Article: USB Audio Driver Security Risk

[The Computer Audiophile]

View full article

[firedog]

Good thing that the new drivers don't include the certificate.

Quote

Users have been advised to manually remove previously installed certificates.

 

Maybe publicize how to remove the root certificate.

[AudioDoctor]

Am I correct that this only affects Windows systems?

[Ralf11]

I am worried about all the Siemens Step7 software controller on my centrifuges

[Dr Tone]

I removed the crappy McIntosh driver a while back, now I have to go track down this certificate in the cert store.  Sheesh.

[AudioDoctor]

4 hours ago, Ralf11 said:

I am worried about all the Siemens Step7 software controller on my centrifuges

 

I am more worried that you're refining uranium...

[Ralf11]

it's for medicinal use - we put it in the hot springs

[One and a half]

6 hours ago, Ralf11 said:

I am worried about all the Siemens Step7 software controller on my centrifuges

Why? Stuxnet is no cost.

[AudioDoctor]

14 hours ago, Ralf11 said:

it's for medicinal use - we put it in the hot springs

 

I think I need to get Donald Trump on the case, he knows all about The Nuclear...

[Ralf11]

here is some medical research:

 

https://www.ncbi.nlm.nih.gov/pubmed/2484503

[AudioDoctor]

8 hours ago, Ralf11 said:

here is some medical research:

 

https://www.ncbi.nlm.nih.gov/pubmed/2484503

 

Sounds like some light reading...

[Ralf11]

Hey - ees Italian!  You want Greek?

 

https://www.ncbi.nlm.nih.gov/pubmed/15172725

[NOMBEDES]

Exactly why home computers should have nothing, ..NOTHING, ..to do with audio, much less audiophilia. 

get a box as far removed from computer madness as possible.

 

All in one.  Plug and play.  Stream.  If you can read email and listen to music at the same time, you are wrong.

[The Computer Audiophile]

9 hours ago, NOMBEDES said:

Exactly why home computers should have nothing, ..NOTHING, ..to do with audio, much less audiophilia. 

get a box as far removed from computer madness as possible.

 

All in one.  Plug and play.  Stream.  If you can read email and listen to music at the same time, you are wrong.

I love your certainty :~)

 

I blame the HiFi companies for every day computers getting popular with audiophiles. We started using them because there was no alternative to purchase. Plus, many of the options available today are so dang expensive. Thus, email, web, and music reside in one :~|

[NOMBEDES]

2 hours ago, The Computer Audiophile said:

I love your certainty :~)

 

I blame the HiFi companies for every day computers getting popular with audiophiles. We started using them because there was no alternative to purchase. Plus, many of the options available today are so dang expensive. Thus, email, web, and music reside in one :~|

 

I know, I know, I just get so frustrated when stuff doesn’t work. Maybe the internet of things can get my refrigerator to play music with refrigerator reliability.

[Miska]

20 hours ago, NOMBEDES said:

Exactly why home computers should have nothing, ..NOTHING, ..to do with audio, much less audiophilia. 

get a box as far removed from computer madness as possible.

 

All in one.  Plug and play.  Stream.

 

Those kind of devices are computers in the end too. Usually with very old software that the manufacturer is not maintaining properly and thus is full of open gaping security holes that can compromise your entire local network. Frequently manufacturer of the device is not really competent on computer security and software maintenance. At worst, those devices can reach out and communicate to internet which makes them especially vulnerable with all the security holes.

 

The disaster called IoT (Internet of Things) is good example of such where botnets of internet routers and security cameras are used to take down banks and public services...

 

In the modern age, audio companies really need to hire competent software developers. Or stick with old CD and vinyl spinners. It is just not enough anymore to know hardware, software has become integral part of it also in audio scope.

 

[Miska]

Quote

I remember several years ago arguing with a manufacturer about the negatives to using custom drivers rather than USB Class 2 drivers built into the operating system. Looks like another vote for native OS drivers.

 

Just that those drivers for commercial OS like Windows and macOS severely lack in features, like native DSD support and such.

 

Manufacturers just have to learn how to do their own drivers and do it properly. Software is as much part of the product quality as is the hardware design. They've just been slacking on software front. Some manufacturers have their own drivers and know how to do things, that gives them competitive advantage over some other vendors. Sometimes it is contracted work, sometimes they have in-house developers. Contracting software work is also art of it's own.

 

From my perspective, it also looks like another vote for open source drivers and platforms like Linux, where the native OS drivers support features like native DSD...

 

 

P.S. From the story it looks like someone wanted to save a bit of money by not obtaining proper code signing key for Windows. It costs just a bit over 200€/year... Meaning that the installer of the driver probably wasn't signed either. And OS will warn you about that. I would advise to never execute unsigned installers on your computer... You can right-click on the installer, select Properties and then Digital Signatures tab to check who signed the package. If there's no Digital Signatures tab, it is unsigned.

[NOMBEDES]

Wise councel from Miska.  Next time I am talking to my TV remote control I will remember to curtail my political opinions.   

[plissken]

Not an issue if one can assume that their private key is secured.

[EuroChamp]

The risk is really, really very low.

[20hertz]

Why even use USB for audio anymore, Ethernet players sound better anyway.