Christmas project idea: Bad USB defender.

[dotm]

I ask myself what to do IF there is little spare time during hollydays.
One option: farcry4
another one: doing electronics, for a change.

How hard could that be?
An Adapter that you can Plug your USB stick into, it checks if it is not a HID (thus BAD USB) and if everything is ok it connects it to the computer.
Anyone thought about this?

Yours
m.

[pickit2]

It sounds more like software project.
http://msdn.microsoft.com/en-us/library/windows/hardware/dn376877(v=vs.85).aspx

[dotm]

It sounds more like software project.
http://msdn.microsoft.com/en-us/library/windows/hardware/dn376877(v=vs.85).aspx

Yes.
But if I somehow want to definitely make it as hardware (for recreational purpose?), how hard can it be?
Should I use a mcu with integrated host like the ftdi vinculum series? Or should I use a software stack like LUFA?

[Gallymimu]

This would be a bit of work because the adapter would have to act as a host, identify the device, and then disconnect and pass the device through.

What would be the purpose of limiting to HID drivers??

The other issue is that I think you would need a database of ALL device PIDs.  Otherwise how would you know what driver a device needs?  The way windows knows is it scans through a list of PIDs it has for devices and if one matches a driver, it installs that driver.

[dotm]

What would be the purpose of limiting to HID drivers??

As far as I read, bad usb will reprogramm the memory controller to act as a HID besides its memory controller functions.
The security risk then comes from hidden keyboard inputs. So the goal would be to limit the stick to storage devices.
My naive idea is to check if there is one and JUST ONE device connected to the host and if this device is a storage device, eveything should be fine.

[Gallymimu]

hmmm,

interesting.  You would have to get a processor that could be a full host or possibly OTG would work.

[dotm]

You would have to get a processor that could be a full host

like this ?
http://www.farnell.com/datasheets/64691.pdf
(ftdi site is down atm)
Would be limiting valid devices to class 08h (storage) sufficient?

[CocaCola]

At the end of the day nothing is going to be fool proof, on Windows follow the steps in this link and disable installation of USB keyboards and that will solve most of the 'BADUSB' thumb drive exploits...

https://heimdalsecurity.com/blog/badusb-exploit-vulnerability-fix/