Jump to content

Mike Elgan Originally shared by BBC News Code that turns USB devices into cyber-attack platf...


G+_George Kozi
 Share

Recommended Posts

Chris Fixsen Are you sure about that? Can you trust that your "new" USB devices haven't been intercepted and "improved"? -- or even compromised at the factory?

 

Furthermore, can you trust that your computer/phone/printer/etc. haven't been compromised? 

 

The insidiousness of this exploit is that it isn't correctable without destroying all current USB devices and changing the USB standard to not allow the updating of the firmware. (which is an exploit waiting to happen in itself.)

 

In other words... there IS no simple solution. 

Link to comment
Share on other sites

Joshua Burgess You're talking about using the autorun feature of USB to compromise systems they're connected to. -- This is far worse.

 

If I reformat a USB drive it destroys that 10-year-ago attack. If I own the firmware on a USB drive, not only will reformatting not destroy the exploit, but you can't even SEE the exploit.

 

USB was designed to trust whatever the controller reports about the devices. In other words, I have no visibility of the USB device past the controller... and past that controller is the firmware and whatever else the device does.

 

Soooo... If I were using this attack, the first thing I would do is to make sure that the controller would report itself as a non-vulnerable USB chipset and automatically report the version number of any firmware that you attempted to upload into the controller. 

 

Since you have no visibility past the controller, any test you run will only show you what the controller tells you. - In my example, it would show you that the USB device is NOT vulnerable to attack, and that it's running the latest firmware.

 

In other words... sooooooo not the attack of 10 years ago. :)

Link to comment
Share on other sites

 Share

×
×
  • Create New...