From owner-freebsd-security@FreeBSD.ORG  Wed Oct 22 06:19:53 2014
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 5063AAAB;
 Wed, 22 Oct 2014 06:19:53 +0000 (UTC)
Received: from mail.turbocat.net (mail.turbocat.net
 [IPv6:2a01:4f8:d16:4514::2])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 10B3BA54;
 Wed, 22 Oct 2014 06:19:52 +0000 (UTC)
Received: from laptop015.home.selasky.org
 (cm-176.74.213.204.customer.telag.net [176.74.213.204])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (No client certificate requested)
 by mail.turbocat.net (Postfix) with ESMTPSA id C07531FE023;
 Wed, 22 Oct 2014 08:19:49 +0200 (CEST)
Message-ID: <54474C8B.5020000@selasky.org>
Date: Wed, 22 Oct 2014 08:19:55 +0200
From: Hans Petter Selasky <hps@selasky.org>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:31.0) Gecko/20100101 Thunderbird/31.1.2
MIME-Version: 1.0
To: Dewayne Geraghty <dewayne.geraghty@heuristicsystems.com.au>
Subject: Re: BadUSB - On Accessories that Turn Evil, by Karsten Nohl + Jakob
 Lell
References: <201410082347.s98NkjW3025396@fire.js.berklix.net>	<54362AE2.90501@selasky.org>
 <CAPjTQNHbh40oeeuJnCk+iiKLOFO9TJU0Z13uRp6FawuUrmHvnw@mail.gmail.com>
 <54369F43.9010806@selasky.org> <544703E5.7000007@heuristicsystems.com.au>
In-Reply-To: <544703E5.7000007@heuristicsystems.com.au>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
X-Mailman-Approved-At: Wed, 22 Oct 2014 11:30:40 +0000
Cc: freebsd-security@freebsd.org, freebsd-usb@freebsd.org
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Oct 2014 06:19:53 -0000

On 10/22/14 03:09, Dewayne Geraghty wrote:
> Hans,
> Thank-you for these enhancements, as its good to have something in the
> armoury to try to address this issue.
>
> I applied the patch
> https://lists.freebsd.org/pipermail/svn-src-head/2014-October/063443.html  to
> an updated 10.Stable overnight.  Disabling enumeration works as
> described above except that, placing the following in loader.conf has no
> effect?
> --- tail of /boot/loader.conf ---
> # 20141022 Didn't work as expected
> #dev.uhub.0.disable_enumeration="1"
> #dev.uhub.1.disable_enumeration="1"
> #dev.uhub.2.disable_enumeration="1"
> #dev.uhub.3.disable_enumeration="1"
> #dev.uhub.4.disable_enumeration="1"
>
> # 20141022 Also didn't work
> hw.usb.disable_enumeration="1"
> --- end of /boot/loader.conf ---

Hi,

The /boot/loader.conf only works in -current, because in 10-stable 
SYSCTLs cannot be automatically loaded from TUNABLEs. You would need to 
add some TUNABLE() statements for that.

--HPS