker could use such a device to bait employees to involuntarily damage company hardware, resulting in a loss of availability and monetary damages.
0
I do not agree that negative rings are false rings. They are quite real. Let's take -1 for example: having control of it almost guarantees having control over anything starting with 0 (with very few exceptions). Nothing unreal about it.
Here's how I see it today:
Ring 3 - user-level
Ring 2 - driver level (actual drivers)
Ring 1 - driver emulation level (...
Top 50 recent answers are included
