19

How can I know in Linux (or otherwise), if the firmware of my USB flash drive can be rewritten using the USB port (when sticking it in an USB port)? Eg. for a cheap EMTEC 16GB.

I was thinking about using udevadm monitor, but do not have any clue on how a USB controller ID looks like (and whether it is printed by udevadm) and where to look further for details for that USB controller. I have read in How to prevent BadUSB attacks on linux desktop that it one of conditions behind the BadUsb attack.

  • 1
    Even if the firmware was rewritable, there is no standard way for USB mass storage devices to advertise this. Usually it's done with a manufacturer-specific command. The only way to be sure would be to obtain a dump of the firmware already installed, disassemble it and see if there are any routines for updating its own firmware in its code. – user42178 May 4 '15 at 14:06
  • @AndréDaniel Than another question: how would a virus try to rewrite the firmware of my USB flash drive? Is there at least a standard way to rewrite (not to check whether rewritable) the firmware? – Andrei I May 5 '15 at 7:12
  • Malware could have a database of USB IDs and the associated firmware flash commands, or just throw them all at the USB device and hope one succeeds. – user42178 May 5 '15 at 7:18
  • 1
    See flashboot.ru, russian website that has downloads of manufacturer's official tools used to program USB sticks. You could download one and disassemble it.. I wouldn't recommend running anything from that site on your own personal machine though. – user42178 May 5 '15 at 7:20
  • 1
    OK, (although not booletproof) a solution to my problem would be to identify the vendor ID of my USB stick, and then check on that website (or on the one of the vendor) if the USB stick is writable. If no information on the large internet, then there are big chances that a usual malware cannot do it. Did I miss anything? – Andrei I May 5 '15 at 7:27
11

In short, there is no way to know this.

There are to many 'badly written' USB controller chips out there that either not report that you can write to them. or worse report you can. but simply ignore any attempt to write to them.

So without knowing specifically what chip it is you can not know how it reacts to such an instruction.

As a even worse case there are USB devices out there which are either USB stick's or USB HDD's that when written to an extreme address instead of writing it to disk, write it to the internal memory (e.a. the flash EEPROM) and you simply can not check for it without writing your own software to do that and test it by uploading your own firmware. (or brick the USB device).


The only reliable methodology for knowing if a USB device can be used in this manner is by White listing the known USB Controllers that allow writing. and writing your own test software to check for this.

  • I see. Let's suppose that the controller correctly reports whethe writing to the USB port is allowed or not. How can one find that out? – Andrei I May 4 '15 at 10:00
  • Only reliable way I know is with white listing / testing. – LvB May 4 '15 at 10:02
  • 4
    Are there any such whitelists in existence already? – oliver May 4 '15 at 12:28
  • 1
    Not a public one to my knowledge I'm afraid. :( – LvB May 4 '15 at 12:35
  • Since there's only a limited amount of ways you can communicate with a USB stick, couldn't you exhaustively test whether or not you could overwrite the firmware, such as by trying to write to huge extremes, trying ATA commands for overwriting firmware, or even fuzzing? I imagine you could built up a whitelist easily that way. – forest Apr 5 '16 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.