0

Was hoping to get your support to help to explain to our system admins how come the AV can't protect our enterprise from attacks that can be generated from USBninja. How can I explain our system admins that AV can't protect our enterprise machines from malware that come from USBninja?

  • 1
    Why can't AV protect from malware from that specific vector? The answer to that question (which you should have, as you imply that it can't) is the answer to how you explain it. – vidarlo Apr 7 '19 at 9:10
  • Sorry, I am not really implying but asking to help me. – Filipon Apr 7 '19 at 9:24
  • 2
    well, the short answer is that it may not act as malware. AV is made to protect against malware running on the computer, but many USB based attacks are not running any non-standard software on the host. – vidarlo Apr 7 '19 at 9:28
  • @vidarlo can you please explain more why you saying "the short answer is that it may not act as malware"? – Filipon Apr 7 '19 at 9:50
  • 1
    @Filopn: The question suggests to me that you a) understand the problem yourself and b) tried already to explain it to the admins and c) they were not convinced by your explanation. In order to help you to convince them better compared to what you've tried one would actually know how you've exactly tried and why they were not convinced, i.e. was it the unconvincing explanation or do the admins have not enough expertise etc. – Steffen Ullrich Apr 7 '19 at 11:43
5

It surprises me that you have to. But then, they might be unfamiliar with the USBninja. Explaining what the USBninja does should be sufficient for sysadmins. But the best way is to show them. Buy one. Set-up a HID-script that copies some data from the system to your USBninja. And have them run their anti-virusses at their leisure.

In mass storage mode, the USBninja is detectable by anti-virus. It will behave as a storage device, which might be useful if you want to extract larger chunks of data. However, you will probably not put a virus on it.

Experiment a bit with HID scripts. Get a few from the Internet like:

DELAY 5000
GUI r
DELAY 1000
PRINT notepad
ENTER
DELAY 1000
PRINT Hello, World!

In general, a short presentation, followed by a demo should be sufficient.

  • First explain what anti-virus does (signature detection, sometimes program behaviour)
  • Explain what a USBninja does. Especially, explain the HID-mode. Make them understand that anti-virusses do not protect from keyboards.
  • Demo-time!
  • For fun, buy some cheap USB-cables that you leave scattered around the room. If they understood the message, no-one will dare to use those cables.
|improve this answer|||||
  • 1
    A demonstration is an excellent recommendation! Far too many admins and security people implement check box security without really understanding the underlying technology. – user10216038 Apr 7 '19 at 15:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.