USB exploit - cross platform

I've duped this against an earlier bug with much discussion, and links off to further discussion.

Sadly there's no obvious good and easy solution. Consider:

- How would a user interact when plugging in the first keyboard or mouse?
  - What if the malicious device was first only because it was 'earlier' in the USB network?

- How would the system tell a keyboard-with-hub that a user intended to buy from a keyboard-with-hub that a user didn't intend to buy?

- What would the interaction look like on a computer with no displays? With a dozen displays? With a dozen seats?

USB is very flexible. Many devices are really multiple devices -- sometimes connected with internal hubs, sometimes they change their runtime personality. And users expect them all to work in all situations.

Thanks

Answering your questions:

"- How would a user interact when plugging in the first keyboard or mouse?"
The first keyboard and mouse are normally connected when powering on the PC.
The behaviour should be like today - no restrictions for the first keyboard and mouse.
(Normally the USB flash drive is connected only *after* that the normal keyboard & mouse are already connected.)

"- What if the malicious device was first only because it was 'earlier' in the USB network?"
If by "earlier in the USB network" you mean :
 * "connected before the keyboard and mouse" then for now there is not much I can think of. But normally that does not happen, and *some* protection is better than none.
 * "connected in parallel (same time) to keyboard & mouse" then alert the user that he needs to remove one of them in order to proceed.

"- How would the system tell a keyboard-with-hub that a user intended to buy from a keyboard-with-hub that a user didn't intend to buy?"
Hubs aren't the norm.
In case that someone has a hub (doubtful..) then he can always disable the security behaviour. I sincerely believe that most of the people would prefer to have more protection and little discomfort than having this huge exploit.

"- What would the interaction look like on a computer with no displays? With a dozen displays? With a dozen seats?"
With no displays: Does it connect via ssh? If so, then he could see the message. If not then a sound/beep would be activated. If having no speakers then the user should understand that something is wrong... But I think that this is rarely happen, therefore if it does happen - then it is probably(??) the USB exploit.
With dozen of displays: Simply display an alert window of some sort on one of the desktop (is this really a problem? How does Ubuntu manages to display errors with dozen of displays?).
With a dozen seats: What do you mean by "seats" ?

USB is very flexible indeed, but most people would prefer to know that their system is secure than spending few minutes (or half an hour in worst case) in understanding the (rare) problem and fixing it.

I suspect Windows can implement a solution because Windows is used for far fewer environments with far more predictable settings -- a human in front of a keyboard, mouse, and display, or perhaps a human in front of a touchscreen.

Linux's deployments are far more varied and one-size most certainly doesn't fit all.

I suggest bringing this up on the oss-security mail list. It'd be helpful if you've got suggestions of which packages would need to be modified in which ways to manage:

- systems without displays
- systems with usual windows-style one seat
- systems with many seats
- servers that have both local keyboards / displays and remote access keyboards / displays

Thanks

Dear Seth,

Indeed but surely there is a solution for this.
You can say the same thing about every other message that should be displayed to the user in every configuration/setup of Ubuntu/Linux.

I sent an email to the OSS security mail list, whose address appears at the following URL:
http://oss-security.openwall.org/wiki/mailing-lists/oss-security
(i.e. "oss [dash] security [at] lists [dot] openwall [dot] com" )

I'm sorry but I don't know which packages should be modified, I'm not well familiar with Ubuntu/Linux.

BTW in every setup or configuration of Linux there is *some* interactive way to alert the user about an error or problem.
Why it is so complicated when dealing with our current problem ?
The user *must* have a screen and a keyboard. Thus the message will be displayed either via the command-line terminal or via the GUI.
(I don't understand what's the problem here...)
If the developers can't implement this security patch, then why would anything else be possible?