If the device is plugged in when the user is already logged in, then of course the device can just pretend to be a keyboard, open a terminal, and run a compromising command. (shortcuts for terminals may vary, but are usually somewhat consistent). This can happen very quickly, too, so sometimes users may not notice.

But on servers, the story is slightly different. There's usually no GUI at all, and even the console session is rarely logged in, since most administration occurs over SSH. In the normal case no interactive user is logged in at all, just some services running under their own users. In such a case, what vectors could be exploited by a malicious USB device?

  • Under certain circumstances (read: very badly configured servers), one may plug an USB device faking an ethernet or RDNIS card and intercept network traffic. But it seems very unlikely... – binarym Sep 11 at 9:57
  • A HID-configured one can do practically anything. – Overmind Sep 11 at 12:51
  • @Overmind could you elaborate on "anything"? I understand it could fake user input, but that isn't very useful on a logged out console. Could it read disk contents? Memory contents? Network packets? Could it inject keystrokes into an ssh session? – Soumya Sep 11 at 16:30
  • In theory, as deep as exploits in the OS will let it get. Even without auto-mounting, the OS still has to talk to the USB device, and the drivers for whatever device class it is may have bugs in them. Once you're dealing with exploitable kernel-level bugs, you've got the potential to quite literally take over the entire system. – Austin Hemmelgarn Sep 11 at 19:25
  • Unless your OS has disabled USBs, you are completely vulnerable. A device detected and auto-mounted as HID will be able to spread and access anything in your system. – Overmind Sep 12 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.