Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [badusb]

A USB device firmware hack allowing the device to spoof other USB devices when plugged into a computer, and run code on the victim's machine.

1
vote
2answers
112 views

How we can prevent innocent looking USBNinja cable attacks in our organization?

Is there anything we can do across an organization to make sure USBNinja and other similar USB cables that looks so real for users can really be mitigated?
0
votes
1answer
116 views

Preventing firmware hacking with read only OS [closed]

Scenario 1: Attack from Internet, SD-card, USB-stick --> direct reflash BIOS firmware, without the operating system as an intermediate stage --> BIOS firmware or any other firmware which is stored ...
3
votes
1answer
564 views

Is all the alarmism around BadUSB really called for with respect to host devices?

I can understand why there was such a furor about BadUSB and indeed it poses a rather earthshaking threat to the base assumptions of many in their cyber security threat models. Things which many of us ...
4
votes
2answers
545 views

Are DVDs vulnerable to firmware malware (and assorted questions)? [closed]

I have a few questions about DVD drives. Are DVD drives and SATA interfaces vulnerable to issues like BadUSB caused by being able to reprogram firmware of the drive or disk or even spreading to other ...
2
votes
1answer
229 views

Is USB type c vulnerable to BadUSB?

Consider the new SanDisk ultra dual type c flash drive. Would that be safer once computers start to come with type c ports?
2
votes
1answer
211 views

In the age of BadUSB, are micro SD cards a secure alternative media immune to those style of attacks? [duplicate]

Why or why not? As a corollary, I saw a presentation description in a recent CCC demonstrating the (non-hostile) use of micro SD cards as a cheap source of processing power. Does this render micro SD ...
0
votes
1answer
204 views

Mouse receiver shows up as keyboard too - is this an issue?

I have recently seen some wireless mice that when the receiver is plugged in to a USB port, Windows device manager shows a new "HID-compliant mouse" (as expected) and also an "HID-compliant keyboard." ...
6
votes
3answers
263 views

Is it safe to connect a random USB battery from a bin to my phone without stopping data transfer in some way?

I've asked the question Power-only USB connection to charge my phone - as simple as cutting the data lines? in electronics SE. In order to bypass the "Why do you want to do this?" request for ...
1
vote
2answers
483 views

How can I connect a USB device to a virtual machine while bypassing the host?

From time-to-time it would be useful to connect an untrusted USB device to my computer. If I could connect it directly to a virtual machine, bypassing the host. that would be secure enough for me. I ...
2
votes
0answers
155 views

Linux selective USB-Locking against evil-maid-attacks [closed]

While the question of completely disabling usb-controllers and -storage to defeat an evil-maid-attack has already been answered here quite often, I have a different solution in mind. Upon locking the ...
3
votes
1answer
101 views

Security of external harware when using VMs

I'm new to using VMs, so I suspect this question may answer itself with experience, however, this question has been bugging me. If a computer user has a VM set up, and plugs in a pen drive, what's ...
4
votes
2answers
243 views

What is the best way to screen potentially compromised USB or flash devices?

I've got some flash devices. It is a bit like playing Russian roulette. The devices are of unknown origin containing information of unknown value. However, the potential value is great enough to be ...
3
votes
1answer
111 views

Does BadUSB infect USB Port PCB Chips?

All answered questions seem to relate to peripherals only. Can BadUSB infect the port pcb chip within a laptop or internal desktop hub (i.e. the strip of usb ports along side a laptop or atop a ...
1
vote
1answer
67 views

data extraction via Badusb from a “secure endpoint”

I am aware of the ducky quacky devices, however, is there a possibility of impersonating an usb input device to extract data from the target computer? Michael Smith's defcon talk ( http://www....
1
vote
1answer
169 views

Rubber ducky windows mitigation

So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions. Essentially my question is can you mitigate rubber ducky attacks using windows ...
0
votes
1answer
94 views

Is it possible to exploit IOT devices with Usb 'RubberDucky'? [closed]

Im kind interested , is it possible to exploit IOT devices with Usb 'RubberDucky' like Routers, servers , printers, modems with 'USB insertion'?
0
votes
0answers
200 views

Did malware spread automatically via USB connection on my Windows 10 computer?

I've got a malware question. Against my better judgement, I recently attached several external storage devices (two smartphones and a portable hard drive) via USB to my Windows 10 laptop. The storage ...
5
votes
4answers
3k views

Detection of BadUSB

We plan to distribute our new software using USB flash drives. The plan is for the field service specialists to visit our customers and upgrade the software using one of our flash drives. However, we ...
0
votes
2answers
112 views

Could a badUSB device actually hack your computer while it is supervised?

Could a badUSB device install actual malware (disguised as the drivers) on your computer? I thought that windows and Mac required all drivers to be digitally signed though? Obviously, a badUSB device ...
3
votes
1answer
182 views

TOR Nodes silently bundled into mass produced usb devices?

This is a matter of curiosity more than of practicality, but would it be possible for a hypothetical manufacturer (hereinafter referred to as International Company Of Mystery or INCOMOM) so inclined ...
1
vote
1answer
609 views

Is YubiKey vulnerable to BadUSB exploits?

I know that BadUSB (revealed by srlabs.de a number of years ago) works by altering the actually firmware of a particular make of USB device, and as such my trusted systems have their own designated ...
9
votes
1answer
749 views

How does one properly check foreign USB Drives before getting them in your Network? Is the presented approach considered “safe”?

Current Situation: I´m currently employed at an Hospital and with rising danger of ransomware etc. spread by usb drives we decided to block all USB-Ports (roundabout 600 Clients/Windows only) via ...
3
votes
1answer
535 views

What are the risks and effects of the feared “Killer USB stick”?

A Russian security researcher known as "Dark Purple" has created a USB stick that contains an unusual payload. It doesn't install malware or exploit a zero-day vulnerability. Instead, the ...
0
votes
0answers
86 views

Burn new firmware on a Disk on Key for bad usb

DOK=Disk on key - sorry for that I have recently read about the bad usb exploit and I'm looking to make one of my own (for studying of course). I've been thinking of taking a DOK and burnning a new ...
6
votes
1answer
373 views

Is the iPhone vulnerable to the BadUSB malware?

Supposedly, the BadUSB malware can infect any USB device. But I find this hard to believe since I don't see why most USB devices would have reprogrammable firmware and I find it even harder to believe ...
3
votes
3answers
312 views

“Mousejack” a wired (non-wireless) mouse

Is it possible a wired mouse can be a malicious device? For example, could a keylogger be installed within a wired mouse that captures keystrokes and sends these to an external server via the internet ...
0
votes
0answers
55 views

How can I prevent Ubuntu from automatically using an USB keyboard? [duplicate]

From what I understood, the possibility of having a multitude of device types connected to the computer via USB (keyboard, mouse, gadgets, sticks, webcams, ...) is a security risk: I connect a USB ...
48
votes
6answers
7k views

Why don't OSes protect against untrusted USB keyboards?

Lately I've been reading about things like BadUSB and RubberDucky which are essentially USB sticks that tell the computer they are a keyboard. Once they are plugged in they "type in" whatever commands ...
3
votes
2answers
369 views

What to do after a BadUSB attack? [closed]

I'm asking myself what to do after a user gets attacked by BadUSB? (Full scan, boot-time scan, ...?) Is the "bad usb" stick even able to infect the user's system with malware or other spy tools?
4
votes
1answer
653 views

BadUSB tarned as Mass Storage

Can an USB Device be infected with BadUSB if Windows recognizes an USB Device as an USB Mass Storage? The Windows Event Log identifies the Device as SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_KINGSTON&...
4
votes
3answers
114 views

Is it dangerous to share a USB flashdrive? [duplicate]

Recently I've watched a movie "Blackhat" where just by inserting a USB flashdrive he could infect a host PC with some malicious program. Is it true that it's not safe to share USB flashdrives just ...
0
votes
1answer
362 views

Bad USB malware and Chrome OS

I have recently been reading about the unpatchable BadUSB and similar malware. I use Chrome OS, which is supposed to be very secure, but could someone with physical access to my system compromise it ...
15
votes
1answer
2k views

Can SD-Card be a vector of a BadUSB type attack when used with a USB reader?

The firmware of a USB flash drive can be maliciously rewritten in order to make it appear as a rogue device (like a keyboard, a network card, etc.). Since several different kind of devices may be ...
2
votes
0answers
1k views

USB Rubber Ducky Firmware Upgrade [closed]

I just erased my firmware, using dfu-programmer-0.7.2: $ dfu-programmer at32uc3b1256 erase Checking memory from 0x2000 to 0x3FFFF... Not blank at 0x2001. Erasing flash... Success Checking memory from ...
0
votes
0answers
179 views

BadUSB attack , driver Specifications

I want to ask you about some specifications in the project I'm diving into, which is related to the BadUSB kind of attacks. A reprogrammable device like USB stick can show itself like a HID device ...
1
vote
2answers
267 views

sound card with BADUSB

Is it possible to prevent a USB sound card, that's infected with BADUSB, from damaging my computer? In particular, if I can limit the sound card to only act as a sound card, and not something else ...
117
votes
11answers
33k views

Is there any way to safely examine the contents of a USB memory stick?

Suppose I found a USB memory stick lying around, and wanted to examine its contents in an attempt to locate its rightful owner. Considering that USB sticks might actually be something altogether more ...
4
votes
1answer
449 views

Is a keyboard with updatable firmware a security risk?

I am looking to buying a small mechanical keyboard for on the go and to use it with various office computers. The ones I like are the Ducky Mini and KBParadise V60. The former has a ARM Cortex-M3 ...
5
votes
3answers
932 views

BadUSB: Why are firmware writeable in the first place? Manufacturer's backdoor?

How many of you have actually updated their mouse, keyboard or USB stick firmware? How many vendor actually propose updates for such devices? However these devices firmware often offer a proprietary ...
1
vote
2answers
1k views

BAD USB attack possible while screen is locked?

If i leave my screen locked and someone sticks in a thumbdrive that was manipulated using the bad USB exploit would an attack be possible?
8
votes
2answers
1k views

Hardware devices for protecting against BadUSB?

Have any devices been released which protect against BadUSB attacks? I'm particularly interested in buying a USB hub which has the following protections: The USB hub itself won't allow reflashing ...
19
votes
1answer
9k views

How to check if my USB stick firmware can be rewritten via the USB port?

How can I know in Linux (or otherwise), if the firmware of my USB flash drive can be rewritten using the USB port (when sticking it in an USB port)? Eg. for a cheap EMTEC 16GB. I was thinking about ...
5
votes
2answers
2k views

How to check if my usb drives are vulnerable by BAD USB

Mark pointed out that only one chip type is vulnerable to BAD USB, id like to check if mine are, am using only Kingston flash drives here so can you tell me if they are, or if there exists a list ...
41
votes
6answers
22k views

How to prevent BadUSB attacks on Linux desktop?

What can I do to protect my Linux laptop from BadUSB attacks as described by ArsTechnica here? Perhaps writing an appropriate AppArmor profile would help?