Security : Firmware

[develorer]

Thank you for releasing the source code for the client side.

However, you have not provided the firmware code. In another issue, that you closed, you said:

There is no firmware code. For more information, please refer to [CH9329]

I do not quite understand this. Obviously there is firmware code on the device.
In addition, the link you provided is broken.

USB devices are still an attack vector, it is not good enough to say this is a simpler device that does not have an internet connection. It interfaces with the OS via the drivers, and can exploit flaws in the driver to access the OS networking capability.

Given your previous track-record, I believe it is necessary to provide assurances that the device is secure. I understand that's extra steps for you, but you would sell many more devices. Releasing only the client source code and not the firmware is a strange decision. Half open-source is not open-source.

Could you please:

1. Disclose what is the original microcontroller you used to create this device
2. Open source the firmware. If you haven't changed it from the original, please provide the original firmware
3. Give us the step to check that the firmware code you provided is indeed the firmware that is on the device

Thank you

[ratmandu]

Just a user here, but also an EE. There is no microcontroller in this device, at least nothing with any sort of custom firmware.

The main chips in the NanoKVM-USB are:

• USB Hub
• CH340 USB->Serial converter (takes commands over USB from the host and sends them to the CH9329)
• CH9329 Serial->HID converter (takes commands from the CH340 and converts them to USB-HID signals, acting as a keyboard and mouse)
• MacroSilicon MS2131 USB3.0 Video Capture (this takes the HDMI input and captures it, showing up as a usb webcam essentially).

There's a couple of other little things to help handle the USB port switching, but nothing with firmware really. They're not releasing the firmware, because there is no firmware to release (and if there is any firmware, it belongs to WCH and MacroSilicon).