9

I'm an average user. I don't take part or have any dangerous jobs.

I know that there is no fixed solution for this type of attack. However, I think USB is still become common devices for average user. So many average users still use USB as keyboard, mouse, dongle for transferring their data from phone to PC, etc. But after learning about BadUSB I became aware of it. So my goal is to prevent the badusb attack as an average user.

I have reviewed around 30 types of BadUSB by reading article, searching on several forums and looking at Github.

I have some premature conclusion that the majority of hardware inside of BadUSB is clearly different from a common or standard USB on the stores. Example lists of BadUSB,

  1. Malduino (https://maltronics.com/collections/malduinos)
  2. TinyDuck (https://github.com/justcallmekoko/Tinyduck)
  3. USB Keystroke Injector (https://github.com/AmirrezaNasiri/usb-keystroke-injector)
  4. USBDriveBy (Samy.pl)
  5. RubberDucky (https://shop.hak5.org/products/usb-rubber-ducky-deluxe)
  6. UberHID (https://github.com/kripthor/UberHid)
  7. USBSamurai (https://securityaffairs.co/wordpress/89978/hacking/usbsamurai-usb-hid.html)
  8. USBKeylogger (https://github.com/justcallmekoko/USBKeylogger)

I only found 1 (One) BadUSB type made by BrandonLW and Adam Caudill (github.com/brandonlw/Psychson) that looks exactly like standard USB. However, their codes only works for several USB controllers. This was also confirmed by DevElectron's statement at the Hak5 forum. ("i must start with mentioning that it can not be done with all the USB sticks you will need one with a specific Nand chipset on it."

  • forums.hak5.org/topic/34950-how-to-make-a-usb-rubber-ducky-using-a-normal-usb-stick -

So, what do you think about it? Is my understanding about BadUSB correct?

Or does ANY KIND of USB from official stores are vulnerable to this attack?

If any kind of USBs are vulnerable, that means this attack can even be applied to SSD External and HDD External, right?

Then, how can I make sure official brands of SSDs or USBs are safe from BadUSB?

4
  • 2
    You could set up an old computer with almost any flavor of Linux to test devices if you feel paranoid... Disable "auto-enabling" of HID class devices, and login as a user With NO USB access and no write access to system-files without manual authentication.
    – svin83
    Commented Oct 24, 2020 at 22:23
  • @svin83 I already did that. Thank you for the suggestions!. What do you think about physical differences of hardware between normal USB and BadUSB? Commented Oct 25, 2020 at 10:21
  • 2
    One can silkscreen an IC to read as any other IC. One can even silkscreen a fake conductor pattern over the PCB. So long for recognition of any board by an unexperienced user.
    – fraxinus
    Commented Oct 25, 2020 at 12:06
  • Visual inspection is never a 100% guarantee. Even if you knew what to look for, and had a workspace with wall-mounted magnifying glass and great lights. Chips and components can be obscured, hidden, rebranded, and traces are also easily hidden/obscured.
    – svin83
    Commented Oct 28, 2020 at 11:21

2 Answers 2

29

No, you can't tell by looking at it.

There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The other is that your research clearly has an observation bias (presumably, because you're finding the things that are easier to find on the web).

Originally, BadUSB was an exploit of the firmware of an existing USB device. As any firmware exploit, it's specific to a particular device, or to a set of devices that use similar firmware. A lot of devices' firmware is susceptible to an exploit of this kind, but the exploit has to be written for each device. The goal of this exploit is to take an existing “inoffensive” device, for example a USB flash drive, and turn it into a multi-purpose device by adding the functionality of a hub (so that the device keeps working for its original purpose) and a malicious device, for example a keyboard to inject malicious commands. It works because from the point of view of the computer, the device is just sending traffic on the wire obeying the USB protocol. If the device can be reprogrammed to send traffic saying that it's a hub, then as far as the computer is concerned, it's a hub. This type of device obviously looks inoffensive, since it's physically exactly what you think it is: only the software running on the device is malicious.

“BadUSB” has been extended to a variant of this attack that reaches the same goal through different means. The goal of this attack is to have a device that looks like a flash drive, but is in fact a hub connected to both a flash drive and a keyboard. You can do that by modifying a flash drive, or by building your own device. If you build your own device, you certainly can make it look externally like an ordinary flash drive, but you don't have to. Hobbyist and security researchers who are demonstrating the possibility typically don't bother to ensure that they use chips that are small enough to fit in the intended volume and to mold them in a shapely plastic case. But there are also people who are doing this for nefarious purposes, and who therefore don't mind paying some manufacturing cost. If you're willing to pay the manufacturing cost, you can make a device that just looks like a random flash drive, but has a fake keyboard inside.

Your research has mostly found hobbyist projects for building a custom USB storage+keyboard device from electronic components that can be bought in small quantities for cheap. That's to be expected: those are the people who make web pages to explain how it all works. Actual black hats don't bother to do that, so they have a markedly lower web profile.

To get an actual assessment of whether BadUSB (including the built-for-purpose variant) is detectable, you need to look at the devices that attackers actually use, not at teaching devices. There doesn't seem to be a lot of publicly available detail about those. But I did find one article with a photo:

photo of a BadUSB drive

This doesn't look different from any other USB thumb drive.

Such devices are available for sale for only slightly more than a normal thumb drive. You even list one in your question, the Rubber Ducky:

Rubber Ducky

Once again, this looks like an ordinary thumb drive. The only thing that sets it apart is the logo, and that's of course extremely easy to change. Even looking at the electronics inside, you couldn't tell that it isn't just a thumb drive except maybe by knowing exactly what this particular model looks like inside.

You cannot avoid BadUSB by looking at devices. You need to know the chain of custody of the device. Only accept USB devices from people that you trust not to be malicious and not to be fooled by a malicious device. If you absolutely need to plug in a USB device that you don't trust, configure your operating system to only automatically accept USB storage devices and to require confirmation for any other type of device, and make sure never to run software from the device or to open a file that could contain malicious macros (such as Microsoft Office files).

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Commented Oct 26, 2020 at 18:53
2

The O.MG Cable has been built specifically to evade visual identification. https://twitter.com/_mg_/status/1304614171540033536?s=21

And there are multiple cable types: https://twitter.com/_mg_/status/1225821814296723457?s=21

And there is also the DemonSeed, which allows custom cables to be built, which makes visual identification more of a problem: https://youtu.be/7hToZTe-1LI

They are all listed on https://o.mg.lol

2
  • Thanks for the clarification, Admin. Then, I guess it's the right time to never use any USB products and depending on cloud solutions. Commented Oct 25, 2020 at 16:19
  • Typically, we prefer that vendors offer their product in an answer alongside other options so as not to come across as an ad. Normally, a single product is not an answer, but in this case, it serves as an example that does answer the question. Are there other vendors or products that do the same as your products?
    – schroeder
    Commented Oct 25, 2020 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .