• 0 Posts
  • 22 Comments
Joined 2 years ago
cake
Cake day: February 6th, 2025

help-circle





  • Wait are they using MIDI for updating the firmware on their dongle? Or what? Because that’s a pretty nasty vulnerability.

    This API is actually a bit horrifying from a security perspective. In addition to allowing you to use MIDI keyboards as input devices on websites, it also allows websites to send binary firmware updates to MIDI devices. The reason is that it’s common to use custom firmware to backup/restore settings and enable neat effects and functionality on MIDI devices.

    Mozilla’s engineers have reasonably pointed out that an attacker utilizing Web MIDI could use MIDI devices as a stepping stone to launch an attack against the user’s PC outside of the web sandbox. One such attack might be by reprogramming the device to appear as a standard USB computer keyboard and “typing” commands to the host.

    I also heard it could be used for fingerprinting.