4

I recently purchased a Logitech MX Master 2S mouse. I had no intention of installing the "options software" that came with the mouse. I simply desired a wireless mouse that wasn't cheap and flimsy.

However, after immediately plugging in the wireless USB dongle, some manner of custom software was able to run without my consent, displaying the following window above all other windows:

Logitech Options software

There is no USB volume listed in File Explorer, and to my knowledge autorun from USB is disabled. I was also unable to find an obvious process listed in the Task Manager.

How did this process start? Additionally this seems like an ideal attack vector for Windows machines. Can anyone provide some insight as to how the USB dongle (with no volume) can do this?

Update: There does not appear to be any built-in logical disk within the dongle, as running wmic logicaldisk get name and diskpart> list volume revealed no additional drives or partitions.

  • 1
    USB is a great attack vector for all operating systems. The general principle is called an "evil maid" attack, and USB is great for it because USB devices can operate as keyboards, mice, hard drives, network devices, and literally anything. This makes it possible to create all sorts of havoc. This article explains much of this, and may also answer your question: schneier.com/blog/archives/2006/06/hacking_compute.html – Conor Mancone Jun 19 at 17:13
  • Yes, I have heard of this attack vector before. Do you think that is the mechanism Logitech used here? Keyboard injection to run/install programs I don't want? – Lemonseed Jun 19 at 18:35
  • It probably just used the autorun option baked into windows+USB (mentioned in the article). I'm not a windows person, which is why I'm not speculating more, but presumably the mouse also has a bit of storage built in which allows it to also act as a simple USB drive with an autorun option that you computer is picking up and executing. The article gives suggestions on disabling autorun, which you can google instructions for in Win10. If disabling autorun stops this then you pretty much have your answer (and can then even answer your own question if you want). – Conor Mancone Jun 19 at 18:53
  • 1
    Just a comment because I'm genuinely not sure, but... is it possible this is some sort of special driver, registered with Windows? Still creepy, obviously, that software can be transparently downloaded and run on your machine, but mildly less creepy than anyone being able to run anything. – Nic Hartley Jun 19 at 20:11
  • 1
    @Lemonseed Per your update, it seems like a requirement that the mouse has built in storage that is running things. However, they probably built it in such a way that it is not generally available/visible to the computer, but rather just to the automated processes the mouse starts up when plugged in. I'm still guessing though - quite the mystery. I'll put up a bounty once sufficient time has passed. – Conor Mancone Jun 20 at 12:09
3

How did this process start? Additionally, this seems like an ideal attack vector for Windows machines. Can anyone provide some insight as to how the USB dongle (with no volume) can do this?

USB is already a well-known attack vector which is occasionally discussed (BadUSB for example). Is all the alarmism around BadUSB really called for with respect to host devices?

Even though a USB stick is not supposed to it might also claim to be a HID keyboard and issue commands as you. In the case of a keyboard/mouse dongle, this would not even appear to be suspicious; it already is a keyboard. Think start+r -> "\\?\volume{something-logitech-hardcoded}\autorun.exe"

Another less nefarious trick I have seen is to expose a virtual CD drive with an autorun, where they are generally slightly more trusted. Even in Windows 10, some form of AutoPlay does run by default.

Unfortunately, I do not have access to such a device so I can offer no specific insight about the exploit involved. One experiment might be to plug it into a computer and attempt to observe anything strange briefly appearing on the screen, guided by the insight above. Otherwise using the device explorer in by connection mode might help to reveal hidden functionalities (but not particularly hidden, the device could remove them after an attack). Determining the contents of the secret internal storage might be helpful. For example, does it have autorun files at all?

8
+200

Nic Hartley mentioned drivers. Windows 10 automatically installs drivers for unknown devices as soon as they are plugged in. If Windows does not have the driver for the device, it silently downloads the drivers online. Event if Windows does have the drivers, it still checks online for an updated version.
So, my theory is: that Windows downloads and installs the necessary drivers from Logitech. The Logitech driver then shows the popup to install the software.

You can test this theory by plugging the dongle into a Windows 10 PC that is not connected to the Internet and does not have the Logitech drivers installed.

If the popup is still shown, then try disabling the Logitech drivers in Device Manager.

Also, try using a tool like Sysinternals Process Explorer to find the process that created the Window. More information.

  • You mean Logitech, not Lenovo. – Keavon Sep 18 at 6:13
  • 1
    Ah, my bad. Thanks for pointing it out. I have fixed the answer. @Keavon – Kartik Soneji Sep 19 at 5:02
4

The Logitech driver is installed by windows 10 when the mouse is attached. In this driver then triggers the download of the logitech options software directly from Logitech. Same happens with HP printers when they are attached locally.

This is done mostly to prevent problems with old drivers in Windows Update, especially in combination with the rolling release model.

When Windows 10 gets an upgrade from one major version to another, a full new install is done and all devices are downloaded and installed again after update.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.