Not really new but it's all over the news right now. You can hack a USB firmware to run an attack by emulating a keyboard.

I wonder how difficult it is create an USB thumb that emulates a keyboard.

I am trying to evaluate how likely such an attack is. Can the kid in my neighborhood do this or does it require are secret agency?

  • 1
    Perhaps it would help to actually reference the exploit you're refering to in order to avoid confusion? Aug 1, 2014 at 14:50
  • 1
    The question as written is about how hard it is to attack a usb device. The question of how hard it is to attack a host, given a usb that does keyboard, network, mouse, etc is also highly dependent on the host - what OS it is running, if it is patched well, how observant the operator is, etc.
    – nealmcb
    Aug 1, 2014 at 15:43

1 Answer 1


After reading different sources I would like to answer this myself.

Currently Karsten Nohl has not released details or tools about how this works. With the given information it should be difficult to reproduce his work.

This will change on August 7 when he will release proof-of-concept tools at BlackHat 2014. There are three widely spread USB controller chips. From what is know Nohl has reversed engineered the firmware of at least the most used controller Phison.

From an attacked USB device he can attack the computer. If is able to get administration access on the USB host he is also able to flash other USB devices from there. That could get interesting...

Depending on what Karsten Nohl will release this could be even used by script kiddies.


Comments asked about sources. I only got a german source but you can use a translator. Nohl did some interviews with different German news agencies.

Here two important parts:

Laut Nohl kommen bei USB-Speicher-Sticks fast nur Controller von drei Herstellern zum Einsatz; sehr weit verbreitet sind die von Phison. Wie Nohl im Rahmen seiner Forschung herausfand, hatten bereits andere deren proprietäre SCSI-Befehle analysiert. Nohls Team gelang es, nach einer Analyse der Firmware auf diesem Weg einen ganz normalen USB-Speicherstick umzuprogrammieren

This is saying that Phison is widely used and in a following sentence that Nohl analysed the SCSI commands and was able to reprogram the USB thumb. It does not directly say he reversed engineered the Phison.

Um dann wiederum weitere Sticks zu infizieren, benötigt der Schadcode zwar Systemrechte...

Here they are saying they can infect other devices if they can get system rights.

  • 2
    Can you cite your sources? I've seen absolutely no confirmation that the Phison chip was reverse engineered. Also, the "BadUSB" announcement mentions nothing about gaining administrator/root access. The three examples given are that the exploit could be used to fake a keyboard and issue commands as the logged in user, spoof a network card and change the computer's DNS settings, and (if the infected device is a USB mass storage device) execute a file hidden on the device. Escalating privileges may require that the infected device download or execute additional payloads from another source. Aug 1, 2014 at 16:43

Not the answer you're looking for? Browse other questions tagged .