156

We all know the story of the USB drive left outside a power plant which was found by a worker and inserted into a computer to see the contents which then allowed a hack to ensue.

Here is my question, how? I get that code is executed but how? I would really like to be able to do this (for my own curiosity of course). I have always had a good grasp on security how to make things secure etc etc but things like viruses, trojans, USB drivers... how are they activated with little human interaction?

I would really like to learn about these things, I am a programmer/sys admin so would like to knock up a script but having never been taught or never have done it I don't know how or where to begin. I would really like a big discussion on this with as much information as possible.

219

Take a look at this USB keyboard:

Rubber Ducky USB Device

"But that's not a keyboard! That's an USB drive, silly!"

Actually, no. It looks like a USB drive to you, but when it gets connected to a computer, it will report that it is a USB keyboard. And the moment it is installed, it will start typing key sequences you programmed on it beforehand. Any operating system I know automatically trusts USB keyboards and installs them as trusted input devices without requiring any user interaction the moment they are connected.

There are various payloads available for it. For example, there is one which types the keyboard input to open a shell, launches WGET to download a binary from the Internet, and runs it.

  • 37
    Also... this.... (ouch!) grahamcluley.com/2015/10/usb-killer – GreatSeaSpider Oct 16 '15 at 11:57
  • 10
    If USB HID devices had to be approved before they could be installed, installation might be a bit tricky! "I've just split coffee on my keyboard. Never mind here's a spare"->"To install new hardware you need to authenticate. Enter your password". Solving this would be interesting. – Chris H Oct 16 '15 at 12:19
  • 8
    It wouldn't be too hard to have a hub and storage in there as well, then you'd need very sharp eyes to spot the extra installation, as the expected drive would appear. – Chris H Oct 16 '15 at 12:21
  • 13
    @ChrisH you might be laughing about it, but that would actually be a solution: any new keyboards first need to enter the password of the user that is currently logged before they can enter anything else. They are installed, but before they can be used, you need to prove it's actually a keyboard. – Nzall Oct 16 '15 at 13:42
  • 22
    @NateKerkhofs, I'm not laughing. Enter the username of the current user might work if you did it after installation. Admin/root PW as for normal installation would be less appealing. Maybe better: enter a random string displayed on screen a bit like bluetooth pairing (I'm wary of getting users to type passwords unexpectedly). I was thinking the hardware would be blocked until the password was entered like in normal hardware installation (basically treat a keyboard like other stuff). – Chris H Oct 16 '15 at 14:31
27

A famous example of what you are asking about is this advisory from Microsoft. The vulnerability referred to is triggered just by inserting the USB stick; no other interaction from the user is required. This is how the Stuxnet virus spread - see e.g. reports from Symantec and F-Secure.

  • 2
    Isn't that vulnerability patched for several years now? – Philipp Oct 16 '15 at 11:50
  • 7
    @Philipp: Besides that there are many unpatched systems out there (ATMs anyone?) what reason is there to believe that there aren't countless similar vulnerabilities that sell for millions on the black market... – PlasmaHH Oct 16 '15 at 13:05
  • 2
    @Philipp That exact vuln was patched in 2010, poorly. See extremetech.com/computing/… for the rest of the story. Attacks almost exactly like the one used by Stuxnet were possible until this year, and attacks that are similar but not discovered/patched yet are probably out there (for a price). – Jeff Meden Oct 16 '15 at 13:34
23

These kind of approaches used to work, but due to the high spreading of viruses through pens, the option autorun on operating systems that enabled USBs to run when plugged, was disabled.

Before that option was disabled, you could have an EXE file on a USB device that would execute when you plugged the USB into the computer. On recent operating systems the autorun option is disabled by default.

A USB device can be re-programmed to emulate a USB keyboard. When the USB device is plugged into the system, the operating system recognizes it as a USB keyboard. Or for a simpler alternative, you can obtain hardware created specifically for that purpose like @Philipp suggested.

This follows the principle of the duck test (adapted version from USB rubber ducky):

If it quacks like a keyboard and types like a keyboard, it must be a keyboard

USB keyboards have the rights of the logged in user and can be used to inject malware into the operating system.

39

The "USB stick left outside the power plant" you are talking about sounds a lot like the Stuxnet affair. There was a surprising (and satisfying) amount of detail about the technical aspects in the book Countdown to Zero Day. If you are genuinely curious I would highly recommend reading it.

To give you a tl;dr for your question; it's not done with a script but rather an file crafted on a lower level to exploit vulnerabilities in the way that the operating system handles USB drives. When you plug a USB drive into Windows, it will try to do helpful things like assess the file structure and see if there are any files you might particularly want to use, in order to give you a prompt to immediately access those files. While it doesn't intentionally execute any of the files directly, there are exploits to the way the OS scans the files that can be used to trick the operating system into executing code.

87

Recently, a form of attack has surfaced which does not "hack" the computer through code or software vulnerabilities, but instead does actual damage to the electronics.

A creator known as Dark Purple created a device known as the USB Killer 2.0 (based on an earlier version created by him based on the same concept) which, when plugged into the USB slot of the computer, stores the small amount of power sent to the device in capacitors, and then sends the stored energy back all at once at -220 volts.

It keeps repeating this process until the computer is dead. This destroys the I/O controller, often built into the motherboard (and may cause other damage as well; I haven't read any details on extensive testing). (Original source in Russian and the Google Translated version.)

USB drive, USB Killer 1.0, USB Killer 2.0

On the right, the exposed USB Killer 1.0 and its successor, the USB Killer 2.0, and on the left, the USB Killer in an enclosed case, which looks just like an ordinary USB flash drive.

The results are shown here, killing the motherboard of a Lenovo ThinkPad X60 just after being plugged in to the USB slot:

YouTube: USB Killer v2.0 testing.

  • 4
    @Michael Protection diodes have their own physical limitations. Each type of diode has its own reverse voltage and I wouldn't be surprised if the voltages aren't too high. Also I'd expect inputs to be mostly protected from shorts among the pins and from static electricity. Static electricity has high voltage, but not much energy. Those capacitors could be packing quite a bit more energy than expected. Also that's all assuming that there is indeed protection circuitry as described in the standard. Many cheaper motherboards don't have it. – AndrejaKo Oct 16 '15 at 18:51
  • 63
    For a moment I thought that is an embed YouTube player. – Derek 朕會功夫 Oct 16 '15 at 19:35
  • 7
    @Derek朕會功夫 Nah, some sites have embedded players, but unfortunately Security StackExchange does not, so it just showed up as an ugly link in the answer. As you can see, I edited in an "alternative solution" just so it looks prettier. ;) – IQAndreas Oct 16 '15 at 19:48
  • 4
    FYI the proper solution to physical attacks is optically isolating ports that untrusted hardware will be connected to. – R.. Oct 18 '15 at 4:42
  • 20
    Poor ThinkPad, it did not deserve such a fate. – Hugo Zink Oct 19 '15 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.