No, just no. It's long, LONG past time to retire this bit of ancient lore, which came out of a completely different time and place in computing. These days for most users not always having physical control is by far the norm, not the exception. And there are absolutely ways to make to mitigate security issues from physical access, that is after all the entire point of technologies like full disk encryption. FDE is completely pointless if physical security can be taken for granted, it exists entirely because physical security cannot be taken for granted. I presume you don't spend your days advocating nobody bother "because it's pointless anyway."
Technologies like specific CPU/SoC/chipset level hardware security zones, HSMs, use of IOMMUs and the like to prevent DMA from ports, etc. are all there in part to help prevent or mitigate certain physical attacks. For that matter, simple locks and/or sealing of computer units aids with both making attacks more difficult, slower (another key part of threat mitigation) and, just as importantly, making them noticeable. The final fallback of a good security system is to at least try to let the owner know that it broke if all else fails. There is a certain amount of disgruntlement amongst some tech people at highly sealed devices, but they do make it significantly more challenging to perform certain physical attacks quickly or undetectably.
So yes, anything which unexpected speeds up physical attacks, renders them less/unnoticeable, or both, is a legitimate issue. Normal users of portable systems should be able to expect that, under normal circumstances, they can warm lock it (screen lock, put it to sleep), leave for a few minutes, and have a low likelihood of a low energy persistent evil maid attack being pulled off in the mean time. Treating modern security like it only needs to consider servers stashed in a secured room/data center is wrong.
Say you go in for a job interview at a company and the interviewer leaves for a minute with their computer locked but still on their desk. Most traditional methods would require you to move to the other side of the desk or pull the computer to you which is risky, but with this you can just reach over for a few seconds.
Not to mention many traditional attacks require rebooting the computer to a bootable CD which will be suspicious if the user has an active login system and all the sudden all their apps are closed.
Or say you are at a doctor's office and there is no CD drive and rebooting the computer would be suspicious. I'm left unattended in exam rooms with computers all the time.
I also imagine it could be fairly easily modified to act like a USB hub and be inserted between the computer and a legitimate device.
Edit: Think of how less dramatic the scenes will be in Mr. Robot and the like if the "hacker" doesn't have to rush to get back to their seat just in-time for the target to get back to their desk.
I'd notice a new usb plugged in, but I wouldn't easily notice this.
This is the reason why keyboard/mouse connectors should look different to USB connectors, so we can tell the difference.
This is such a defeatist attitude, and it has also proven to be (mostly) false by Apple and its iPhones. If we stopped saying that every time there is a hack like this, perhaps companies would actually give a damn to make sure it doesn't happen anymore, or not nearly as easily.
It's one thing to pay from tens of thousands of dollars to a million for modification of a chip in a factory or with highly-advanced equipment, and it's quite another to just insert a USB stick into a random PC and hack it.
Has it?
https://www.washingtonpost.com/world/national-security/fbi-p...