Circlean

Looks like they don't, but they turn off usbhid on that particular port: https://github.com/CIRCL/Circlean/blob/master/circlean_fs/ro... However, that could be bypassed if the USB key acted like a USB hub with a keyboard attached. If you do get a keyboard working, it looks like you can just log in with raspberry / raspberry and then full privileged access since sudo from the raspberry user, and /dev/kmem from root is enabled. That would allow arbitrary content to be copied on to the user supplied USB, and depending on the device, possibly firmware reprogramming.

Oh, you are right, this can be bad. But I doubt that CIRCLean does any of the badUSB mitigations. They could fix all of these including the instructions. But that they copy unrecognised binaries ("Octet-stream" in their readme) without marking them dangerous is the most worrisome for me [1]. It seems to be useful only for office documents. [1] https://github.com/CIRCL/Circlean

But it's the assumption that is in itself inaccurate. Case #1 is about a modified firmware of the USB controller in the USB stick, case #2 assumes that a boot is initiated from the USB stick. What the Circlean thingy does is more similar to an antivirus, it examines the contents (files) on the USB stick filesystem and only copies to the second stick those files of known type, according to the given rules. Whether this is effective against everything is another thing, of course. Only "plain" files are directly copied, other supported ones are analyzed and converted, some more detiled info is here: https://github.com/CIRCL/Circlean/blob/master/README.md The thing is not really "new": https://news.ycombinator.com/item?id=8216853

> The code runs on a Raspberry Pi (a small hardware device), which also means it is not required to plug the original USB key into a computer. This may be splitting hairs, but a Raspberry Pi is a computer. From https://www.raspberrypi.org/ > The Raspberry Pi is a tiny and affordable computer that you can use to learn programming through fun, practical projects. The actual project page - https://github.com/CIRCL/Circlean