On Tue, Oct 20, 2009 at 01:30:01AM -0600, Anathae E. Townsend wrote:
> Off topic, I know, but I'm hoping some USB programming smart readers
> might know the answer to my question.
>
> Are there available usb interface chips that an OEM can program the
> PID, VID, and Serial Number without having to specify it in the chip
> Mask?
>
> If this is possible, USB devices cannot be guaranteed to be unique
> based on PID, VID and Serial number.
>
> Anathae Townsend
>
> p.s. yes, there is a reason for knowing this.
I'm not sure what you are trying to do, but whitelisting USB keys (e.g.
to run arbitrary code from them) based on something as simple as a
serial number is not really a good idea. I'm by no means a USB expert,
but I'd imagine that quite a few devices get their serial number
programmed into them at the factory, and I'd be surprised if there
weren't any "debugging devices" that reported whatever they are told to
report.
It's probably obscure enough to twart most attackers, though.
Joachim
