{"action":"created","issue":{"url":"https://api.github.com/repos/hephaest0s/usbkill/issues/36","labels_url":"https://api.github.com/repos/hephaest0s/usbkill/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/hephaest0s/usbkill/issues/36/comments","events_url":"https://api.github.com/repos/hephaest0s/usbkill/issues/36/events","html_url":"https://github.com/hephaest0s/usbkill/issues/36","id":73981430,"number":36,"title":"Vulnerability: Every device is whitelisted during (re)boot","user":{"login":"evilsocket","id":86922,"avatar_url":"https://avatars.githubusercontent.com/u/86922?v=3","gravatar_id":"","url":"https://api.github.com/users/evilsocket","html_url":"https://github.com/evilsocket","followers_url":"https://api.github.com/users/evilsocket/followers","following_url":"https://api.github.com/users/evilsocket/following{/other_user}","gists_url":"https://api.github.com/users/evilsocket/gists{/gist_id}","starred_url":"https://api.github.com/users/evilsocket/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evilsocket/subscriptions","organizations_url":"https://api.github.com/users/evilsocket/orgs","repos_url":"https://api.github.com/users/evilsocket/repos","events_url":"https://api.github.com/users/evilsocket/events{/privacy}","received_events_url":"https://api.github.com/users/evilsocket/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2015-05-07T13:11:20Z","updated_at":"2015-05-07T14:34:04Z","closed_at":null,"body":"I was reading the code and [these lines](https://github.com/hephaest0s/usbkill/blob/master/usbkill.py#L127) came to my attention:\r\n\r\n    start_devices = lsusb()\r\n    acceptable_devices = set(start_devices + whitelisted_devices)\r\n    \r\nConsidering the [discussion](https://twitter.com/evilsocket/status/596269535067508736) with @pwnsdx on twitter, this makes the pc vulnerable to the following scenario:\r\n\r\n- Attacker has some kernel exploit to bypass login or read encryption keys from memory + physical access to the machine.\r\n- It connects its usb pen with the exploit on it, the computer shuts down due to usbkill.\r\n- He leaves his device attached and reboot the pc, now his device is put inside the acceptable_devices variable, thus whitelisted."},"comment":{"url":"https://api.github.com/repos/hephaest0s/usbkill/issues/comments/99889270","html_url":"https://github.com/hephaest0s/usbkill/issues/36#issuecomment-99889270","issue_url":"https://api.github.com/repos/hephaest0s/usbkill/issues/36","id":99889270,"user":{"login":"pwnsdx","id":2057765,"avatar_url":"https://avatars.githubusercontent.com/u/2057765?v=3","gravatar_id":"","url":"https://api.github.com/users/pwnsdx","html_url":"https://github.com/pwnsdx","followers_url":"https://api.github.com/users/pwnsdx/followers","following_url":"https://api.github.com/users/pwnsdx/following{/other_user}","gists_url":"https://api.github.com/users/pwnsdx/gists{/gist_id}","starred_url":"https://api.github.com/users/pwnsdx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwnsdx/subscriptions","organizations_url":"https://api.github.com/users/pwnsdx/orgs","repos_url":"https://api.github.com/users/pwnsdx/repos","events_url":"https://api.github.com/users/pwnsdx/events{/privacy}","received_events_url":"https://api.github.com/users/pwnsdx/received_events","type":"User","site_admin":false},"created_at":"2015-05-07T14:34:04Z","updated_at":"2015-05-07T14:34:04Z","body":":smiley:"}}