How protect ourselves from USB Firmware viruses? Does Antivirus help?

Question

On Windows (pnd probably other operating systems, I don't know), when you plug in a USB appliance (a flash drive, mouse, etc) Windows automatically runs the "Device installation" and the firmware is installed. However, that firmware doesn't reside inside the user-accessible space (i.e. there is no G: drive) however, somewhere the actual files are installed.

After reading a few articles on some reputable security websites, I am worried about the global and non-beatable problem we face. Almost all non-branded & cheap USB appliances are programmed with suspicious-looking firmware (possibly malware), which Windows will auto-run while plugged in (unless you have auto-installation disabled. Which I suspect only around 1% of users actually do have this disabled)

How do I protect myself from this?

Answer 1

Where does the driver come from

The driver is downloaded from Windows Update, they are generally signed and secure, with some exceptions, like the signed drivers used by Stuxnet.

Where does the firmware come from

The firmware is loaded onto the device in the factory, and in some most cases can be updated once the device is in use, although depending on the device this may be impossible, or just difficult to get the new firmware and software needed.

What can bad firmware do

Bad firmware can make the drive pretend to be anything, allowing for attacks where the device pretends to be a keyboard and mouse and takes over the machine, downloading and installing malware itself.

How to protect against bad firmware

You can avoid plugging clean devices into suspected infected/untrusted machines, although this will not help if you are unaware a trusted machine has been infected.

There are also some non-upgradeable USB devices, but these tend to be hard to find, and more expensive when available.

Answer 2

Windows automatically runs the "Device installation" and the firmware is installed

No, the firmware is a special program executed by the microcontroller inside the USB drive. Windows will install the driver. Firmware is the program that interfaces with the USB port and writes and reads things on the flash chip, perform error correction, and execute a few other tasks, like identifying itself and allowing for its own update. It runs entirely inside the USB device, on its own memory and processor, not on the host computer, or cell phone, or game console.

that firmware doesn't reside inside the user-accessible space

You probably meant the driver. Most of the time, the device will identify itself as a Mass Storage Device and Windows will load the driver from Windows Update site. On the rare cases where the driver is not found, Windows will say it could not find the driver and give you a chance of providing one yourself.

which Windows will auto-run while plugged in

No, Windows (or any other OS) will not auto-run firmware when you plug any USB device. See above.

How do I protect myself from this?

You can whitelist the devices you trust and Windows will ignore any strange device. Creating a list of the trusted devices can be time-consuming, but gives you peace of mind.

What are really the risks?

The risk is very, very small and the possible attacks are mostly overrated.

Modified firmware can make a USB mass storage device identify itself as a mouse or keyboard and type data on its own. Usually Win+R plus some Powershell commands are used to download and execute code from the internet.

Another attack involves the device identifying itself as a network adapter and changing DNS resolution, pointing to rogue DNS servers. Any DNS request will be re-routed to the attacker servers, possibly leading to cache poisoning.

The probability of being randomly hit by this attack is very small. It's way more possible to buy a cheap USB drive and find malware store on its files, not on the firmware. BadUSB affected devices will be used on targeted attacks, and probably other attacks will be used too. For real life attacks, usually the attacker will purchase a special device that looks and behaves a lot like a USB device, but it's not. See Rubber Ducky for example.

Answer 3

Windows loads drivers FOR the device not FROM IT. The drivers loaded are based on the Hardware IDs provided by the device (VEN_ & DEV_). These are loaded from trusted locations (System32, or Windows Update), and have to be signed with a trusted certificate to be loaded at all for newer versions of Windows.

It is possible for the controller on the USB device to have malware on it. The firmware for it is going to be basically impossible to verify for the average user. The best you can realistically hope for is to be name brand flash memory from a reputable vendor, and reputable store, and trust that you are too small a target for custom firmware. Also whether or not the controller for the USB device can be reflashed with malicious firmware is going to be basically random, and difficult to find a device that can't be reflashed easily by a malicious actor.

The more likely scenario is that there are plausibly deniable backdoors written into the controllers firmware via sloppy coding. Those will be for random vendors from your point of view, and difficult to find. There likely aren't that many vendors that are affected, since it is very difficult to pull off, and therefore costly.

The autorun.inf vulnerability is largely mitigated with newer versions of windows asking you what you want to do with removable media when you first plug in the device.

Some Antivirus programs like Kaspersky also block USB keyboards, until they are confirmed under your control by forcing you to type in a string of text from the device. This only protects against fake keyboards though.

Most Hardware devices on the motherboard are DMA (can directly read, or write to memory, bypassing most safeguards), USB doesn't have Direct Memory Access, but there are plenty of other attack vectors, given that USB is designed to connect any type of device.

The .lnk vulnerability of Stuxnet attacked an explorer (graphical shell) bug for instance.

There is ALOT of attack surface on PC hardware, firmware, and software.

Here is a decent list of known attacks: https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/

There will always be bugs in code that can be exploited, understand that, but also know that generally, for the average user malware infections will be from automated sources, and not targeted attacks, which greatly limits the likelihood of many exploits being used, since many of them are near impossible without being from a targeted attack.

The best you could realistically do is (in order of least to most effective): 1. Buy reputable hardware, from reputable sources, and never use the USB peripheral on computers you don't control. 2. Use a Virtual Machine to separate the peripheral from your Physical Host. 3. Use QubesOS, and only plug the USB peripheral in after the OS has finished loading.