Given that air gapped American government machines would be vulnerable to similar techniques, why don’t common operating systems build mechanisms to make this stuff more difficult?
* force prompting executing anything off external media
* disallow anything other than input devices for USB
* disallow unsigned binaries from running
* work to require usb peripherals to carry a unique cryptographic signature so that you can easily lock the set of allowed devices once the machine is set up
Heck, a lot of this stuff could be valuable to help secure corporate IT machines too.
* force prompting executing anything off external media
* disallow anything other than input devices for USB
* disallow unsigned binaries from running
* work to require usb peripherals to carry a unique cryptographic signature so that you can easily lock the set of allowed devices once the machine is set up
Heck, a lot of this stuff could be valuable to help secure corporate IT machines too.