Article: USB Audio Driver Security Risk

[Miska]

20 hours ago, NOMBEDES said:

Exactly why home computers should have nothing, ..NOTHING, ..to do with audio, much less audiophilia. 

get a box as far removed from computer madness as possible.

 

All in one.  Plug and play.  Stream.

 

Those kind of devices are computers in the end too. Usually with very old software that the manufacturer is not maintaining properly and thus is full of open gaping security holes that can compromise your entire local network. Frequently manufacturer of the device is not really competent on computer security and software maintenance. At worst, those devices can reach out and communicate to internet which makes them especially vulnerable with all the security holes.

 

The disaster called IoT (Internet of Things) is good example of such where botnets of internet routers and security cameras are used to take down banks and public services...

 

In the modern age, audio companies really need to hire competent software developers. Or stick with old CD and vinyl spinners. It is just not enough anymore to know hardware, software has become integral part of it also in audio scope.

 

[Miska]

Quote

I remember several years ago arguing with a manufacturer about the negatives to using custom drivers rather than USB Class 2 drivers built into the operating system. Looks like another vote for native OS drivers.

 

Just that those drivers for commercial OS like Windows and macOS severely lack in features, like native DSD support and such.

 

Manufacturers just have to learn how to do their own drivers and do it properly. Software is as much part of the product quality as is the hardware design. They've just been slacking on software front. Some manufacturers have their own drivers and know how to do things, that gives them competitive advantage over some other vendors. Sometimes it is contracted work, sometimes they have in-house developers. Contracting software work is also art of it's own.

 

From my perspective, it also looks like another vote for open source drivers and platforms like Linux, where the native OS drivers support features like native DSD...

 

 

P.S. From the story it looks like someone wanted to save a bit of money by not obtaining proper code signing key for Windows. It costs just a bit over 200€/year... Meaning that the installer of the driver probably wasn't signed either. And OS will warn you about that. I would advise to never execute unsigned installers on your computer... You can right-click on the installer, select Properties and then Digital Signatures tab to check who signed the package. If there's no Digital Signatures tab, it is unsigned.