I am aware of the ducky quacky devices, however, is there a possibility of impersonating an usb input device to extract data from the target computer? Michael Smith's defcon talk ( http://www.slideshare.net/the_netlocksmith/defcon-2012-hacking-using-usb-devices ) implies such a thing but -if I did not skip it- upon a closer look I do not think his attack is what I have asked. In my shallow knowledge an input device has limited allowed abilities so there is nothing to fear, am I wrong?

Thank you,

  • While the classic "badusb" emulated an input device there can be other things done with usb devices, like emulating a network card. And this can then be used to extract data from the system, see poison tap. – Steffen Ullrich Apr 23 '17 at 19:49
  • Thank you for your reply, however, for my specific case there are no whitelisted VID/PIDs other than HIDs. – keoxkeox Apr 23 '17 at 20:08

Some of the ways that a USB device can be used for malicious actions.

Act as a keyboard

  • There are a bunch of different makers out there, but a USB Rubber Ducky is the most popular one. It impersonates a keyboard. Technically, to the computer it IS a keyboard, because it identifies itself as an HID (Human Interface Device).
  • If a user walks away, this device can be inserted and essentially type everything an attacker wants to do. However, it doesnt have storage typically, so how would it steal passwords? By running a script (bash or powershell), that posts the files to public sites like pastebin.
  • As a human, you cant remember and type several thousand characters of base64 encoded powershell, but a rubber ducky can. It can type out a full payload and call invoke-expression to execute arbitrary powershell code. They are awesome.

Act like a network card

  • You can get a LAN turtle, or newer models, like a bash bunny, that act as a USB ethernet card. This is different from a rubber ducky because this kind of USB device can be blocked via group policy or BIOS settings. But a LAN Turtle acts as a network card.
  • Windows will automatically install the drivers for a network card, no matter if the user is logged in, or locked screensaver.
  • Once the USB network drivers are installed, the LAN Turtle can issue your computer a DHCP IP address, and start poisoning the traffic to route traffic to itself.

    • This is often done with Responder.py, and awesomesauce tool that does tons of attacks like ARP Poisoning, WPAD poisoning, DNS, SMB, HTTPS, and others.
  • Basically, you plug in the device, and hope to catch some credentials moving across the network, like mounting an SMB share.

Physical destruction

Overall, USB can do lots of damage, and thats not including specifically destructive USB drives like a USB killer, which has a good chance of frying the motherboard or USB controller.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.