up vote 4 down vote favorite
share [g+] share [fb]

I am wondering if a USB device could potentially be a security hole on a properly configured system just by being plugged in. This was inspired by a post on BitLocker, namely the phrase:

USB devices, after all, get direct access to the system's memory

As far as I know, USB devices don't literally have such access - right? But I can imagine a driver that gives a USB device such an ability.

Are any standard USB device drivers, shipped with Win7, known to expose arbitrary physical memory locations to the USB device?

link|improve this question
75% accept rate
1  
I'm almost sure that only Firewire and Thunderbolt devices get such access. – Dr McKay May 29 '11 at 18:03
I cannot imagine that such a flaw exists, as it would be very major and very simple. Poor proof I know but... – soandos May 29 '11 at 18:13
1  
@DrMcKay so could a specially crafted Thunderbolt device read all the physical memory in a system? Or only a subset of it that was reserved specifically for this purpose, wiped of any potentially sensitive previous data? – romkyns May 29 '11 at 18:37
1  
@romkyns Memory access is totally unrestricted. And yes, it's a whole memory. Mac: theregister.co.uk/2011/02/24/thunderbolt_mac_threat and Windows: friendsglobal.com/papers/… (it's about Firewire as I have no idea if Windows supports Thunderbolt). In fact, both protocols give any device a blind trust. – Dr McKay May 29 '11 at 21:28
I'm pretty sure most USB drivers run in user-mode now, so the whole physical memory access issue is non-existent. I'm writing some USB drivers right now actually, and don't see how I could gain access to anything until my device is initialized by some software. However, even if I were to have that ability, being in user-mode would just BSOD the system before anything happened. – Breakthrough May 30 '11 at 2:16
show 1 more comment
feedback

1 Answer

up vote 2 down vote accepted

Most USB drivers run in user-mode under the WDF driver framework, so the whole physical memory access issue is non-existent. There is no place in USB drivers that allow direct access to anything in memory. Regardless, if a device driver does attempt to access memory it should not, Windows will blue-screen most of the time.

It is worth noting that if a device is given enough permissions, exploits can be created (i.e. buffer overflows) through the software that accesses that device.

TLDR: USB drivers themselves don't pose a threat, but the software you use with the device can.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.