I'm an average user. I don't take part or have any dangerous jobs.
I know that there is no fixed solution for this type of attack. However, I think USB is still become common devices for average user. So many average users still use USB as keyboard, mouse, dongle for transferring their data from phone to PC, etc. But after learning about BadUSB I became aware of it. So my goal is to prevent the badusb attack as an average user.
I have reviewed around 30 types of BadUSB by reading article, searching on several forums and looking at Github.
I have some premature conclusion that the majority of hardware inside of BadUSB is clearly different from a common or standard USB on the stores. Example lists of BadUSB,
- Malduino (https://maltronics.com/collections/malduinos)
- TinyDuck (https://github.com/justcallmekoko/Tinyduck)
- USB Keystroke Injector (https://github.com/AmirrezaNasiri/usb-keystroke-injector)
- USBDriveBy (Samy.pl)
- RubberDucky (https://shop.hak5.org/products/usb-rubber-ducky-deluxe)
- UberHID (https://github.com/kripthor/UberHid)
- USBSamurai (https://securityaffairs.co/wordpress/89978/hacking/usbsamurai-usb-hid.html)
- USBKeylogger (https://github.com/justcallmekoko/USBKeylogger)
I only found 1 (One) BadUSB type made by BrandonLW and Adam Caudill (github.com/brandonlw/Psychson) that looks exactly like standard USB. However, their codes only works for several USB controllers. This was also confirmed by DevElectron's statement at the Hak5 forum. ("i must start with mentioning that it can not be done with all the USB sticks you will need one with a specific Nand chipset on it."
- forums.hak5.org/topic/34950-how-to-make-a-usb-rubber-ducky-using-a-normal-usb-stick -
So, what do you think about it? Is my understanding about BadUSB correct?
Or does ANY KIND of USB from official stores are vulnerable to this attack?
If any kind of USBs are vulnerable, that means this attack can even be applied to SSD External and HDD External, right?
Then, how can I make sure official brands of SSDs or USBs are safe from BadUSB?