Hello, welcome to the Friday, May 29th, 2020 edition of the Sands and its Storm Center's Stormcast.

My name is Johannes Ulrich, and then I'm recording from Jacksonville, Florida.

Back when we were still meeting at conferences and handing each other USB drives, for example, with virtual machines for the glass.

There was always that little bit uneasy feeling that a little bit snickering about,

well, I have to plug this USB drive that you just gave me into my computer.

Can I trust it?

And of course you can trust USB drives that I give you, but what could possibly

happen? Now, back in the old days, of course, there were a lot of these sort of auto-run style

exploits where software would run as soon as you plug in a USB drive, but that has been less of a problem on a well-configured system.

Another issue, however, are various USB drivers that have to interact with the USB drive.

And a new tool USB fuss has looked at vulnerabilities in USB drivers that are included in operating systems.

And of course, they found quite a few of them. They discovered a total of 26 new vulnerabilities

across various operating systems, including Linux, which got 16 out of those 26, one buck

in free BSD 3 in Mac OS, and then the remainder is so distributed between Windows 8 and

Windows 10. Now, I didn't see when reading this any sort of direct remote code execution vulnerabilities, but there are some blue screen of deaths, there are some system freezes and such.

And whenever you have a denial of service like this created by a fuzzling tool, there could be a potential for code execution,

but of course these fassing tools often don't trigger the code execution,

but instead just a system crash.

Now, good news here, the bugs were reported to the respective operating system.

Many of them have been patched.

The USB fuss tool that was used to find these vulnerabilities will soon be open sourced, has not been open sourced yet, but the name

of the GitHub repository has already been announced. And of course, I'll add a link to the complete paper to the show notes.

...