67

This is my mouse. I used it with my old computer which was full of viruses.

If I use this mouse for my new PC, can my new computer be infected from my mouse?

  • 47
    Usb-devices are vulnerable to the BadUSB exploit. – Selenog Sep 21 '15 at 6:48
  • 10
    How do you know it's a regular mouse? A mouse is a USB device. Could you tell the difference if it wasn't just a mouse but also contained malicious devices? – Ben Sep 21 '15 at 8:08
  • 7
    c't (a German computer Magazin) once discovered mice offered as gifts were reacting to signs on mousepads. These mice then tried to send keyboard strokes to the computer. Of course the article is only in German and you can only read part if it. – idmean Sep 21 '15 at 12:04
  • 9
    @idmean: the article you linked was an april fool. This does, however, not change that it is theoretically possible for mice to carry arbitrary payloads. ;) – dst Sep 21 '15 at 22:39
  • 3
    In fact, you could easily weaponize this mouse to do just that, and then leave it for someone to find at work/school. – Dan Ross Sep 22 '15 at 13:16
81

USB devices as a rule, in principle, can carry viruses. But that doesn't mean that all USB devices are capable of carrying viruses, it just means that if you don't know where the device came from, then it you shouldn't plug it into your computer even if it doesn't look like a device that could transmit a virus.

That said, most mice (presumably including this one) don't contain any writable memory. So the mouse can't be modified by an infected computer. So if the mouse wasn't dangerous to begin with, then plugging it into a dangerous computer generally can't make it a dangerous mouse.


Interestingly, this particular mouse is unusual in that it does actually have some amount of memory in the form of programmable macros, actually stored on-device. This makes the device slightly more suspect -- a malicious piece of software could theoretically overwrite your macros. How that might translate into subversive behavior is anyone's guess, but for run-of-the-mill malware infections, transmission by way of this particular macro function is quite unlikely, if for no other reason than because this mouse is not very common.

There's some chatter about the possibility of overwriting the mouse's firmware so as to persist an attack. Flashing firmware was the basis for the Bad USB attack class. But this requires that the firmware be user-flashable. For most mice there's nothing to worry about. Adding a firmware modification feature to the USB connection is expensive and uncommon. But if you expect to see such a feature anywhere, it would be on overly complicated and expensive peripherals targeted at gamers.

The anatomy of such an attack would be, almost certainly, to emulate a keyboard and inject a script of keystrokes when you're not looking -- see the USB Rubber Ducky for how this works.

  • 42
    Modern mice tend to have writable firmware. Even the cheap pieces may be infectable - and the chance goes up for the more expensive ones. There's not a lot of space for any modern virus (disk formatters are kind of rare now :)), but we're living on the internet now - it's quite possible to fit in enough code to allow a HTTP download and run whatever executable. IIRC mouse drivers aren't kernel-mode anymore, but it's still a vulnerability (especially without UAC). Of course, it's still not very likely - it's too much effort on the wannabe-hacker's part. – Luaan Sep 21 '15 at 8:39
  • 4
    @Luaan Not to mention that each "hack" must be for a very specific device, firmware version, model, manufacturer, driver version, operating system and operating system version and build and hardware architecture and it's version. Just too many variables for someone to even try it. – Ismael Miguel Sep 21 '15 at 8:46
  • 22
    A mouse with the correct software could pretend to be a keyboard and send keystrokes to download and run software using common keyboard shortcuts. – Joe Sep 21 '15 at 9:42
  • 5
    @IsmaelMiguel But it could be used to target a specific victim, e.g. to enter a protected environment/network. USB sticks have been left in parking lots to do this, and a mouse would seem even more innocent. – dtech Sep 21 '15 at 14:50
  • 2
    @tylerl every micro I have worked with has some way to access the memory bus over USB. Also your assertion that "most mice (presumably including this one) don't contain any writable memory" is almost certanly wrong. – Sam Sep 21 '15 at 20:47
25

According to my post here, the memory of a mouse is too small to store a virus (plus, it is a read only memory). So in practice it is very difficult to get a mouse infected.

But still there have been a few cases where a mouse was used as an attack vector to infect not only one computer but a whole network thanks to the firmware contained within it that is automatically launched when the mouse is plugged to a computer. (Netragard’s Hacker Interface Device (HID))

  • 2
    Don't most mice contain a microprocessor, which does have memory? – Bergi Sep 21 '15 at 12:35
  • Depends on which type of mouse you talk about. If you are considering the normal mouse (the one with a ball, if I may say so), the answer is no. If you are talking about optic mice, the answer is yes, they have a processor integrated into an ASIC that drives a camera that takes pictures of a surface, records them to memory, and compares them against newer pictures and decides in which direction the device was moved. But the memory is too small to contain a malware as I said. The example I gave in my answer is about a mouse fabricated for the purpose to harm a client of Nefragard. @Bergi – user45139 Sep 21 '15 at 12:44
  • 2
    Do you have any justification or evidence for your statement that most mice do not have any memory? See Luuan's comment that most mice have writeable firmware. – D.W. Sep 21 '15 at 18:13
  • 2
    Huh? You write in the very first sentence of your answer that "Most mice do not have any type of memory.", but you claim you didn't say that? I don't follow you. Did you not write the answer that appears above your name? Sounds like you need to edit your answer to be a lot clearer about what you are and aren't saying. – D.W. Sep 21 '15 at 18:16
  • 3
    Again, I suggest that you edit your answer to clarify what you are trying to say, what the rationale for your statement is, and what assumptions you are making. Your answer says "Most mice", but now your comments suggest that maybe you are really talking about "Ball mice" and assuming that most mice are "ball mice". The right solution is not to continue with a back-and-forth in comments; the right solution is to edit your answer to be more explicit. P.S. I still would like to see what is the reason for claiming ball mice don't have writeable firmware. Do you have any evidence for that? – D.W. Sep 21 '15 at 18:24
9

The mouse you have linked contains a macro function, it could be used for malicious purposes, but a specific set of programmed inputs would need to be configured for a very specific attack on your environment, additionally the 6 buttons would need to be mapped to inputs as well.

The biggest risk would be any software that you install with the mouse which allows you to configure your mouse key mappings and programme the macros.

Although unlikely it not unheard for commercially available products to come packed with software that has secondary functions that you may not be aware of and could be considered malicious. The software itself could also contain vulnerabilities, that could be exploitable.

The real risks with any mice, keyboards or any other human interface device (HID) are the associated vectors which may be left exposed.

For example HID USB ports are typically left open, especially for a mouse and keyboard, even on assests that have USB interfaces locked down. These interfaces can be used with commercially avaliable products like the USB Rubber Ducky for malicious purposes. Additionally modified mice like Netragard USB project can also be used to attack a system.

Intermediary hardware devices could also be used to capture mouse inputs.

Additional vectors such as sniffing any radio communications on wireless mice and keyboards is also possible, but would require special hardware within close proximity.

Then there is the old spy movie stuff, mice tampered with to place trackers, microphones, loggers, etc, inside them. How much this has a place in reality I don't know, regardless the risk associated with it for most people is very low.

These are generic to all mice though and not just the one you linked to.

TLDR; Your mouse has a low risk of being used maliciously. Mice in general could be used to deliver malicious payloads, but the biggest risks with them is the associated attack vectors which may be exposed. Although the risk attached is low and typically physical access is required.

  • 1
    Most macro-function devices I'm aware of don't actually reprogram the device, they just tell the driver/controller to execute some additional function. – Clockwork-Muse Sep 21 '15 at 8:21
  • Yeah, absolutely and the mouse in question appears to operate exactly as you describe. This is the reason I highlighted the software that the mouse will use to operate. – TheJulyPlot Sep 21 '15 at 8:25
  • 1
    Yeah, but for the PC-side program to have any bearing in that case you'd have to transfer the data somehow, at which point you're asking "I transferred program data from A to B, could I be compromised". The macro function itself is a red herring, and is unlikely to be an additional vector when moving to a new machine. Telling the macro to execute an attack (say, open a command prompt) would require the same access as actually executing the attack, so isn't interesting. Distributing a malicious profile would work better, since most people don't check them like .bat files... – Clockwork-Muse Sep 21 '15 at 8:42
  • 1
    @Clockwork-Muse to support your point in only some cases: my macro-capable mouse is at home but my bluetooth presenter sends <winkey>+{ and <winkey>+} for it's programmable buttons, the software then carries out macros (limited testing as I use it on linux and don't have the windows CD here). However the mouse (a logitech G300) can be configured to send key combinations using the windows software, which then work under linux with no drivers. I don't think it can send sequences, but assigning "<winkey>+t; rm -rf ~/" would be a bad idea if it could. Your "all of them" assumption is shaky – Chris H Sep 22 '15 at 9:26
  • 1
    @ChrisH - Only some of them it is, then! – Clockwork-Muse Sep 22 '15 at 10:03
5

Tl;Dr; Can it? Absolutely. Will it? Probably not.

Can it contain a virus? Yes. That mouse, like most USB device, has a micro-controller in it. That micro-controller has non-volatile memory. It is likely that that non-volatile memory is writeable (for firmware updates, out of laziness by the designer, it was the cheapest part available that met requirements).

Could it be infected? Yes. Any software that has access to the driver can write to that memory, its likely the software running on the mouse itself would need to be reverse engineered but that would not be that hard.

Could it infect another computer? Yes. The firmware can easily upload a virus for example, it could also so something much more simple, like sending keyboard presses to the target computer.

Is it likely that it's infected? No. All of the above steps are very hard and therefore expensive. No one does hard and expensive work without expecting to earn value. There are two types of hackers, one those that want to make money, they will not attack mice as there are much easier and more profitable attack methods, two "goverment" agencies (think NSA), they want to either collect huge amounts of information (think phone data) or target specific organizations (think stuxnet), that mouse is not common enough for the former or specific enough for the latter.

3

This mouse will not probably act as a medium for transferring any data or infection unless its bugged with a separate device.
Why?
According to the product specifications:

512k in-store memory which macro function can use in different computers

This shows the presence of a storage location of size 512kb, pretty enough for having some infection dropper stored, but not for a very sophisticated one.(Probably directly user accessible memory?)
By new PC, assuming it has everything up-to-date and patched, will be secure also. While this device is connected and the drive is being accessed, surely the security program will scan the 'in-store' memory, which results in detection of infection traces and cleaning it. Well, it depends on the security software installed. That's the case if the memory location is accessible by user/system.

Now, if the memory is not user accessible, ie only the accompanying software has the right to access the memory to manipulate the key mapping data stored in there, probably it only has the right to modify or manipulate the data.
Suppose the infections from the previous system managed to store a dropper in the on-board memory, there must be some actor to trigger the infection to be launched. Since only the companion software can access the memory space, and if it accidentally accessed the dropper, it would not know how to use it and will throw an error.

The narrow case is, the dropper has specially crafted macro codes(used by the mouse software) and the software accessed it and tried to make changes according to the macro, you may be infected if those specially crafted macro codes can exploit the software and run commands (vb-scripts, for example). (Still the heuristic behavior shield of security software may catch that)

Usually programmable mouse and pointing devices have a separate tool/software to change the functions of various buttons, which must be installed on the machine in which you need to have the intended changes. Same is the case here, but with an on-board storage to reduce the inconvenience of remapping keys while migrating the device.

Macro functions: Macro functions are commands or key combinations being executed by a single button press. Useful for repetitive tasks.

  • 2
    It's worth mentioning that the Sharkoon FireGlider mice have their own internal memory which can be written to. These mice could easily contain malicious inputs, I use these to prank friends. – Hugo Zink Sep 21 '15 at 6:39
  • How do you know mice won't act as a medium? We look for answers that back up their conclusion with detailed justification, evidence, analysis, and/or reasoning. – D.W. Sep 21 '15 at 18:14
  • @ D.W I was referring to product mentioned in this topic only, not the advanced cases. – Nikhil_CV Sep 21 '15 at 18:23
  • We still want justifcation. You just state a conclusion, but you do not provide any evidence, analysis, or details to back up your conclusion. Saying "I'm only referring to the one product mentioned in the question" is not responsive and does not change the expectation to provide those kinds of details. – D.W. Sep 22 '15 at 6:20
  • @ D.W. Kindly recheck if that's okay. ☺ – Nikhil_CV Sep 22 '15 at 16:51

protected by Community Feb 5 '17 at 15:45

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.