USB-C Accessories Need User Permission to Communicate With Apple Silicon Macs Running macOS Ventura

[DStaal]

Perhaps HID class devices do not need approval.

That would negate the entire purpose, as HID class devices are often what the malicious devices try to pretend they are - they then can act on the computer.

 

[sideshowuniqueuser]

This is the main vector. A device pertaining to be a USB stick actually is a keyboard that can inject keystrokes and infect a machine.

USB Rubber Ducky

NEW VERSION OF THE BEST SELLING HOTPLUG With a few seconds of physical access, all bets are off...

shop.hak5.org

Ok, but how are we supposed to know this is going to happen? I mean, when I plug in a USB stick, of course I want to transfer data from it, so of course I am going to give permission. How does this improve things beyond creating an extra annoying step every single time I plug a device in?

 

[Danfango]

Ok, but how are we supposed to know this is going to happen? I mean, when I plug in a USB stick, of course I want to transfer data from it, so of course I am going to give permission. How does this improve things beyond creating an extra annoying step every single time I plug a device in?

Well if you plug it in and it asks "this USB stick is wanting to be a keyboard" then you can say "err no".

Also when you are away from the computer and it is locked, no attacker can access the ports, which has historically been a big problem with Thunderbolt and USB.