0

From what I understood, the possibility of having a multitude of device types connected to the computer via USB (keyboard, mouse, gadgets, sticks, webcams, ...) is a security risk:

  1. I connect a USB stick with malware on it.
  2. The malware says "I'm a keyboard" -> The OS thinks a keyboard is connected.
  3. The malware can execute arbitrary keystrokes.

It seems to me that it would be pretty simple to prevent this from happening by asking the user every time a USB keyboard gets connected something like "We think a USB keyboard was connected. Due to security concerns we have to ask you: Is this correct?", giving the user the possibility to answer "yes" or "no". When the user clicks on "yes" (with the mouse / with another keyboard) the device is "registered" and can be used. If the user clicks "no", it is not "registered" and thus cannot be used.

Would this work?

Is there a possibility to make Ubuntu handle USB keyboards like this?

Paul Cager
  • 183
  • 2
  • 7
Martin Thoma
  • 3,952
  • 6
  • 33
  • 42
  • What if I connect a keyboard before the computer boots? – Matthew Feb 29 '16 at 09:31
  • @Matthew I'm not saying this can solve all possible problems. For laptops, USB keyboards should probably not be connected automatically at all. For desktop computers without a PS/2 port, the user has to make sure there is only a USB keyboard (and no other USB device) connected. – Martin Thoma Feb 29 '16 at 10:07
  • This could be possible with udev - instead of automatically loading the keyboard driver for a device, open a GUI instead (see a somewhat-related question here: http://askubuntu.com/questions/531445/only-use-mass-storage-devices-on-a-selected-usb-port-how ). Of course, that brings us back to square 1 - with what do you authenticate the device? Another device, which needs to be authenticated with...turtles all the way down. (my newish laptop has no PS/2 keyboards: even the internal one seems to be connected over USB) – Piskvor left the building Feb 29 '16 at 11:40

0 Answers0