Questions tagged [usb]
an industry standard used for connecting to and powering peripheral devices (keyboards, mice, cameras, printers, external hard drives, etc) from a computer or other USB capable device.
260
questions
89
votes
9
answers
16k
views
Secure USB cable for charging in untrusted environments
On a long haul flight, I imagine that charging a phone (in flight mode) with the inbuilt USB port on the head rest would be a security risk.
Could I mitigate that risk by taking a regular USB cable ...
- 1,298
71
votes
9
answers
16k
views
How can "USB stick" online identification possibly work?
My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced.
Most importantly, they introduced a rather ...
user135452
67
votes
8
answers
16k
views
Can a stolen Android phone with USB debugging enabled have screen lock bypassed?
My Android (8.0) phone was pickpocketed from me yesterday. It was immediately turned off by the thief and when I tried to locate it using Find My Device it shows as offline.
As a programmer and a ...
- 693
60
votes
4
answers
9k
views
How worried should I be about getting hacked with PoisonTap?
I just heard of PoisonTap today. Here is a short description from a TechCrunch article:
PoisonTap connects to the USB port and announces itself not as a USB
device, but an Ethernet interface. The ...
- 1,705
54
votes
13
answers
24k
views
Allow only specific devices to be connected to USB
Suppose I have a Windows PC in a safe room, disconnected from the internet, with only 3 cables connecting to another room, to a mouse, monitor and keyboard.
The computer contains highly sensitive ...
- 805
52
votes
6
answers
12k
views
Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?
Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk.
It was for 3 seconds and I was in control of the MacBook the whole time.
- 701
51
votes
7
answers
31k
views
How to prevent BadUSB attacks on Linux desktop?
What can I do to protect my Linux laptop from BadUSB attacks as described by ArsTechnica here?
Perhaps writing an appropriate AppArmor profile would help?
- 1,473
46
votes
8
answers
10k
views
Force user to remove USB token
I'm looking at setting up secure laptops using BitLocker with pre-boot PIN and startup key.
I'm wondering if there is a way to force the user, who is remote, to remove the USB with the startup key ...
- 742
43
votes
1
answer
4k
views
Why is Firewire a bigger threat than USB?
This question notes that a person briefly connected an Android device to an Apple computer via USB, and one comment indicates that it would "quite possibly" be a risk:
In theory, yes, in practice, ...
34
votes
3
answers
11k
views
Can malware be transmitted via a USB charger plugged into a wall socket?
I have a smart phone that I often plug into a wall socket for charging via a small adapter that rectifies the AC to DC power and transforms the voltage from line (120V or 240V) to 5 V DC, probably ...
- 2,052
34
votes
2
answers
8k
views
Can a connected USB device read all data from the USB bus?
Is it possible for a (malicious) (hardware) USB device to access all the data that is transferred through the USB bus and then read/store this information, essentially sniffing all transferred data? ...
- 1,147
33
votes
9
answers
9k
views
Is it safe to use cheap USB data cables?
Websites like Amazon and eBay sell USB data cables for a pittance, often of unknown or dubious provenance.
Should I be wary of using these cables to transfer data to or from my devices? Is it ...
- 432
32
votes
5
answers
12k
views
How to safely wipe a USB flash drive [duplicate]
I want to wipe all residual data left behind even after a format on a regular 64GB fash drive, the ones someone can scan and recover data. What's the most efficient but quickest way to do this? Any ...
- 452
31
votes
5
answers
6k
views
Is disallowing write to USB actually an efficient way to prevent data leakage?
In my organization, a group policy exists that prevents users from writing data to a USB stick. This always seemed like a bit of a pointless PITA to me, just "one of those things...". I forget about ...
- 381
22
votes
1
answer
12k
views
How to check if my USB stick firmware can be rewritten via the USB port?
How can I know in Linux (or otherwise), if the firmware of my USB flash drive can be rewritten using the USB port (when sticking it in an USB port)? Eg. for a cheap EMTEC 16GB.
I was thinking about ...
- 363
16
votes
4
answers
14k
views
Can I block viruses from a USB stick by scanning it before opening its folder?
I inserted my USB stick into a friend's PC which was full of viruses, malwares and adwares. Therefore I suppose they attacked my USB device as well. Now I want to use my USB device on my PC without ...
- 481
16
votes
4
answers
12k
views
Detecting Hardware keyloggers... elegant solutions?
My company recently discovered a hardware keylogger installed during an routine maintenance procedure.
We tried catching the culprit but unfortunately it doesn't seem like we are going to be able to, ...
- 161
14
votes
5
answers
11k
views
Can autoplay USB stick spread virus to windows 8 or 10?
Autoplay was a security hole on older versions of Windows, but can I trust newer version like Windows 8 or 10 to insert USB stick without turning autoplay off?
- 1,398
14
votes
2
answers
14k
views
Attacks via physical access to USB (DMA...?)
I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or a laptop attached to a desk.
Obviously, the boot sequence should be secure (...
- 311
14
votes
6
answers
3k
views
Can the BadUSB exploit be prevented?
Recently I read a few things about the BadUSB exploit, for example:
http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/
My understanding ...
- 141
11
votes
1
answer
3k
views
Is all the alarmism around BadUSB really called for with respect to host devices?
I can understand why there was such a furor about BadUSB and indeed it poses a rather earthshaking threat to the base assumptions of many in their cyber security threat models. Things which many of us ...
- 299
11
votes
3
answers
8k
views
Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker?
Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd.
If an attacker gets physical ...
- 466
11
votes
4
answers
24k
views
How to detect a keylogger in a USB keyboard? Can a USB keyboard host a keylogger?
I recently got an USB keyboard. I want to investigate if the microcontroller of the keyboard may host a keylogger and how could it interact with a Windows OS. My understanding is that, once Windows ...
- 213
11
votes
3
answers
2k
views
Disable USB keyboard pluggability on MacBook
I'm concerned about USB devices being physically attached to my MacBook laptop when I am about to unlock my computer or while my computer is unlocked.
My threat model involves an attacker who is ...
- 213
10
votes
2
answers
784
views
risk from USB-C port on locked laptop
If an attacker has access to the USB-C port on my laptop which is in powered on but at the lock screen, what is the risk that they are able to carry out an evil maid attack? Say I'm in the room but ...
- 101
9
votes
2
answers
4k
views
Can BadUSB be avoided by looking at the shapes and the controller model inside it?
I'm an average user. I don't take part or have any dangerous jobs.
I know that there is no fixed solution for this type of attack. However, I think USB is still become common devices for average user. ...
9
votes
4
answers
11k
views
Is it possible to USB whitelist in Linux?
After watching Black Hat's presentation on the fundamental problems with USB "security", I'm wondering if there's a way to do USB whitelisting in Linux.
Is there currently a mechanism that will allow ...
- 6,823
9
votes
2
answers
2k
views
Hardware devices for protecting against BadUSB?
Have any devices been released which protect against BadUSB attacks?
I'm particularly interested in buying a USB hub which has the following protections:
The USB hub itself won't allow reflashing ...
- 6,823
9
votes
3
answers
5k
views
Does connecting an android device via usb to a PC pose a risk if charging is selected?
If an android device has some something malicious on it that can also target/affect PCs. And that device is connected to a PC via USB, by default it automatically chooses to start charging.
Is there ...
- 235
7
votes
2
answers
2k
views
A compromised USB
Assuming that a given USB drive is compromised(infected), what's the best way to deal with it? I mean, obviously, the solution is to nuke(format) the drive. But for that, the device needs to be ...
- 613
7
votes
4
answers
1k
views
Possible to use *only* U2F authentication?
Using a U2F USB authentication key to login to services such as Google seems a good idea. However, these services often allow you to register a backup two-factor-authentication (2FA) method, which you ...
- 133
7
votes
1
answer
3k
views
Can I safely use a physical USB stick inside VirtualBox (isolated) without possibly infecting the host OS?
There is a program that I wish to run under VirtualBox in order to avoid possibly infecting my computer because I am not sure I should trust the source. (Based on download location).
It is for ...
- 254
7
votes
0
answers
345
views
Windows 10 installaton USBs sold by Microsoft [closed]
With the recent release of Microsoft's Windows 10, I dropped by a local Microsoft store to purchase a windows 10 installation media.
To my surprise (somewhat) the employees said that they do not ...
- 79
6
votes
3
answers
12k
views
Why use a USB WiFi adapter with Aircrack-ng?
What are the limitations we have when we are performing aircrack-ng pen testing using laptop's built-in WiFi adapter? Many pen testers are using USB WiFi dongles for this purpose and I wonder why.
...
- 1,317
6
votes
3
answers
476
views
Is it safe to connect a random USB battery from a bin to my phone without stopping data transfer in some way?
I've asked the question Power-only USB connection to charge my phone - as simple as cutting the data lines? in electronics SE. In order to bypass the "Why do you want to do this?" request ...
- 1,409
6
votes
1
answer
268
views
Does using an UPS mitigate power-analysis attacks on a keyboard?
Are there any papers that can document that using an online UPS (Uninterruptible Power Supply) can reliably protect against power-analysis attacks that attempt to read keystrokes on wired keyboards?
...
- 215
6
votes
2
answers
2k
views
How to protect/mitigate IntelME (CSME) JTAG attack over USB?
Two security searchers from ptsecurity.com ( Maxim Goryachy @h0t_max and Mark Ermolov @_markel___ ) have announced on Twitter:
Game over! We (I and @_markel___ ) have obtained fully functional ...
- 311
6
votes
1
answer
324
views
Can USB host ports be dangerous in uncontrolled environments? Virus etc?
We have an Android device with 2 external USB host ports. Now I wonder what harm can be accomplished by an attacker with malicious intentions, provided that:
The user can not access settings or any ...
- 163
5
votes
2
answers
740
views
Can an SD card (or microsd card) emulate an HID device?
In a similar manner to a usb rubber ducky, can one use an SD card to emulate an HID device (such as a mouse or keyboard)? If so, how could this be implemented, and how can it be protected against?
- 1,336
5
votes
1
answer
819
views
How can a user defeat anti-live forensics software?
Let's say I have a computer with full disk encryption which is logged and running, but I suspect it has anti-forensics software (eg. usbkill), which means that I risk compromising the integrity of the ...
- 53
5
votes
3
answers
2k
views
BadUSB: Why are firmware writeable in the first place? Manufacturer's backdoor?
How many of you have actually updated their mouse, keyboard or USB stick firmware? How many vendor actually propose updates for such devices?
However these devices firmware often offer a proprietary ...
- 19.3k
5
votes
3
answers
6k
views
How protect ourselves from USB Firmware viruses? Does Antivirus help?
On Windows (pnd probably other operating systems, I don't know), when you plug in a USB appliance (a flash drive, mouse, etc) Windows automatically runs the "Device installation" and the firmware is ...
- 2,727
5
votes
1
answer
3k
views
How does holding the shift key protect my system from viruses on an USB?
I saw a tip on our local cyber security center informational page that holding the shift key on Windows while inserting a USB drive protect the system from being filled or attacked by malwares on that ...
- 153
5
votes
1
answer
812
views
Are PS/2 devices a risky piece of hardware for modern point of sale devices to be using?
This question is based off of a TempleOS question here on Super User. The gist is that PS/2 support seems to be disabled from many modern BIOS’es due to a possible security flaw in the protocol. ...
- 1,184
5
votes
2
answers
3k
views
How to check if my usb drives are vulnerable by BAD USB
Mark pointed out that only one chip type is vulnerable to BAD USB, id like to check if mine are, am using only Kingston flash drives here so can you tell me if they are, or if there exists a list ...
5
votes
1
answer
1k
views
Windows group policies to protect against Rubber Ducky attack
I have these group policies set on my personal computer and it seems to me they should protect against Rubber Ducky attack (however I've read other threads that say it's hard to protect against, hence ...
- 53
5
votes
3
answers
324
views
USB modem software installs autorun.inf parser, are there any risks?
A major telecommunications device manufacturer ships its USB modem with helper software and drivers so that the user can connect to the internet and send/receive SMS.
Since recent versions of Windows ...
user22260
5
votes
0
answers
2k
views
Storing SSH keys on a dedicated hardware device [closed]
When setting up a remote SSH access for an automated job, I realized that one of the main risks would be that the client machine gets hacked and the key stolen, giving the attacker access to the ...
- 537
4
votes
3
answers
15k
views
How to check if USB device isn't malicious?
Let's say I've got a generic, cheap mouse.
It's a USB-device. Any USB-device may contain memory, so how to know if the manufacturer didn't embed any memory with malware software in a device?
(on ...
- 225
4
votes
2
answers
598
views
Can the USB standard be altered to prevent the "firmware attack"? [duplicate]
Wired, and others are reporting on a research paper by Karsten Nohl and Jakob Lell. The paper apparently shows how any USB device (not just memory sticks) can be infected with malware at the firmware ...
- 840