How does it do this? (USB Key)

Discussion in 'Mac Basics and Help' started by jimandy, May 19, 2015.

  1. jimandy macrumors newbie

    Joined:
    May 19, 2015
    #1
    I have received a USB "Web Key" in the mail from a trusted source. It is just a bit of plastic attached to a cardboard insert from which it can be torn off. In reading about such items (used mainly for marketing) I understand that it has an embedded chip and an eeprom that contains the URL of the vendor. All this in a half inch by half inch, almost paper thin device. Inserting it into the USB port opens Safari on my Mac and redirects to the vendor's web site.

    In reading up on how these things work I believe it sends keyboard commands (or at least character codes) that open the browser. My question is how can this be? I re-booted to make sure no applications were running, no browsers for sure, and yet it still did it's magic. What kind of keyboard characters or external device generated codes can interrupt the OS, then find and open an application without a bit of dialog between me and the OS?

    Yes, I know on Windows machines there is an auto-run feature that can be user programmed to do similar things but I don't believe Apple left open such a wide door to security issues with Mac OS. (I'm running Snow Leopard).
     
  2. dyt1983 macrumors 65816

    Joined:
    May 6, 2014
    Location:
    USA USA USA
    #2
    If it is running with the HID USB profile (human interface device) as you surmise, then it can interact with the computer as if a human were controlling it. Nothing sneaky or nefarious. Well, unless it is used that way. A specially crafted device could open a terminal and execute a "rm -rf ~" which would delete your whole home directory without even asking.

    (There are several ways of accomplishing what you've described, and I can think of many... I'm not sure which way your particular device did it though.)
     
  3. jimandy thread starter macrumors newbie

    Joined:
    May 19, 2015
    #3
    Thanks for the quick reply.

    OK, so it must send commands that interact with the OS, calling up a search for the browser app with the target URL appended. Now if my Mac is running just plain finder, what would be the equivalent human commands to launch an app through the keyboard only, without benefit of the usual pointing and clicking of a mouse? I don't know of any keyboard command or sequence of commands that can do this unless I have pre-programmed some keyboard shortcuts into the function keys.

    If the Web Key is doing this like a human (without benefit of moving the mouse) then how can I as a real human do it? I understand the OS is "listening" to the USB port (it mounts a drive without the user doing anything) so it must be listening to something from this device for the web launching process. It is what it "hears" that I am interested in.
     
  4. Gav2k macrumors G3

    Gav2k

    Joined:
    Jul 24, 2009
    #4
    open -a Safari http://stackoverflow.com
     
  5. jimandy thread starter macrumors newbie

    Joined:
    May 19, 2015
    #5
    By golly Gav2K, that works!

    So if the codes that the Web Key sends can get Terminal running then the rest is easy. Maybe it works this way...

    The micro chip in the key sends command <space> to open Spotlight, then it sends "Terminal" plus a <cr> into the search box and then the rest of the command line shortly after enough time for Terminal to launch.

    But, to do this on a Windows machine, the Web Key would need to know to send "flag-key" code plus "r" for a similar process. Would mean the device needs to know what type of OS it is working with. Hmmm.

    Thanks. I will continue to ponder.
     

Share This Page