USB Type-C Auth: Now Monopolizing Backdoors in Yer ROM's
https://newatlas.com/usb-c-authentication-program/57844/ https://www.digicert.com/news/digicert-selected-to-operate-managed-pki-for-u... https://www.usb.org/ https://duckduckgo.com/?q="badusb" Not your keys, not your hardware. Not open, not yours. With the arrival of USB-C a few years back, plugging into laptops, tablets and smartphones became even easier than before. Users no longer had to worry about which way up the cable needed to be before pushing the 24-pin connector into a device's port, and could also look forward to fast data transfer and power delivery too. But there are potential security risks. The USB Type-C Authentication Program launched today aims to address such issues. Trustingly plugging a USB charging cable into any available public port can leave your device open to attack from hidden malware, could cause permanent damage from a power surge and may even open the door to your personal or business data. The new protocol from the USB Implementers Forum (USB-IF) can be used to validate the authenticity of a cable, charger or hardware at the moment of connection, and stop attacks in their tracks. The USB-IF has chosen DigiCert to operate registrations and certificate authority services for the new specification, which makes use of 128-bit cryptographic-based authentication for certificate format, digital signing, hash and random number generation. "USB Type-C Authentication gives OEMs the opportunity to use certificates that enable host systems to confirm the authenticity of a USB device or USB charger, including such product aspects as the descriptors, capabilities and certification status," said DigiCert in a press release. "This protects against potential damage from non-compliant USB chargers and the risks from maliciously embedded hardware or software in devices attempting to exploit a USB connection." At launch, the program is optional but with more and more manufacturers including USB-C connectivity on their devices, it's a welcome addition to the security toolkit.
Not open, not yours.
https://www.wired.com/story/intel-meltdown-spectre-storm/ The Elite Intel Team Still Fighting Meltdown and Spectre "With Meltdown and Spectre we were very aggressive with how we approached this problem," says Dhinesh Manoharan, who heads Intel's offensive security research division, which includes STORM. "The amount of products that we needed to deal with and address and the pace in which we did this -- we set a really high bar." Intel's offensive security research team comprises about 60 people who focus on proactive security testing and in-depth investigations. STORM is a subset, about a dozen people who specifically work on prototyping exploits to show their practical impact. They help shed light on how far a vulnerability really extends, while also pointing to potential mitigations. The strategy helped them catch as many variants as possible of the speculative execution vulnerabilities that emerged in a slow trickle throughout 2018. "Every time a new state of the art capability or attack is discovered we need to keep tracking it, doing work on it, and making sure that our technologies are still resilient," says Rodrigo Branco, who heads STORM. "It was no different for Spectre and Meltdown. The only difference in that case is the size, because it also affected other companies and the industry as a whole." Blatant spin. Open all your shit and launch a public bugtracker. #OpenFabs , #OpenHW , #OpenSW , #OpenDev , #OpenBiz CPU's are not that elite, someone will do this someday, and reap immense profits for decades as the first trustable player in the market.
participants (1)
-
grarpamp