5 ms·

I have been thinking about creating an active "USB Condom" for a while, and this might be the right time to work on it. It would be pretty straight forward to m

I have been thinking about creating an active "USB Condom" for a while, and this might be the right time to work on it. It would be pretty straight forward to make a device that sits between a PC and a USB device and monitors the traffic. It could allow only certain device classes, or it could ask you to press a button for each file moved. My original thought was to stop the spread of viruses that are designed to move between computers over USB drives (my last job had a lot of trouble with these), but preventing it from showing up as a HID would also be useful in this case. One option would be to build this into the chassis of a PC so that you know anything plugged into the green USB port will only work as a drive.

chrisBob 12y ago
Perhaps its time for me to create a KickStarter account.
- daveloyall 12y ago
  Bonus points for a "keyboard macro" mode.
drivingmenuts 12y ago
You mean like this? http://syncstop.com/ http://syncstop.com/
- chrisBob 12y ago
  I knew someone would mention that, and I almost put a note about it in my post. I think all that does is disconnect the data pins, so it wouldn't be too useful when you are attaching a flash drive to your computer.
  - drivingmenuts 12y ago
    Good point. However, if the exploit is in the bios of the usb device, you can't trust anything coming off of it. All you've got left is recharging it.
- 300bps 12y ago
  Interesting but in a bit of irony I don't need that at all. I use a Windows Phone 8 device. Targeting it for malware is a waste of time.
- mahyarm 12y ago
  Might as well merge it into 2 functions and just carry a usb battery
McGlockenshire 12y ago
You aren't the first with that idea, though hopefully you have enough knowledge to pull it off. It'd probably be more simple to just make one type for each class of device: http://en.wikipedia.org/wiki/USB#Device_classes http://en.wikipedia.org/wiki/USB#Device_classes It should be easy enough to train my users to only put their thumb drives into the one specific port. The rest are gonna get sealed off with hot glue at this rate...
esteth 12y ago
This'd give you an artificial sense of security though. There's nothing stopping the device's firmware from injecting exploits into files that you put onto the device. So you tell the device to store workReport.pdf, and it stores workReport.pdf, but also injects a malicious payload into the PDF so that when you open it again it infects you.
- FreeFull 12y ago
  There is also the potential of the USB condom itself getting infected with the malware.
dguido 12y ago
done: http://goodfet.sourceforge.net/hardware/facedancer11/ http://goodfet.sourceforge.net/hardware/facedancer11/
- TeMPOraL 12y ago
  I've seen that before, but I still have no clue what this is supposed to do, and the website doesn't really explain anything. Could you please elaborate on what this device is actually for?
  - noselasd 12y ago
    It's a device, mostly intended for research purposes, that proxies the USB protocol back up to a python program/library. Basically you plug in USB at one end, at the other end you can script the USB protocol with python, emulating any USB device you want to (or that you can write the code for).
shabble 12y ago
You're talking about essentially an HW firewall for USB connections. We can discount VID/PID based black/whitelisting since they're trivial to spoof, but it might be possible to use them to identify (from an external database) what features that V/P device is supposed to be capable of, and block/alert if it tries to do things it shouldn't. So if you initially enumerate as 0x0403/0x6001 (FTDI usb-serial) then if you try to start serving up descriptors about how you totally do mass-storage or something, that's probably kinda naughty. You'd potentially need quite a bit of code to parse and decode the various protocols it might be observing, giving a really big code surface for an attacker to identify or compromise your 'condom' itself. So, with a lot of work, and a really big and annoying to update database, it might be possible to protect against imposter/multi-personality devices. The bigger overall threat though is probably masquerading as valid mass-storage, but then doing various things to the data you're asked to store/fetch. (See the Active anti-forensics iPod and similar) As I see it, there's basically nothing you can do here against an actively hostile device that isn't a cat & mouse game of exploit->patch->repeat. Conceivably the OS could sign every file going in, and maintain a local cache of signatures to check when reading, but that falls over in the hugely predominant use-case of using a USB drive to transfer files between things; you have no easy side-channel to also transfer sigs. So then the machines need to trust each other (without the malicious drive compromising one and being able to fake sigs)

chrisBob 12y ago

Perhaps its time for me to create a KickStarter account.

daveloyall 12y ago
Bonus points for a "keyboard macro" mode.

drivingmenuts 12y ago

You mean like this? http://syncstop.com/ http://syncstop.com/

chrisBob 12y ago
I knew someone would mention that, and I almost put a note about it in my post. I think all that does is disconnect the data pins, so it wouldn't be too useful when you are attaching a flash drive to your computer.
- drivingmenuts 12y ago
  Good point. However, if the exploit is in the bios of the usb device, you can't trust anything coming off of it. All you've got left is recharging it.
300bps 12y ago
Interesting but in a bit of irony I don't need that at all. I use a Windows Phone 8 device. Targeting it for malware is a waste of time.
mahyarm 12y ago
Might as well merge it into 2 functions and just carry a usb battery

McGlockenshire 12y ago

You aren't the first with that idea, though hopefully you have enough knowledge to pull it off. It'd probably be more simple to just make one type for each class of device: http://en.wikipedia.org/wiki/USB#Device_classes http://en.wikipedia.org/wiki/USB#Device_classes It should be easy enough to train my users to only put their thumb drives into the one specific port. The rest are gonna get sealed off with hot glue at this rate...

esteth 12y ago

This'd give you an artificial sense of security though. There's nothing stopping the device's firmware from injecting exploits into files that you put onto the device. So you tell the device to store workReport.pdf, and it stores workReport.pdf, but also injects a malicious payload into the PDF so that when you open it again it infects you.

FreeFull 12y ago
There is also the potential of the USB condom itself getting infected with the malware.

dguido 12y ago

done: http://goodfet.sourceforge.net/hardware/facedancer11/ http://goodfet.sourceforge.net/hardware/facedancer11/

TeMPOraL 12y ago
I've seen that before, but I still have no clue what this is supposed to do, and the website doesn't really explain anything. Could you please elaborate on what this device is actually for?
- noselasd 12y ago
  It's a device, mostly intended for research purposes, that proxies the USB protocol back up to a python program/library. Basically you plug in USB at one end, at the other end you can script the USB protocol with python, emulating any USB device you want to (or that you can write the code for).

shabble 12y ago

You're talking about essentially an HW firewall for USB connections. We can discount VID/PID based black/whitelisting since they're trivial to spoof, but it might be possible to use them to identify (from an external database) what features that V/P device is supposed to be capable of, and block/alert if it tries to do things it shouldn't. So if you initially enumerate as 0x0403/0x6001 (FTDI usb-serial) then if you try to start serving up descriptors about how you totally do mass-storage or something, that's probably kinda naughty. You'd potentially need quite a bit of code to parse and decode the various protocols it might be observing, giving a really big code surface for an attacker to identify or compromise your 'condom' itself. So, with a lot of work, and a really big and annoying to update database, it might be possible to protect against imposter/multi-personality devices. The bigger overall threat though is probably masquerading as valid mass-storage, but then doing various things to the data you're asked to store/fetch. (See the Active anti-forensics iPod and similar) As I see it, there's basically nothing you can do here against an actively hostile device that isn't a cat & mouse game of exploit->patch->repeat. Conceivably the OS could sign every file going in, and maintain a local cache of signatures to check when reading, but that falls over in the hugely predominant use-case of using a USB drive to transfer files between things; you have no easy side-channel to also transfer sigs. So then the machines need to trust each other (without the malicious drive compromising one and being able to fake sigs)