Protect against BadUSB device

Sadly, the solution is not easy nor obvious. Ubuntu is used in a wide variety of different ways and many of them do not lend themselves well to just popping up a dialog box.

Furthermore, the problem is not at all restricted to just devices that can be reprogrammed to act like keyboards.

A fairly lengthy discussion can be found here: http://www.openwall.com/lists/oss-security/2014/08/09/4

Thanks

Status changed to 'Confirmed' because the bug affects multiple users.

@ Seth Arnold: Thanks for your comment. In the case of an USB device acting as a keyboard and for multi-seat machines or remote servers, the keyboard should simply not be activated (what for?). This security measure can also be an option available in "Security & Privacy". I agree that Ubuntu and GNU/Linux is used in many different configuration and the solution proposed here is mostly for desktop use, but it still make sense.

Removing package for now, as it's not at all clear how to design this (at least udev is way too low in the stack to even potentially ask the user anything).

I'm very sceptical of these approaches. Experience shows that popping up dialog boxes with security related questions à la "are you sure that ..." are at least annoying and rarely productive. And on a server you usually don't even have a way to interactively ask the user anything on hardware changes.

If there is a way to detect "malicious" USB devices in some way, we absolutely should do that, but as versatile as they are, USB devices can do pretty much anything. They could act as an audio device to record what you are doing, as a network device to re-route traffic, or as a malicious keyboard (but that's not even the worst IMHO, as you then usually see that something funky is going on and yank it out again).

It's nothing new at all that malicious hardware can exist and that hardware always trumps software in terms of trying to keep each other in check :-)

For the cases of having a multi-function device which also acts as a keyboard we could potentially ask whether the user really wants to use it. This just needs to keep in mind that there are many legitimate devices which look very similar -- headsets often have buttons (which manifest as evdev devices, i. e. similar to keyboards, but you can tell them apart via their event mask), or Yubikeys which are legitimately USB keyboards to enter passwords, etc. -- These dialog boxes must have a very low false positive ratio, or people will quickly start ignoring them just like they get conditioned to ignore pretty much every other security dialog (policykit, Firefox untrusted certificates, and what not).