Questions tagged [usb]

an industry standard used for connecting to and powering peripheral devices (keyboards, mice, cameras, printers, external hard drives, etc) from a computer or other USB capable device.

Filter by
Sorted by
Tagged with
88
votes
9answers
14k views

Secure USB cable for charging in untrusted environments

On a long haul flight, I imagine that charging a phone (in flight mode) with the inbuilt USB port on the head rest would be a security risk. Could I mitigate that risk by taking a regular USB cable ...
71
votes
9answers
14k views

How can “USB stick” online identification possibly work?

My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced. Most importantly, they introduced a rather ...
61
votes
4answers
9k views

How worried should I be about getting hacked with PoisonTap?

I just heard of PoisonTap today. Here is a short description from a TechCrunch article: PoisonTap connects to the USB port and announces itself not as a USB device, but an Ethernet interface. The ...
53
votes
13answers
16k views

Allow only specific devices to be connected to USB

Suppose I have a Windows PC in a safe room, disconnected from the internet, with only 3 cables connecting to another room, to a mouse, monitor and keyboard. The computer contains highly sensitive ...
53
votes
6answers
11k views

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk. It was for 3 seconds and I was in control of the MacBook the whole time.
46
votes
8answers
10k views

Force user to remove USB token

I'm looking at setting up secure laptops using BitLocker with pre-boot PIN and startup key. I'm wondering if there is a way to force the user, who is remote, to remove the USB with the startup key ...
44
votes
1answer
4k views

Why is Firewire a bigger threat than USB?

This question notes that a person briefly connected an Android device to an Apple computer via USB, and one comment indicates that it would "quite possibly" be a risk: In theory, yes, in practice, ...
43
votes
7answers
24k views

How to prevent BadUSB attacks on Linux desktop?

What can I do to protect my Linux laptop from BadUSB attacks as described by ArsTechnica here? Perhaps writing an appropriate AppArmor profile would help?
33
votes
9answers
7k views

Is it safe to use cheap USB data cables?

Websites like Amazon and eBay sell USB data cables for a pittance, often of unknown or dubious provenance. Should I be wary of using these cables to transfer data to or from my devices? Is it ...
32
votes
3answers
7k views

Can malware be transmitted via a USB charger plugged into a wall socket?

I have a smart phone that I often plug into a wall socket for charging via a small adapter that rectifies the AC to DC power and transforms the voltage from line (120V or 240V) to 5 V DC, probably ...
31
votes
5answers
5k views

How to safely wipe a USB flash drive [duplicate]

I want to wipe all residual data left behind even after a format on a regular 64GB fash drive, the ones someone can scan and recover data. What's the most efficient but quickest way to do this? Any ...
31
votes
5answers
5k views

Is disallowing write to USB actually an efficient way to prevent data leakage?

In my organization, a group policy exists that prevents users from writing data to a USB stick. This always seemed like a bit of a pointless PITA to me, just "one of those things...". I forget about ...
31
votes
2answers
6k views

Can a connected USB device read all data from the USB bus?

Is it possible for a (malicious) (hardware) USB device to access all the data that is transferred through the USB bus and then read/store this information, essentially sniffing all transferred data? ...
19
votes
1answer
9k views

How to check if my USB stick firmware can be rewritten via the USB port?

How can I know in Linux (or otherwise), if the firmware of my USB flash drive can be rewritten using the USB port (when sticking it in an USB port)? Eg. for a cheap EMTEC 16GB. I was thinking about ...
15
votes
4answers
8k views

Can I block viruses from a USB stick by scanning it before opening its folder?

I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
15
votes
4answers
9k views

Detecting Hardware keyloggers… elegant solutions?

My company recently discovered a hardware keylogger installed during an routine maintenance procedure. We tried catching the culprit but unfortunately it doesn't seem like we are going to be able to, ...
14
votes
5answers
9k views

Can autoplay USB stick spread virus to windows 8 or 10?

Autoplay was a security hole on older versions of Windows, but can I trust newer version like Windows 8 or 10 to insert USB stick without turning autoplay off?
14
votes
6answers
2k views

Can the BadUSB exploit be prevented?

Recently I read a few things about the BadUSB exploit, for example: http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/ My understanding ...
11
votes
2answers
8k views

Attacks via physical access to USB (DMA…?)

I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or a laptop attached to a desk. Obviously, the boot sequence should be secure (...
10
votes
2answers
244 views

risk from USB-C port on locked laptop

If an attacker has access to the USB-C port on my laptop which is in powered on but at the lock screen, what is the risk that they are able to carry out an evil maid attack? Say I'm in the room but ...
9
votes
3answers
218 views

Does connecting an android device via usb to a PC pose a risk if charging is selected?

If an android device has some something malicious on it that can also target/affect PCs. And that device is connected to a PC via USB, by default it automatically chooses to start charging. Is there ...
8
votes
2answers
1k views

Hardware devices for protecting against BadUSB?

Have any devices been released which protect against BadUSB attacks? I'm particularly interested in buying a USB hub which has the following protections: The USB hub itself won't allow reflashing ...
8
votes
3answers
1k views

Disable USB keyboard pluggability on MacBook

I'm concerned about USB devices being physically attached to my MacBook laptop when I am about to unlock my computer or while my computer is unlocked. My threat model involves an attacker who is ...
7
votes
3answers
4k views

Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker?

Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd. If an attacker gets physical ...
7
votes
2answers
884 views

A compromised USB

Assuming that a given USB drive is compromised(infected), what's the best way to deal with it? I mean, obviously, the solution is to nuke(format) the drive. But for that, the device needs to be ...
7
votes
4answers
5k views

Is it possible to USB whitelist in Linux?

After watching Black Hat's presentation on the fundamental problems with USB "security", I'm wondering if there's a way to do USB whitelisting in Linux. Is there currently a mechanism that will allow ...
7
votes
0answers
278 views

Windows 10 installaton USBs sold by Microsoft [closed]

With the recent release of Microsoft's Windows 10, I dropped by a local Microsoft store to purchase a windows 10 installation media. To my surprise (somewhat) the employees said that they do not ...
6
votes
3answers
8k views

Why use a USB WiFi adapter with Aircrack-ng?

What are the limitations we have when we are performing aircrack-ng pen testing using laptop's built-in WiFi adapter? Many pen testers are using USB WiFi dongles for this purpose and I wonder why. ...
6
votes
2answers
6k views

How to detect a keylogger in a USB keyboard? Can a USB keyboard host a keylogger?

I recently got an USB keyboard. I want to investigate if the microcontroller of the keyboard may host a keylogger and how could it interact with a Windows OS. My understanding is that, once Windows ...
6
votes
3answers
286 views

Is it safe to connect a random USB battery from a bin to my phone without stopping data transfer in some way?

I've asked the question Power-only USB connection to charge my phone - as simple as cutting the data lines? in electronics SE. In order to bypass the "Why do you want to do this?" request for ...
6
votes
4answers
778 views

Possible to use *only* U2F authentication?

Using a U2F USB authentication key to login to services such as Google seems a good idea. However, these services often allow you to register a backup two-factor-authentication (2FA) method, which you ...
6
votes
1answer
197 views

Can USB host ports be dangerous in uncontrolled environments? Virus etc?

(Note: I was told this post belongs here rather than in Android Enthusiasts) We have an Android device with 2 external USB host ports. Now I wonder what harm can be accomplished by an attacker with ...
5
votes
3answers
1k views

BadUSB: Why are firmware writeable in the first place? Manufacturer's backdoor?

How many of you have actually updated their mouse, keyboard or USB stick firmware? How many vendor actually propose updates for such devices? However these devices firmware often offer a proprietary ...
5
votes
2answers
2k views

How to check if my usb drives are vulnerable by BAD USB

Mark pointed out that only one chip type is vulnerable to BAD USB, id like to check if mine are, am using only Kingston flash drives here so can you tell me if they are, or if there exists a list ...
5
votes
1answer
320 views

Are PS/2 devices a risky piece of hardware for modern point of sale devices to be using?

This question is based off of a TempleOS question here on Super User. The gist is that PS/2 support seems to be disabled from many modern BIOS’es due to a possible security flaw in the protocol. ...
5
votes
1answer
106 views

Does using an UPS mitigate power-analysis attacks on a keyboard?

Are there any papers that can document that using an online UPS (Uninterruptible Power Supply) can reliably protect against power-analysis attacks that attempt to read keystrokes on wired keyboards? ...
5
votes
3answers
166 views

USB modem software installs autorun.inf parser, are there any risks?

A major telecommunications device manufacturer ships its USB modem with helper software and drivers so that the user can connect to the internet and send/receive SMS. Since recent versions of Windows ...
5
votes
0answers
2k views

Storing SSH keys on a dedicated hardware device [closed]

When setting up a remote SSH access for an automated job, I realized that one of the main risks would be that the client machine gets hacked and the key stolen, giving the attacker access to the ...
4
votes
2answers
486 views

Can the USB standard be altered to prevent the “firmware attack”? [duplicate]

Wired, and others are reporting on a research paper by Karsten Nohl and Jakob Lell. The paper apparently shows how any USB device (not just memory sticks) can be infected with malware at the firmware ...
4
votes
3answers
2k views

How protect ourselves from USB Firmware viruses? Does Antivirus help?

On Windows (pnd probably other operating systems, I don't know), when you plug in a USB appliance (a flash drive, mouse, etc) Windows automatically runs the "Device installation" and the firmware is ...
4
votes
4answers
257 views

Risk of connecting found pendrives to USB ports

At work we mostly use Windows 10, but some co-workers doing design work use Macs. Pen-drives lie around and the only way of knowing what's inside, is to stick it into a PC and read the content? How ...
4
votes
1answer
1k views

How does holding the shift key protect my system from viruses on an USB?

I saw a tip on our local cyber security center informational page that holding the shift key on Windows while inserting a USB drive protect the system from being filled or attacked by malwares on that ...
4
votes
1answer
489 views

How can a user defeat anti-live forensics software?

Let's say I have a computer with full disk encryption which is logged and running, but I suspect it has anti-forensics software (eg. usbkill), which means that I risk compromising the integrity of the ...
4
votes
1answer
2k views

Is all the alarmism around BadUSB really called for with respect to host devices?

I can understand why there was such a furor about BadUSB and indeed it poses a rather earthshaking threat to the base assumptions of many in their cyber security threat models. Things which many of us ...
4
votes
3answers
123 views

what are security precautions to ask clients who send a USB or CD?

We're launching a tender for a big project, and some of the businesses who want to make an offer are asking if they can send some brochures together with a USB stick or CD-Rom. Since we're trying to ...
4
votes
1answer
759 views

How to check whether my USB flash drive was infected by the BadUSB

After failing to check whether my USB stick firmware can be rewritten AT ALL, I want find out, whether it WAS rewritten when I sticked it in another computer. In particular the question is: how to ...
4
votes
1answer
239 views

Can smart power meters read key presses on a wired keyboard?

Smart power meters are becoming quite prevalent. Question: Can a smart power meter (with patched firmware) read the keys pressed on a wired PS/2 or USB keyboard, connected to a desktop computer? What ...
4
votes
1answer
558 views

Can I safely use a physical USB stick inside VirtualBox (isolated) without possibly infecting the host OS?

There is a program that I wish to run under VirtualBox in order to avoid possibly infecting my computer because I am not sure I should trust the source. (Based on download location). It is for ...
4
votes
1answer
101 views

Deactivate Linux Shell to prevent “blind” login on router

Today I analyzed my home router. I connected a keyboard to the router's USB port, which is usually used for mass storage devices. However, I pressed the key combination to reboot a Linux system from ...
4
votes
0answers
424 views

Onboard Memory of USB HID Devices “hackable”?

I own some mice and keyboards for example my logitech G400 mouse and my razer deathstalker keyboard. Both of those devices have as far as i know built in memories to save DPI settings macros so on ...