3

Is there anything we can do across the company to make sure USBNinja and other similar USB cables that looks so real for users can really be mitigated?

  • Penteract keyboard detector? – User42 Dec 9 '18 at 23:23
3

USBNinja exploits design-level weaknesses of the USB specification. As such there is no simple technical solution and it is unlikely that one will emerge.

You can attempt to close down your USB using device control solutions, but a) you need a very homogeneous IT environment to be able to do that effectively (i.e. blocking devices based on vendor and product ID) and b) a targeted attack can easily work around these.

You also cause yourself headaches with device control that should not be underestimated. We've just been through this process for a customer, and it took days to find a tight policy that doesn't lock down the entire system (due to the way Windows loads its device drivers, if you block an essential device, your system is toast).

An awareness approach is most likely the one with the highest contribution to resistance, but it will also have holes (guests and visitors, contractors, etc.)

For your most valuable devices, I would seriously consider glueing known-good devices to the system at least so much that any tampering will be visible. Also lock unused USB ports (there are USB locks).

Consider USB locks also for notebooks of critical personel.

1

Update your training and HR policies to tell users not to plug things into the USB ports on their computers.

Anyone caught plugging something into their computer not on the official list gets a written warning with HR.

Buy a NinjaUSB yourself, write a payload that just sends an email, then leave the cable out and see if anyone bites. If they do, make sure you use it as a teachable moment.

Write a windows group policy to disallow USB devices such as badusb/NinjaUSB from registering when plugged in. Unfortunately blocking USB devices is a blacklist and not a whitelist approach. http://technet.microsoft.com/en-us/library/cc731387.aspx

EDIT: This site contains a list of known USB devices. You could write a script to block all those devices. https://usb-ids.gowdy.us/read/UC/. While it's not exhaustive, even a partial block list will prevent the unsophisticated attacker who purchases off the shelf hardware.

  • 1
    "BadUSB" is not a device, it is a (frankly overhyped) class of attacks. There is no way to block it specifically short of completely blocking new USB devices, or at least blocking USB devices that identify as an HID. – forest Oct 6 '18 at 4:18
  • 1
    Correct, what I'm suggesting is using a script to create a blacklist of known bad actors. There are lists of USB devices curated for this specific use usb-ids.gowdy.us/read/UC. While it's not an exhaustive list, and a custom firmware could use a new ID, it prevents the lazy attacks from someone who purchases a NinjaUSB, RubberDuckie, or uses the available firmware flashers to create a HID device from a commercial USB running the phison chipset. It's a similar approach to running a filter for bad URLs, God, but not perfect. – Daisetsu Oct 6 '18 at 14:21
  • 1
    Most organizations have a standard supplier for their peripherals, they should only have a handful of keyboards and mice. It should be possible to enumerate all the legit HID and not include those in the block list. – Daisetsu Oct 6 '18 at 14:29
  • 1
    @forest "There is no way to block it ..." Not true. You can have the screen lock when any keyboard is connected like Penteract keyboard detector does. – User42 Dec 12 '18 at 18:45
  • 2
    @User42 That might help with keyboards, but what if the device registers itself as some other HID, like a mouse or touchpad? What if it registers itself as a non-keyboard HID that installs a driver which gives it keyboard-like behavior? What if it registers itself as a network interface? – forest Dec 13 '18 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.