Ask HN: Security of Hardware Nano KVM
3 comments
https://www.wch-ic.com/downloads/CH9329DS1_PDF.html
They dont have the. The chip convert the ecltrical signal into keypress
The ch9329 they link is the chip they use. It is certainliy off the shelf and purchased from another, that does not provide much more information to them past implementation
The firm: Check the https://github.com/sipeed/NanoKVM/tree/main/server there is quite a bit of .so committed to the repo sadly. The NanoKVM in NanoKVM USB use CH9329.
They dont have the. The chip convert the ecltrical signal into keypress
The ch9329 they link is the chip they use. It is certainliy off the shelf and purchased from another, that does not provide much more information to them past implementation
The firm: Check the https://github.com/sipeed/NanoKVM/tree/main/server there is quite a bit of .so committed to the repo sadly. The NanoKVM in NanoKVM USB use CH9329.
That makes sense, thanks!
Just isolate it on the network so it doesn't have outside internet access.
There are also similar alternative devices like JetKVM, TinyPilot, etc.
There are also similar alternative devices like JetKVM, TinyPilot, etc.
It would work very well for my need, but the company has a [terrible track-record for security](https://www.youtube.com/watch?v=plJGZQ35Q6I).
So I am trying to approach it from a fully paranoid perspective. Can I use this device and protect myself fully from it?
They provide the source code for the client side. SO that's fine, I can read that code, recompile it, and convince myself it is fully safe (I am only human, but let's assume it's good enough).
I have strong doubts about the firmware side though. I am not familiar with the hardware side, but could there be any security issue there?
The guys making the device are claiming ["there is no firmware code"](https://github.com/sipeed/NanoKVM-USB/issues/5#issuecomment-2785035753). I do not understand that statement. Can anyone more knowledgeable shed some light as to what that means, and how I could verify it?
They point to a link to corroborate that claim, but the link is broken.
Thanks in advance for any insights!