Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering if a USB device could potentially be a security hole on a properly configured system just by being plugged in. This was inspired by a post on BitLocker, namely the phrase:

USB devices, after all, get direct access to the system's memory

As far as I know, USB devices don't literally have such access - right? But I can imagine a driver that gives a USB device such an ability.

Are any standard USB device drivers, shipped with Win7, known to expose arbitrary physical memory locations to the USB device?

share|improve this question
1  
I'm almost sure that only Firewire and Thunderbolt devices get such access. – Dr McKay May 29 '11 at 18:03
    
I cannot imagine that such a flaw exists, as it would be very major and very simple. Poor proof I know but... – soandos May 29 '11 at 18:13
1  
@DrMcKay so could a specially crafted Thunderbolt device read all the physical memory in a system? Or only a subset of it that was reserved specifically for this purpose, wiped of any potentially sensitive previous data? – romkyns May 29 '11 at 18:37
1  
@romkyns Memory access is totally unrestricted. And yes, it's a whole memory. Mac: theregister.co.uk/2011/02/24/thunderbolt_mac_threat and Windows: friendsglobal.com/papers/… (it's about Firewire as I have no idea if Windows supports Thunderbolt). In fact, both protocols give any device a blind trust. – Dr McKay May 29 '11 at 21:28
    
I'm pretty sure most USB drivers run in user-mode now, so the whole physical memory access issue is non-existent. I'm writing some USB drivers right now actually, and don't see how I could gain access to anything until my device is initialized by some software. However, even if I were to have that ability, being in user-mode would just BSOD the system before anything happened. – Breakthrough May 30 '11 at 2:16
up vote 2 down vote accepted

Most USB drivers run in user-mode under the WDF driver framework, so the whole physical memory access issue is non-existent. There is no place in USB drivers that allow direct access to anything in memory. Regardless, if a device driver does attempt to access memory it should not, Windows will blue-screen most of the time.

It is worth noting that if a device is given enough permissions, exploits can be created (i.e. buffer overflows) through the software that accesses that device.

TLDR: USB drivers themselves don't pose a threat, but the software you use with the device can.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .