The Connection, Inc Blog

The Connection, Inc has been serving the New Jersey area since 1992, providing IT Support such as technical helpdesk support, computer support and consulting to small and medium-sized businesses.

BadUSB: Theoretical Malware Turned Reality

b2ap3_thumbnail_usb_security_400.jpgWe reported in August that security researcher Karsten Nohl of SR Labs revealed a flaw in USB firmware that cripples the technology beyond repair. At the Black Hat security conference, it was revealed that USB devices of all kinds can be targeted by hidden malware. Nohl refused to release the code used in the research, due to being concerned that it would be used by the wrong hands, but it has been made public anyway, putting the masses at risk.

Adam Caudill and Brandon Wilson, hackers at the Derbycon conference, have found their own way to take advantage of the USB firmware. They have reverse-engineered the firmware used by Nohl, and posted the code publicly on Github. Why would they do this? The answer is simple: It's a challenge; an ultimatum to USB manufacturers. Either the makers of USB technology must resolve the issue, or let every single user of USB devices stay vulnerable to the threat.

It's a bold attempt at opening the eyes of the bigwigs in the technology industry. Nohl, who previously discovered the USB vulnerabilities, refrained from posting how to exploit the devices because he thought the vulnerability was unpatchable. By posting the code where hackers can get to it, Caudill and Wilson are hoping that the code can be studied and protected against. In an interview with WIRED magazine, Caudill states:

If the only people who can do this are those with significant budgets, the manufacturers will never do anything about it. You have to prove to the world that it's practical, that anyone can do it...That puts pressure on the manufactures to fix the real issue.

USB firmware can be reprogrammed and used to perform illicit activities. For example, the security professionals were able to make the infected USB device appear as a keyboard, and then use it to type keystrokes on another machine. Because it's the firmware inside the USB device that's altered, it's difficult to fix.

A patch won't work because the problem isn't in the device's software, and files that hold malicious activity within the firmware can easily be deleted, hidden, or possibly even disable the USB's security functions. Caudill describes USBs as more than storage devices; in fact, he says, "[People] don't realize there's a reprogrammable computer in their hands."

In order to fix this vulnerability, manufacturers have to completely change the architecture of the USB device to make accessing the code inside the device impossible. According to Nohl, assuming that the problem is resolved, it would take up to 10 years for problems concerning the current USB standard to dissolve. In the meantime, here are a few tips to help keep yourself safe from the USB-transmitted disease:

  • Only allow trusted USB devices to connect to your PC. Don't let strangers charge their phones with your computer. Don't borrow someone else's USB device to move files from one PC to another. You're better off purchasing a new device and using it yourself.
  • Keep your eyes on your PC, especially in public places. Obviously, you shouldn't leave your computer lying around in the open where anyone could walk up and plug in a USB drive containing the malware.
  • Stay away from USB technology in general. This likely isn't an option, but it's the only way to truly keep yourself safe from the USB bug. Even devices like wireless mouses and keyboards can potentially hold the malware. Use wired mouses and keyboards, and transfer files using cloud services if you must.

Do you think that Caudill and Wilson did the right thing by releasing the code for BadUSB, or do you think they've unleashed a monster upon the world? Let us know in the comments.

Just 28% of Organizational Data Stored Has a Clear...
Does the FCC’s Sack of the NFL Blackout Ruling Bod...
 

Comments

No comments made yet. Be the first to submit a comment
Guest
Already Registered? Login Here
Guest
Thursday, 07 November 2024

Captcha Image

Blog Archive

Mobile? Grab this Article

QR Code

Free Consultation

team work

Interested in seeing what we can do for your business? Contact us to see how we can help you!

Sign Up Today!

News & Updates

The Connection, Inc. Celebrates 32 Years as a Trusted Technology Provider!   Since our founding in 1992, technology and the way we operate and do business has changed a lot. Companies that have adapted and aligned themselves with ...

Contact us

Learn more about what The Connection, Inc can do for your business.

The Connection, Inc
51 Village CT
Hazlet, New Jersey 07730