4

On Windows (pnd probably other operating systems, I don't know), when you plug in a USB appliance (a flash drive, mouse, etc) Windows automatically runs the "Device installation" and the firmware is installed. However, that firmware doesn't reside inside the user-accessible space (i.e. there is no G: drive) however, somewhere the actual files are installed.

After reading a few articles on some reputable security websites, I am worried about the global and non-beatable problem we face. Almost all non-branded & cheap USB appliances are programmed with suspicious-looking firmware (possibly malware), which Windows will auto-run while plugged in (unless you have auto-installation disabled. Which I suspect only around 1% of users actually do have this disabled)

How do I protect myself from this?

|improve this question
  • 2
    The drivers aren't actually stored on the device itself. They are downloaded from Windows Update or shipped with your operating system. If you don't trust Microsoft to vet the drivers properly you can always turn off automatic driver downloads. laptopmag.com/articles/… – Chris May 19 '18 at 11:37
  • 1
    "almost all non-branded usb appliances are programmed with malwares": WTF? care to substantiate? Most USB devices won't even have USB controller firmware; it's all ROM. Only development gear would have a re-programmable USB controller, save one batch of early USB3 thumb drives (by one manufacturer) that were made famous by the "bad USB" exploit. – dandavis May 19 '18 at 20:58
  • @dandavis Sorry, I an very dilletant in terminology of hardware parts, and don't know the difference between USB CONTROLER FIRMWARE and ROM. All I know is that when I plug usb applicance, Windows auto-installs (runs) some firmware for that usb, and what i've read on security websites, except braned and higher-end usbs, all other cheap USB's have suspicious firmware. – T.Todua May 20 '18 at 16:30
  • if you're talking about thumbdrives, only a couple historical examples have programmable firmware. the difference between ROM and programmable firmware (eeprom/flash/etc) is that ROM is far cheaper in bulk and cannot be modified. Let me ask you this: can you link to a single legit thumbdrive firmware download from any major manufacturer in the last 5 years? Of course not; that doesn't make sense because you can't update the "firmware", for updates or to hack. Also, autorun has been disabled since windows Vista (~10 years)... – dandavis May 20 '18 at 20:15
  • @dandavis but i dont especially mean the programable chips. i mean, if those already manufactured roms( or whatevet the chip is named) already probrammed in chinese factory, where it included malware. so when iplug, i see windows auto installs "usb device harfware instalaltion" pricess (in systray) and installs something. thats what i ask mainly. however prigramable chips and rom - very good info thanks. – T.Todua May 20 '18 at 21:23
3

Where does the driver come from

The driver is downloaded from Windows Update, they are generally signed and secure, with some exceptions, like the signed drivers used by Stuxnet.

Where does the firmware come from

The firmware is loaded onto the device in the factory, and in some most cases can be updated once the device is in use, although depending on the device this may be impossible, or just difficult to get the new firmware and software needed.

What can bad firmware do

Bad firmware can make the drive pretend to be anything, allowing for attacks where the device pretends to be a keyboard and mouse and takes over the machine, downloading and installing malware itself.

How to protect against bad firmware

You can avoid plugging clean devices into suspected infected/untrusted machines, although this will not help if you are unaware a trusted machine has been infected.

There are also some non-upgradeable USB devices, but these tend to be hard to find, and more expensive when available.

|improve this answer
  • it the answer was a bit more detailed and large, it could have been best. However thanks ! btw i was interested how to protect (ANti VUris can do that? ) what commands firmmware executes while plugged in windows and which sites is access and etc... – T.Todua May 19 '18 at 16:39
  • Short of epoxying all your USB ports, nothing will make you 100% safe, and the other 2 depend entirely on which infection you choose, different ones will do different things – jrtapsell May 19 '18 at 18:56
  • 1
    "Bad firmware can make the drive pretend to be anything": no, it can't. firmware can't turn an IO controller into a magical general-purpose computing machine; the device can only do what it was built to do. That seems confuses mass-produced devices with home-made MCU-based exploits, which are designed to be re-programmable and capable of running arbitrary code. There's also a difference between device firmware and the usb controller instruction set, which is actually stored on ROM in production devices. – dandavis May 19 '18 at 21:05
  • @jrtapsell: not 100%: one can drill through epoxy and shove pogo pins onto the contacts in mins. – dandavis May 19 '18 at 21:06
  • @dandavis help.kaspersky.com/KESWin/11/en-US/97194.htm seems to point to at least some usb devices being reprogrammable to the level of appearing as a usb keyboard, although I would be interested to see how effective the defences they give are, and what percentage of real life usb devices are vulnerable, RE: epoxy, this is true, I know of no way to defend against an attacker who has tools available – jrtapsell May 19 '18 at 21:55
3

Windows automatically runs the "Device installation" and the firmware is installed

No, the firmware is a special program executed by the microcontroller inside the USB drive. Windows will install the driver. Firmware is the program that interfaces with the USB port and writes and reads things on the flash chip, perform error correction, and execute a few other tasks, like identifying itself and allowing for its own update. It runs entirely inside the USB device, on its own memory and processor, not on the host computer, or cell phone, or game console.

that firmware doesn't reside inside the user-accessible space

You probably meant the driver. Most of the time, the device will identify itself as a Mass Storage Device and Windows will load the driver from Windows Update site. On the rare cases where the driver is not found, Windows will say it could not find the driver and give you a chance of providing one yourself.

which Windows will auto-run while plugged in

No, Windows (or any other OS) will not auto-run firmware when you plug any USB device. See above.

How do I protect myself from this?

You can whitelist the devices you trust and Windows will ignore any strange device. Creating a list of the trusted devices can be time-consuming, but gives you peace of mind.

What are really the risks?

The risk is very, very small and the possible attacks are mostly overrated.

Modified firmware can make a USB mass storage device identify itself as a mouse or keyboard and type data on its own. Usually Win+R plus some Powershell commands are used to download and execute code from the internet.

Another attack involves the device identifying itself as a network adapter and changing DNS resolution, pointing to rogue DNS servers. Any DNS request will be re-routed to the attacker servers, possibly leading to cache poisoning.

The probability of being randomly hit by this attack is very small. It's way more possible to buy a cheap USB drive and find malware store on its files, not on the firmware. BadUSB affected devices will be used on targeted attacks, and probably other attacks will be used too. For real life attacks, usually the attacker will purchase a special device that looks and behaves a lot like a USB device, but it's not. See Rubber Ducky for example.

|improve this answer
  • @wow, fortunately you appeared with answer, thanks ! – T.Todua May 21 '18 at 13:41
1

Windows loads drivers FOR the device not FROM IT. The drivers loaded are based on the Hardware IDs provided by the device (VEN_ & DEV_). These are loaded from trusted locations (System32, or Windows Update), and have to be signed with a trusted certificate to be loaded at all for newer versions of Windows.

It is possible for the controller on the USB device to have malware on it. The firmware for it is going to be basically impossible to verify for the average user. The best you can realistically hope for is to be name brand flash memory from a reputable vendor, and reputable store, and trust that you are too small a target for custom firmware. Also whether or not the controller for the USB device can be reflashed with malicious firmware is going to be basically random, and difficult to find a device that can't be reflashed easily by a malicious actor.

The more likely scenario is that there are plausibly deniable backdoors written into the controllers firmware via sloppy coding. Those will be for random vendors from your point of view, and difficult to find. There likely aren't that many vendors that are affected, since it is very difficult to pull off, and therefore costly.

The autorun.inf vulnerability is largely mitigated with newer versions of windows asking you what you want to do with removable media when you first plug in the device.

Some Antivirus programs like Kaspersky also block USB keyboards, until they are confirmed under your control by forcing you to type in a string of text from the device. This only protects against fake keyboards though.

Most Hardware devices on the motherboard are DMA (can directly read, or write to memory, bypassing most safeguards), USB doesn't have Direct Memory Access, but there are plenty of other attack vectors, given that USB is designed to connect any type of device.

The .lnk vulnerability of Stuxnet attacked an explorer (graphical shell) bug for instance.

There is ALOT of attack surface on PC hardware, firmware, and software.

Here is a decent list of known attacks: https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/

There will always be bugs in code that can be exploited, understand that, but also know that generally, for the average user malware infections will be from automated sources, and not targeted attacks, which greatly limits the likelihood of many exploits being used, since many of them are near impossible without being from a targeted attack.

The best you could realistically do is (in order of least to most effective): 1. Buy reputable hardware, from reputable sources, and never use the USB peripheral on computers you don't control. 2. Use a Virtual Machine to separate the peripheral from your Physical Host. 3. Use QubesOS, and only plug the USB peripheral in after the OS has finished loading.

|improve this answer
  • Thanks for the post, but I don't think this adds anything beyond what has already been stated in the other answers. If it does, can you remove the points that have already been made? – browly Dec 6 '18 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.