I just found out about BadUSB. Should I worry about it although I bought my USB from official stores?

Question

I want to prevent malicious program accessing my PC via USB. My thread is as follows: I'm just a regular citizen with a non-dangerous job. However I live in a country that didn't care about data privacy and security.

Recently I just learned about the dangers of badusb. The problem is I have never checked the authenticity of my USB although I bought it all from the official stores.

To sort this out, I checked my usb collections with H2Testw. I also had time to download Beamgun app to detect badusb and all the results were positive without any issues. I have also made sure there is no Command Prompt showed on my screen when I plugged the USB.

However, new problem emerged. After I teardown some of my USB, I found a Phison controller inside. I checked on flashboot(.)ru and there is a software that can reflash that controller model.

Does that mean attacker can reflash my USB with a malicious payload?

I wasn't sure if buying from official store and checking with beamgun app and H2testw is enough to prevent badusb. Should I be worried?

What do you think about this?

Answer 1

While all of those concerns are technically possible, by far the biggest USB issue when purchasing from official stores is getting a bogus usb device that only stores a fraction of the claimed size or performs much slower than advertised.

A true BADusb is capable of acting before you can run analysis. If you plan on dealing with something like that you need a sand boxed system. What's more, a BADusb attack can come from usb items that may not look like anything to concern you, right down to and including a usb cable.

I've encountered bogus storage USB devices from commercial purchases occasionally, but the only true BADusb devices I've dealt with were in rather specialized environments.

Answer 2

BadUSB attacks are overrated. Don't expect to see one in the real world unless you have a high security job, are a pentester, journalist, or something like that. Or as a prank.

There are some issues with the BadUSB attack, it's noisy, and it's hard to hide it. As soon as the attack is detected, it's impossible to deny it, because all details of the attack are there to everyone see. Open a text editor on another OS, plug it, and done: every step of the attack is there.

The other issue is the scale. Unless you are specifically targeted, there's no way to an attacker to grab anything of value from a random person he does not know anything about. The cost and effort are significant to just attack some random person.

Attacking by software is faster, cheaper, can target one specific individual more easily, can be very well concealed, can leave no trace during and after the attack, and it's very easy to hide its origins. A poisoned USB drive can be pointed straight to were you got it.

To an attacker to compromise your store-bought USB drive, he would need physical access to it for considerable time. It would be easier to replace a couple of your files with an executable with the same name and icon, and you would surely fall for it. Easier than disassemble the USB drive, reprogram it, and reassemble it without leaving any marks or scratches.