4 ms·

First thought I had: Very cool! Second thought: If I received this card, I would think twice about attaching a homemade USB device to anything. Who knows what

First thought I had: Very cool! Second thought: If I received this card, I would think twice about attaching a homemade USB device to anything. Who knows what it might do? [1] Third thought: I should let people I know that this is becoming possible. Fourth thought: Wait a minute, any USB device is potentially risky, not just homemade ones. Carry on! .. 1. https://usbkill.com/ https://usbkill.com/

JohnFen 3y ago
> If I received this card, I would think twice about attaching a homemade USB device to anything. I have a Raspberry Pi devoted to the purpose of plugging unknown USB devices into in order to do a security check on them. If it kills the R-Pi, no big deal. If it doesn't, then you have the power of Linux to interrogate the device with and spot suspicious behavior.
- kid64 3y ago
  That's interesting, may I ask how you'd typically perform the interrogation?
  - an_aparallel 3y ago
    im interested too... im guessing there's some Kali linux utils for doing just this?
    - JohnFen 3y ago
      Kali is convenient in that it has security tools preinstalled (it's what I use in my pentesting gear), but this can be done with any distro. Primarily what I'm looking for is if the capabilities of the device match what I expect them to be (does this flash drive -- or even just a random USB cable -- also represent itself as a user input device?), and to spy on the USB packets for things like keystroke replay, bitstreams that don't match what would be expected (virii installations, unusual behavior if the storage device thinks that it is being booted from, etc.) It is not comprehensive. Just a sanity check.
- hathawsh 3y ago
  If I were paranoid, I might be concerned that the USB device would detect when it's plugged in to a small device like a Raspberry Pi and only launch its attack when it's plugged in to a more valuable target. Is there some way to mitigate that?
  - bpye 3y ago
    Different operating systems also have subtle differences in enumeration - I don’t think there is a great way to mitigate that.
  - lcnPylGDnU4H9OF 3y ago
    > then you have the power of Linux to interrogate the device with and spot suspicious behavior Ideally, you’d find the malicious payload. It’s probably not hidden so well that it can’t be found by a security researcher.
    - JohnFen 3y ago
      True, if I care. I use the R-Pi as a screening method, not really as the means to dig into something malicious and analyze it in detail. I have other tools for that. My reasoning for using the R-Pi is that it's disposable, so if the USB device turns out to be an electrical USB-killer, it doesn't kill any hardware that really matters to me.
  - JohnFen 3y ago
    > Is there some way to mitigate that? Against a very sophisticated attacker? Maybe not, but it doesn't matter for my purposes. My concern is the most likely kinds of attacks, which are not terribly sophisticated. It's really more of a sanity check than a comprehensive security audit. No security can ever be 100% effective. Like all security measures, this is just one layer intended to cover attacks I am most likely to be exposed to. In other words, if I'm protecting against governments and other well-funded entities or skilled and determined hackers, I wouldn't be using this alone. I'd be using it in conjunction with other security processes, such as not attaching unknown USB devices to my systems at all, or at least not to ones that matter or aren't permanently isolated from my other machines.
nine_k 3y ago
Iwonder if a $15 USB hub could serve as an adequate protection against electric shenanigans.
- DistractionRect 3y ago
  Who says the hub isn't the one hosting the shenanigans?
  - squarefoot 3y ago
    If one buys it from a reputable source it should be safe. Besides, who says that the binary firmware blobs in the computer don't already contain suspicious code?
nonrandomstring 3y ago
A student of mine was researching "vendor malware" [0] she decided to order as many random, dodgy USB devices as could be found on the internet to see what percentage of them were loaded with horrors. We settled on a CRU Wiebetech write blocker and a minimal sandboxed distro (that could reboot to a clean slate in a couple of seconds) with little more than a kernel for which we could activate and deactivate USB modules. Conclusions: USB is terrifying! :) Buying USB things in the internet is even more scary!! [0] https://www.solent.ac.uk/degree-shows/students/helen-plews-2 https://www.solent.ac.uk/degree-shows/students/helen-plews-2
- pests 3y ago
  Interesting. I expected already used and returned devices but seeing hidden possible firmware and encrypted blobs was a surprise.
  - epcoa 3y ago
    Don’t have the time to dissect the linked PDF, but it has numerous issues including methods that are imprecise, misapplied or simply wrong. It needs a pretty extensive review by an expert. The file signature listings shown on page 80 are most likely spurious (false matches). The first give away is why there would be over 2000 microcode artifacts, the next is that all of the inspected fields are bogus, including the size field (some in the GBs). In theory you could purposefully obfuscate that, but then why would you carry any tell of microcode at all. Much more likely this is just patterned data that happens to match that file magic. Anybody with experience with binwalk knows how common this is. Same goes for the mcrypt(?) headers. Blowfish 448 CBC 8-bit happens to be all 0s. Another very common false positive (matches \x00m\x02). Also look at the offsets carefully. Seems more like a match confusion. As for encrypted appearing data at all, not too surprising if someone is selling used drives and naively wiped them. But it isn’t clear that encrypted vs compressed data was identified. There’s also a fundamental misunderstanding of what a write blocker is/does repeated. "Results indicated the presence of firmware ... in the machine code of the unallocated spaces of the storage device.". Machine code of the unallocated spaces makes no sense. In general: microcode attacks are sophisticated attacks. Anybody carrying these out is unlikely to leave such an obvious smoking gun. Not saying impossible, but it would give any serious researcher pause to scrutinize their work. Also not saying you won’t get shitty crap from random sellers and should buy random junk, but I’d take this paper with a large grain of salt.
rantingdemon 3y ago
Yes exactly. No security conscious person I know would just plug in some unknown USB device. It's a very, very well known attack vector. If the point of the exercise is a proof of concept as an expirement then awesome. If it's supposed to be something you can hand out to stakeholders as a business card then it's probably not that useful.

JohnFen 3y ago

> If I received this card, I would think twice about attaching a homemade USB device to anything. I have a Raspberry Pi devoted to the purpose of plugging unknown USB devices into in order to do a security check on them. If it kills the R-Pi, no big deal. If it doesn't, then you have the power of Linux to interrogate the device with and spot suspicious behavior.

kid64 3y ago
That's interesting, may I ask how you'd typically perform the interrogation?
- an_aparallel 3y ago
  im interested too... im guessing there's some Kali linux utils for doing just this?
  - JohnFen 3y ago
    Kali is convenient in that it has security tools preinstalled (it's what I use in my pentesting gear), but this can be done with any distro. Primarily what I'm looking for is if the capabilities of the device match what I expect them to be (does this flash drive -- or even just a random USB cable -- also represent itself as a user input device?), and to spy on the USB packets for things like keystroke replay, bitstreams that don't match what would be expected (virii installations, unusual behavior if the storage device thinks that it is being booted from, etc.) It is not comprehensive. Just a sanity check.
hathawsh 3y ago
If I were paranoid, I might be concerned that the USB device would detect when it's plugged in to a small device like a Raspberry Pi and only launch its attack when it's plugged in to a more valuable target. Is there some way to mitigate that?
- bpye 3y ago
  Different operating systems also have subtle differences in enumeration - I don’t think there is a great way to mitigate that.
- lcnPylGDnU4H9OF 3y ago
  > then you have the power of Linux to interrogate the device with and spot suspicious behavior Ideally, you’d find the malicious payload. It’s probably not hidden so well that it can’t be found by a security researcher.
  - JohnFen 3y ago
    True, if I care. I use the R-Pi as a screening method, not really as the means to dig into something malicious and analyze it in detail. I have other tools for that. My reasoning for using the R-Pi is that it's disposable, so if the USB device turns out to be an electrical USB-killer, it doesn't kill any hardware that really matters to me.
- JohnFen 3y ago
  > Is there some way to mitigate that? Against a very sophisticated attacker? Maybe not, but it doesn't matter for my purposes. My concern is the most likely kinds of attacks, which are not terribly sophisticated. It's really more of a sanity check than a comprehensive security audit. No security can ever be 100% effective. Like all security measures, this is just one layer intended to cover attacks I am most likely to be exposed to. In other words, if I'm protecting against governments and other well-funded entities or skilled and determined hackers, I wouldn't be using this alone. I'd be using it in conjunction with other security processes, such as not attaching unknown USB devices to my systems at all, or at least not to ones that matter or aren't permanently isolated from my other machines.

nine_k 3y ago

Iwonder if a $15 USB hub could serve as an adequate protection against electric shenanigans.

DistractionRect 3y ago
Who says the hub isn't the one hosting the shenanigans?
- squarefoot 3y ago
  If one buys it from a reputable source it should be safe. Besides, who says that the binary firmware blobs in the computer don't already contain suspicious code?

nonrandomstring 3y ago

A student of mine was researching "vendor malware" [0] she decided to order as many random, dodgy USB devices as could be found on the internet to see what percentage of them were loaded with horrors. We settled on a CRU Wiebetech write blocker and a minimal sandboxed distro (that could reboot to a clean slate in a couple of seconds) with little more than a kernel for which we could activate and deactivate USB modules. Conclusions: USB is terrifying! :) Buying USB things in the internet is even more scary!! [0] https://www.solent.ac.uk/degree-shows/students/helen-plews-2 https://www.solent.ac.uk/degree-shows/students/helen-plews-2

pests 3y ago
Interesting. I expected already used and returned devices but seeing hidden possible firmware and encrypted blobs was a surprise.
- epcoa 3y ago
  Don’t have the time to dissect the linked PDF, but it has numerous issues including methods that are imprecise, misapplied or simply wrong. It needs a pretty extensive review by an expert. The file signature listings shown on page 80 are most likely spurious (false matches). The first give away is why there would be over 2000 microcode artifacts, the next is that all of the inspected fields are bogus, including the size field (some in the GBs). In theory you could purposefully obfuscate that, but then why would you carry any tell of microcode at all. Much more likely this is just patterned data that happens to match that file magic. Anybody with experience with binwalk knows how common this is. Same goes for the mcrypt(?) headers. Blowfish 448 CBC 8-bit happens to be all 0s. Another very common false positive (matches \x00m\x02). Also look at the offsets carefully. Seems more like a match confusion. As for encrypted appearing data at all, not too surprising if someone is selling used drives and naively wiped them. But it isn’t clear that encrypted vs compressed data was identified. There’s also a fundamental misunderstanding of what a write blocker is/does repeated. "Results indicated the presence of firmware ... in the machine code of the unallocated spaces of the storage device.". Machine code of the unallocated spaces makes no sense. In general: microcode attacks are sophisticated attacks. Anybody carrying these out is unlikely to leave such an obvious smoking gun. Not saying impossible, but it would give any serious researcher pause to scrutinize their work. Also not saying you won’t get shitty crap from random sellers and should buy random junk, but I’d take this paper with a large grain of salt.

rantingdemon 3y ago

Yes exactly. No security conscious person I know would just plug in some unknown USB device. It's a very, very well known attack vector. If the point of the exercise is a proof of concept as an expirement then awesome. If it's supposed to be something you can hand out to stakeholders as a business card then it's probably not that useful.