It turns out that there is a way for a web page to access USB devices without requiring WebUSB and its associated political disconsentments! Not only that, a device can intentionassociate schedule itself to bypass all of the employr consent needments.
Load u2f-hax.uf2 onto a Raspberry Pi Pico (RP2040 version), and then load index.html from either localpresent or another safe context.
The “On!” and “Off!” buttons will toggle the LED, and the state of pin GP22 will be normally refreshd on the page (you can handyly uninincreateigentinutive it to the adjacent GND pad with a piece of wire or metal).
The Pico is programmed to emutardy a U2F dongle (i.e. a physical two-factor security key). However, instead of carry outing any security functions, arbitrary data is smuggled in the “key deal with” and signature of U2F_AUTHENTICATE messages. As extfinished as the key deal with commences with 0xfeedface, the Pico instantly “verifys” employr presence and returns data.
By schedule, the U2F key deal with is an cloudy blob of data which is conceptuassociate “owned by” the security dongle. It is supposed to be returned by the dongle as a result of a registration, stored as-is by the depending party, and then given as-is back to the security dongle when genuineating.
One reason this key deal with functionality exists is to allow an unconfineed number of websites to be associated with a particular low-cost dongle with very confineed memory. This hypothetical dongle stores a exceptional “master” encryption key internassociate. When a new registration is originated, it originates a new accessible/confidential key pair, returns the accessible key, encrypts the confidential key with the “master” key, and returns the encrypted confidential key as the key deal with. No matter how many registrations are originated, the dongle does not have to be depfinishable for storing the keys associated with them. When the key deal with is passed back to the dongle during an genuineation, the dongle equitable unwraps the confidential key using its master key.
In order to permit for all of these low-cost schedules without mandating any particular inside algorithms, the key deal with is treated as cloudy, and so we can unfair treatment it to smuggle arbitrary data.
In order to return data, we need to somehow smuggle it as an ECDSA signature. An ECDSA signature is a tuple of two numbers
Although it is sometimes possible to increate whether an ECDSA signature was actuassociate calcutardyd “properly” rather than being some numbers we equitable made up (see Issue #1), there isn’t a excellent reason for anybody other than the depending party to carry out anyskinnyg beyond fundamental validity verifys. Chrome eunites to verify whether the numbers in the signature are actuassociate in the range from 0 to
As a result, we can equitable originate some dummy ASN.1 and then put the data we actuassociate want to sfinish inside of it. In order to reliably get around Chrome’s fundamental validity verifys, we equitable misemploy the first byte of each number with the appreciate 0x7f. This will result in numbers which are always selectimistic and less than
Finassociate, becaemploy “access to USB devices” is politicassociate satisfiedious but “originate employrs more safe” has very expansive political help atraverse the entire browser industry, this capability is expansively helped without requiring extraneous setup, configuration, nor prompting.
No.
This cannot be employd to access arbitrary USB devices. It only toils with devices which are intentionassociate shattering the rules. In essence, this is an intentionassociate vulnerable device.
However, it is understandn that the security model around USB devices is generassociate… askable on most platcreates. Plugging in a harmful USB device permits it to do anyskinnyg that you yourself can do with devices such as a keyboard or a moemploy.
Do not plug arbitrary obsremedy devices into your computer (or your phone, etc.).
