Is it possible to "trick" a Windows 10 PC into thinking a flash drive is a mouse to execute code on the machine? If so, how?
Note: I'm not trying to do anything malicious. All of this is strictly for learning purposes.
11
-
Have you heard of "Bad USB"?– forestJun 29, 2021 at 2:47
-
No, I haven't @forest– user259894Jun 29, 2021 at 2:48
-
1security.stackexchange.com/questions/tagged/badusb– forestJun 29, 2021 at 2:51
-
None of those questions/answers teach how to make a bad usb though.– user259894Jun 29, 2021 at 2:52
-
If you want to actually make one, you can look into the Teensy USB development board, which is an active USB device. If you want to compromise the firmware of a normal USB flash drive, you're out of luck. That's something you'd have to do yourself and would differ for each flash drive (you'd need to reverse engineer the firmware and find an exploit assuming you don't use an SPI programmer or something to rewrite the chip itself, since there really aren't public "how to" guides for that due to its complexity).– forestJun 29, 2021 at 2:52
|
Show 6 more comments
1 Answer
As part of the USB protocol, every device has a data structure that it provides on connection that describes the device. This structure could also list multiple devices (as if the device was a hub with devices attached).
To make a flash drive pretend to be a mouse, you would have to reprogram the firmware in the device to present a different device descriptor, and may require extensive knowledge of the internals of the flash disk and a way to change the firmware. However there are many tools and tutorials available.
It might be much easier to use a device with a known programming capability, such as one of the Arduino variants. Several Arduino devices actually have examples of how to make them act like a USB keyboard or mouse. With a small Arduino such as the Teensy, it might even be possible to disguise it as a flash drive.
One possible legitimate use of this: I programmed an arduino to read infrared signals from TV remotes and translate those to keystrokes on a simulated keyboard.
