USB coffee-cup warmer could be stealing your data

[instronics]

Hello everyone

Very interesting indeed. Now i have a nooby question regarding this. Would this threat affect 'any' OS by default? Or would it be like viruses, that have to be individually created for a specific OS? This also might be affected by what kind of data is to be collected (hence a NIC might be different from a keyboard) etc....

Bottom line (to be a bit selfish here), would a slackware system be affected by the contents of this article, or would it have to be a very custom hardware device specifically 'for' slackware?

In addition... what do you folks recomend as a countermeasure?

Cheers.

[SnugglesTheBear]

Plug n Play is the main culprit. As long as you are not running that, you should be okay. Slackware by default does not have PnP running I do believe.

[nihil]

Hmmmmm,

Most of the answer is physical security and vigilance. For a human interface device you should notice that it has been substituted by a new one? and it would be nearly impossible to exactly match the individual characteristics that they soon pick up. Also a lot of my stuff would be hard for an attacker to find, either because of its age or obscure manufacturer.

As we are talking about hardware and firmware; then anything that will run on your system or in your environment will also run the malware as soon as it gets recognised by the BIOS. The mitigation here would be that as you are not running FAT* or NTFS, it probably wouldn't be able to do much, unless it can phone home or you have poor physical security that lets people at your systems unattended and with the ability to launch bootable media.

My basic point is that we are talking about the hardware level interface here, not the OS/application (user) level one, so Slackware won't protect you, even by obscurity.

A great mitigation is the fact that malware authors are percentage players and always go for the low hanging fruit. Most of the attacks we are discussing (apart from PnP) are just too much effort for them IMO.

Mostly I guess that this sort of stuff belongs in the realms of theoretical research, rather than real life, but I would be slightly more wary of publicly accessible systems nowadays?

Just my £0.01