Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am wondering if a USB device could potentially be a security hole on a properly configured system just by being plugged in. This was inspired by a post on BitLocker, namely the phrase:

USB devices, after all, get direct access to the system's memory

As far as I know, USB devices don't literally have such access - right? But I can imagine a driver that gives a USB device such an ability.

Are any standard USB device drivers, shipped with Win7, known to expose arbitrary physical memory locations to the USB device?

share|improve this question
1  
I'm almost sure that only Firewire and Thunderbolt devices get such access. –  Dr McKay May 29 '11 at 18:03
    
I cannot imagine that such a flaw exists, as it would be very major and very simple. Poor proof I know but... –  soandos May 29 '11 at 18:13
1  
@DrMcKay so could a specially crafted Thunderbolt device read all the physical memory in a system? Or only a subset of it that was reserved specifically for this purpose, wiped of any potentially sensitive previous data? –  romkyns May 29 '11 at 18:37
1  
@romkyns Memory access is totally unrestricted. And yes, it's a whole memory. Mac: theregister.co.uk/2011/02/24/thunderbolt_mac_threat and Windows: friendsglobal.com/papers/… (it's about Firewire as I have no idea if Windows supports Thunderbolt). In fact, both protocols give any device a blind trust. –  Dr McKay May 29 '11 at 21:28
    
I'm pretty sure most USB drivers run in user-mode now, so the whole physical memory access issue is non-existent. I'm writing some USB drivers right now actually, and don't see how I could gain access to anything until my device is initialized by some software. However, even if I were to have that ability, being in user-mode would just BSOD the system before anything happened. –  Breakthrough May 30 '11 at 2:16

1 Answer 1

up vote 2 down vote accepted

Most USB drivers run in user-mode under the WDF driver framework, so the whole physical memory access issue is non-existent. There is no place in USB drivers that allow direct access to anything in memory. Regardless, if a device driver does attempt to access memory it should not, Windows will blue-screen most of the time.

It is worth noting that if a device is given enough permissions, exploits can be created (i.e. buffer overflows) through the software that accesses that device.

TLDR: USB drivers themselves don't pose a threat, but the software you use with the device can.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.