Brace yourselves: USB bugs are coming!
Quote Tweet
Slides for my "Coverage-guided USB Fuzzing with Syzkaller" talk @offensive_con docs.google.com/presentation/d
1
8
46
Conversation
Replying to
I applied 's deny_new_usb patch around the time it appeared. Syzkaller keeps vindicating that choice. 👍
1
1
3
I didn't make the deny_new_usb feature. I developed the Android integration for it including integration into Keyguard for automatically enabling it when the screen is locked. It existed as a kernel feature for many years prior but hadn't been properly integrated as intended.
There's an upstream kernel feature (kernel.org/doc/Documentat) which I worked on integrating as a more sophisticated feature where users can confirm the device types match their expectation. Unfortunately, it was only a prototype and wasn't ever ported to later releases of Android.
2
1
I picked up the patch from the Linux Hardened tree you were maintaining a while back (thanks!), so the patch I use has your name as the git author. What was the original provenance? PaX/grsec?
1
The commit states the origin (grsecurity). Being the author of a commit doesn't imply being the original author of the code. The origin of the patch wasn't published as a Git repository and even if it was there wouldn't necessarily be a usable commit to directly extract that way.
1
Show replies