-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 12/10/2016 08:25 AM, Marek Marczykowski-Górecki wrote: > On Sun, Sep 04, 2016 at 06:35:42PM +1200, Robert Fisk wrote: >> On 09/01/2016 06:55 PM, johnyju...@sigaint.org wrote: >>> I was thinking earlier that some form of a "USB Firewall" >>> hardware device might be cool to create; one that goes into >>> each USB port in between each device and the PC, and only >>> passes a specific device, or only a HID device (and doesn't >>> permit a drive to add another HID identity). Yet another side >>> project for winter. :) There may be existing products. > > >> Ahem. Allow me to introduce you to a project I have been working >> on for a while now: > >> https://github.com/robertfisk/usg/wiki >> https://github.com/robertfisk/USG/wiki/FAQ > >> The USG (which is Good, not Bad) is a hardware firewall for your >> USB ports. It connects between your computer and your untrusted >> USB device, isolating the badness with two dedicated processors. > >> Features: - Isolates low-level USB exploits by using a simple >> internal protocol with minimal attack surface > >> - No hub support blocks 'hidden' malicious devices > >> - Prevents devices changing their enumerated class after >> connection, stopping malicious class changes. > > >> Device support: mass storage (flash drives), keyboards, mice. > >> Project status: You can build your own USG v0.9 hardware out of >> development boards if you are handy with a soldering iron. End >> user hardware is approaching production-ready status, samples >> will be available in the coming months. > >> Feedback / pull requests / sales leads are welcome! > > This project have great potential! The USB proxy hardware can be > used for somehow more secure USB keyboard usage on Qubes OS, when > only a single USB controller is available. Take a look at this > idea[1]: > > Have a piece of hardware plugged between USB keyboard and PC (based > on https://github.com/robertfisk/USG?), to encrypt and > integrity-protect the events. And then decrypt them in dom0 and > check integrity protection, and only then pass them down to input > devices stack. This should at least partially guard against > malicious USB VM. It still will be able to perform timing based > attacks to guess what you're typing - not sure how accurate such > attacks are currently. Such device could introduce artificial delay > (like - inject queued events every 50ms) to at least partially > mitigate such attacks. > > What do you think about it? I think the hardware you've designed > is perfect for this! > > [1] > https://github.com/QubesOS/qubes-issues/issues/2507#issuecomment-265894809 > > >
This sounds like a great idea, and I am keen to be involved. There is plenty of flash space available on the embedded CPUs to implement some form of encryption, although the best method of doing so on bare-metal ARM is certainly open for discussion. A recent batch of hardware samples sold out in November. Due to Real Life(TM) the next batch of hardware is likely to be ready late January or early February. Pricing is currently NZ$80 each (approx US$57). Regards, Robert -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJYTINVAAoJEN65WsAVra66UqgP/js8V9oHjYtsVs8wHhBs0Iq+ NL4pWUUtceGlCPBJZnKhmPM2Q7gNve3CS4K1i3JikSGIMw4BTqH59JqRmHIv1UDW jH3DHfbGRLNXAJQTAUFQVV+M43rMQXcM0BT5xrTUdlwG8dQhe44cS+cW1BzmSBtn FsszZVEp7UU6IJ/YZMYfEIbd/dhq92YBU5fU16F6PVdAFq8ObQoLCMPxWN8GLSKy JgYkcRHiC2mjzYWN5hv+iZYFVWfxR33jkUoo7n2Iyaz27bYjHyKCy83sBsnhUaLg Xr2+HJxGoxtScG9Q42ay1/40W5LQyhLRyvnYg1Yih1p18JrY54oe4k2F5jGnj953 giQri7lg6xWk9Md9rDRKvq7Xc2Kd6VdRAp1ooPfehGSIidGRdyYEAVttaqMxmZB3 7U1j35ELDTN3q79++LxnQr01yERsQHM6cKYQsog5/mOHtSG2+iOK2RoNK5M2fhQB wrULmBTmwNruRGO+W2RBCcOZCvmP8WTthEb85BSVwHlrra6Vv02oFyAvDTj4Q8RI NLV9HqwXILW1eICCoQUOzcW41SAYrn3ykX/eWgksg221Lks9RWzfxDItBXtrjXSR pqKtbqRVZIT0k35GJug8RjTuG2JRaMbSEepblmWCvm9cN4bl/RRkOy9uRgfBLKsx +k6vRfW54/ly/WT/XVJh =1NhG -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/1fe8b1eb-4de2-ca63-c91f-4b5d3387bfeb%40fastmail.fm. For more options, visit https://groups.google.com/d/optout.
