10 ms·
What are malicious USB keys and how to create a realistic one?
- Palomides 10y agoIt's interesting to see mention of 0-days against USB drivers as a vector, says "AFAIK, none of those have been publicly discussed." It seems very likely there are vulnerable drivers.
- blockoperation 10y agoBlock layer or filesystem driver vulnerabilities would be even better – no special hardware needed. Just buy a load of cheap flash drives, copy over your malicious partition table or filesystem, and you're set.
- jotux 10y agoMaking a mold and casting a custom case seems incredibly cumbersome compared to just buying a USB key case and fitting the board into it: http://www.mouser.com/New-Age-Enclosures/Enclosures/Enclosures-Boxes-Cases/_/N-5g3p?P=1z0s1a1Z1z0vnv0 http://www.mouser.com/New-Age-Enclosures/Enclosures/Enclosur...
- throwaway2016a 10y agoIf you look closely there might be two issues with that. First the device that was used doesn't have the USB connector centered and second, the board sticks out the edge a little so I would guess that it would need a larger than normal case.
- ajford 10y agoI think the parent might have been suggesting to develop your own board. Using something like a USB enabled Atmel chip (ATMega32u2) should be relatively simple, and there are plenty of HID libraries out there for it. If you were trying for a bulk attack, or had the funds, this would be by far the best solution.
- Sanddancer 10y agoEven a non-bulk attack can be done pretty cheaply these days. Places like seeed will do boards for a buck a piece if your design's small enough and you get a ten pack. Doing smt work is honestly more bark than bite compared to pth; a $20 toaster oven will work Well Enough for something like this.
- jotux 10y agoFor small run electronic prototyping it's hardly worth stuffing your own boards any more. Macrofab or circuithub can get you fully assembled boards in a few weeks in the $20-$50/unit range.
- yakult 10y agoEven easier: just buy a cheap usb stick of correct size, preferably one with a recognizable brand, open it up and replace the innards.
- gwu78 10y ago"(I didn't know about it!)" The reference is to the existence of /dev/tcp when using the "Bourne again" shell. Some other large shells, and gawk, have this "feature" as well. Then I noticed he is head of something technical at Google. We are always reading about the rigor of this company's interviews in testing candidates for practical knowledge. I guess knowledge of important capabilities of widely/universally installed software is not something they are testing for? I mean, I am sure there are probably hundreds of employees there who know these things. And they have some legendary programmers on the payroll. It is like a miniature Hall of Fame of computer programming. I am not even sure what this all means, but I find it interesting to see the gaps in knowledge considering jobs with this company are so highly sought after. And they are entrusted with protecting an enormous quantity of other people's data.
- detaro 10y ago"important capabilities"? It's a fairly exotic feature nearly nobody is actually using, so the only people I'd expect to know about it are old-timey sysadmins and security people who've looked into stuff like discussed in the article. And while "lead of the anti-abuse team" is a security role, there are many possible backgrounds where you'd never come across this, and anti-abuse likely is working on a higher level. Testing for stuff like that would be worse trivia checks than the algorithm-bingo people like to complain about in Google developer interviews.
- jerf 10y agoI just checked. The only presence of this feature in the Bash man page is under REDIRECTION with the following, as the fifth and sixth elements of the list: /dev/tcp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, bash attempts to open the corresponding TCP socket. /dev/udp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, bash attempts to open the corresponding UDP socket. It's not a feature with a large documentation footprint. I've known about it for a while, but mostly only in the context of security too. I have wondered whether the majority use of this feature is to provide hacked network shells before. It's probably a feature that never should have been added, though I understand the initial appeal.
- rwmj 10y agoIf one finds a USB key in a parking lot, is there any safe way to find out what's on it?
- stcredzero 10y agoPlug it into a machine you don't care about?
- puddintane 10y agoSand-boxed environment I would have to say. But as the article states this attack vector could become more sophisticated (if it has already not gotten to this level for sectors that can afford this). If anything I would say it's not worth it all, just turn it in to your nearby local law enforcement or trash it, not worth what could be the last thing you plug into your computer.
- detaro 10y agomost paranoid I can think of: Use an Atmel AVR (Harvard architecture means no code execution, and it doesn't have low-level firmware that could be vulnerable) to read the filesystem and sanitize data, then feed it over serial to a host machine to analyze? If you trust your hardware and VM hypervisor to be secure, pass the USB controller to a VM?
- puddintane 10y agoI'm wondering if even this route is no longer safe - stcredzero comment [1] points out things that could be added to completely circumvent even a system that is essentially "off-the-grid" or just uses the USB for power. [1] https://news.ycombinator.com/item?id=12694843 https://news.ycombinator.com/item?id=12694843
- detaro 10y agoRight, you can't tell if there is a hidden malicious component that hasn't been activated yet. You can extract assumed non-malicious data without giving a malicious component the ability to do anything, if it hasn't an build-in data exfiltration channel (microphone and wireless transmitter could spy on you without attacking your system)
- stcredzero 10y agoA HID-based attack has to spawn a terminal and very quickly inject a set of commands that is very visible but only for a short period of time. Once the attack has been carried out, there is nothing left to see, so this type of attack is less obvious than the social engineering one. MEMS microphones are tiny. It should be possible to combine data from that and a light sensor, that would make an HID based attack far less likely to be detected. The frequency profiles of keystrokes and someone pushing away an office chair should be fairly easy do discern. You'd want to make it more likely that the attack would occur after someone had left their desk. (Hopefully with the machine unlocked.) EDIT: Another idea: The USB key uses autorun to pop up what looks like a spammy ad for a PC "cleaner" utility, or something you'd expect on a USB key conference swag item. It's actual purpose is to cover up the shell's window, or to contain the exploit itself.
- besselheim 10y agoAnother approach - controlling the USB device over WiFi, so it can be remotely triggered at any time: https://www.sensepost.com/blog/2016/universal-serial-abuse/ https://www.sensepost.com/blog/2016/universal-serial-abuse/
- Relys 10y agoI recently made a few of these with Cactus Micro Rev2's. :D
- ben174 10y agoI think it would be unlikely that the user would step away from his machine before unplugging the device. If it was discovered on the ground, I would think the likely sequence of events is: 1.) plug in, 2.) open finder, notice nothing of interest. 3.) unplug, 4.) discard
- stcredzero 10y agoSo then, one tactic would be to fill it with nested folder after folder of something that might be interesting. Like "Studio Rough.mp3" If you make it large enough, a lot of people will procrastinate going through it all.
- DeepYogurt 10y agoRelevant to this discussion: https://www.crowdsupply.com/inverse-path/usb-armory https://www.crowdsupply.com/inverse-path/usb-armory
- mschuster91 10y agoThere's a fourth class of malicious USB keys: those which discharge -100V across the USB data lines, aka "usb killers". Drop a couple of these on a huge parking lot to create a boatload of damage.
- lightedman 10y agoMost ICs can handle at least -3000V static discharge. You need to pump about -5000V to start doing real damage. Even LEDs are so robust now days as to take 3X-5X their rated forward voltage as reverse voltage regardless of what their spec sheet says; I make 120V rectifiers from strings of them all the time.
- morcheeba 10y agothe killers don't do a low-current static discharge; they do high-current through the protection diodes and seriously mess things up. https://www.youtube.com/watch?v=3hbuhFwFsDU https://www.youtube.com/watch?v=3hbuhFwFsDU
- yuubi 10y agoThe 3 kV rating is most likely 3 kV on a human body model, which is a small capacitor (few picofarads) with a series resistor. This says nothing about what happens if you charge a large capacitor to 100v and then dump it through as low a resistance as possible into the victim port.
- lazaroclapp 10y agoMeh, a couple tens of thousands of dollars in destroyed equipment via a very crude vandalism attack. Sounds like a lot until you realize you can cost someone millions with a medium sized botnet and a long standing DDoS. For most large targets, a USB that fries a laptop or two is no big deal (assuming automatic backups or devserver or etc), one that installs a rootkit would be a much worse scenario. Also, if you are talking about harming individual users, and you are the kind of person who would drop "killer" USB drives on a parking lot, how is that any different from just keying every car? You get no benefit, it only causes damage, it takes near zero sophistication and the end results is it costs people a bunch of money and police start an investigation for vandalism.
- s_kilk 10y agoA few years ago, a co-worker came back from a MongoDB event with a bag of swag, including a MongoDB branded USB drive. When he plugged it in, it acted as a keyboard and managed to open the browser to a MongoDB promotional page. Needless to say he freaked out a bit. Some marketing goons (not restricted to the people at MongoDB) seem to think this kind of thing is a great promotional tool. Now that I think of it, my wife has a similar story about her University distributing this same kind of USB/botnet thing to students.
- ubernostrum 10y agoWho needs USB keys? If you have Python (and preferably a handy virtualenv so you can throw it away afterward), do `pip install rickroll`. It will do exactly what it sounds like it should do.
- PokeAcer 10y agoI'm surprised nobody has made something for testing; how much would it take to make something you plug a USB into and see what it does? (I.E. "USB is typing"/"USB is doing")
- thatcat 10y agoThere is usbpcap which captures all the packets.
- Sanddancer 10y agoA zero-day key wouldn't have hardware costs that would be significantly different from an HID key. A lot of microcontrollers will gladly announce themselves to be whatever sort of device class you want them to be, and which vendor and device IDs to use. Also, if you're worried about bulk, putting an LED or something that flashes and looks pretty would also lower peoples' guards as to why it's so big. USB hacking is an area where there are wide open fields to play with.
- achr2 10y agoA really sneaky method would be to create a USB suppository, that looked like a large USB key but would leave the active part inserted inside the socket after the target pulls out the seemingly defective key.
- mablap 10y agoAnd how is the port supposed the stay functional upon removal of the key? The point of this attack is stealth.
- shawkinaw 10y agoAnother good reason to run something like Little Snitch. Of course it's also another good reason not to plug random USB keys into your computer. It also seems to me like your OS should warn and confirm when a new input source is detected.
- cheiVia0 10y agoHe forgot the electrical attacks; fry your motherboard with a malicious USB device.
- Philipp__ 10y agoI think that was not the point of this, let's call it "experiment". Although I saw on Hackaday some "USB devices" that held huge capacitors in them, so when you plug it in, caps would discharge and your motherboard would be damaged.
- greggman 10y agoThis might be a dumb question but wouldn't one solution to the HID-based attack be for the OS to ask the user for permission to allow the new keyboard? As in "New Keyboard Detected: Allow? Y/N" That wouldn't protect against driver 0 days but hey, one step at a time. Do any OSes have an option to ask the user if connection is ok before allowing it?