1

Can a USB-based atack, e.g., BadUSB, RubberyDucky be detected by observing the output from dmesg?

I bought a brand new DFRobot Beetle, which is essentialy a miniaturized Leonardo. A few seconds after plugging it in, the USB keyboard I'm using stops working. It's possible that it may have been caused by low power, but checking the output from dmesg, I noticed that the device is detected and disconnected three times without being physically moved.

What is most interesting is that Mfr and product changes twice:

[Tue Jan 15 09:42:54 2019]usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0

[Tue Jan 15 09:43:18 2019]usb 1-1.2: USB disconnect, device number 6

...

[Tue Jan 15 09:43:19 2019]usb 1-1.2: new USB device found, idVendor=2341, idProduct=0036

[Tue Jan 15 09:43:19 2019]usb 1-1.2: New USB device strings: Mfr=2, Product=1, SerialNumber=0

[Tue Jan 15 09:43:18 2019]usb 1-1.2: USB disconnect, device number 7

...

[Tue Jan 15 09:43:19 2019]usb 1-1.2: new USB device found, idVendor=2341, idProduct=8036

[Tue Jan 15 09:43:19 2019]usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3

In addition, idProduct also changes briefly.

Initially, I thought maybe the had become loose and so was detected several times, but after rebooting and checking dmesg again, it was not shown to be disconnected even when I wiggled the device around in the USB port. The second set of values, i.e., Mfr=2, Product=1 and idVendor=2341, idProduct=0036 also never show up.

Is all this normal or is this possibly signs of a USB-based attack?

Improve this question

1 Answer 1

Reset to default
1

What you describe is pretty normal. I would suspect that the device has a driver that is installed upon initial connection. When a driver is installed it can disconnect device a few times. After the device driver is installed it will then be properly recognized hence no more installation and disconnections. You can always remove the driver, and debug USB port to see what is happening in the background.

Improve this answer
2
  • I've heard of something like this happening on Windows systems, but since almost any driver you need would most probably already be installed on Linux in some form, does that also happen on Linux? Also, since this is a simple usb device using dwc_otg, could that be the case here?
    – user942937
    Commented Jan 18, 2019 at 9:36
  • I think this will help you understand this behavior: kernel.org/doc/html/v4.13/driver-api/usb/hotplug.html
    – nethero
    Commented Jan 18, 2019 at 13:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .