1

BadUsb works by infecting a computer when plugged into the USB port. Is it also possible for an attacker who gains control of a system, such as remote access, to then infect any connected USB devices? Or does it only affect the ports it's plugged into?

  • At least for Phison based devices (around half of devices), as long as an attacker has Administrator/root privileges, they would be able to place the device in boot mode and update the firmware. Local or remote doesn't matter. – Adam Caudill Oct 18 '14 at 3:37
2

Once an attacker gains control of a system he may use it to try and compromise vulnerable USB devices plugged into it in hopes of compromising the other systems to which the compromised USB devices will be connected.

And the attacker doesn't care about which ports are used, he'll just probe all of them in hopes of finding & compromising a vulnerable USB device.

  • marked this as correct because I feel it answers the question with more accuracy, but I appreciate both responses. – TigerCoding Oct 20 '14 at 20:23
2

If a USB stick accepts unsigned firmware updates then yes it's vulnerable to a bad USB attack. There are products out there that only accept digitally signed firmware updates. These devices are not susceptible. http://www.ironkey.com/en-US/solutions/protect-against-badusb.html

  • If USB stick includes basic storage sticks, what firmware would it have and how are the stick autonomous enough to accept or reject firmware? – LateralFractal Oct 17 '14 at 22:05
  • "As explained by the researchers, the best protection against this vulnerability is to use code signing for firmware updates. If the signed firmware is modified, the device cannot authenticate the firmware and simply will not operate. This prevents the infection from spreading but results in an unusable device. That is why in addition to using signed firmware, IronKey protects the mechanism used to update the firmware with hardware-based security keys. This prevents tampering with the signed firmware, which would leave the device unusable." – k to the z Oct 17 '14 at 22:09
  • But is IronKey more autonomous than than normal flash eeprom? I would have thought for normal flash device that decisions on firmware validity are made by the host operating system. – LateralFractal Oct 17 '14 at 22:14
  • 1
    At least for Phison controllers (about half of devices), there's a boot image that loads the firmware from NAND and executes it; it's that boot image that should perform validation - it's likely this check isn't done to improve performance. The host PC has no idea what's executing on the drive - that's what makes this technique so effective. – Adam Caudill Oct 18 '14 at 3:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.