[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Find something in the street and plug it in.





On Mon, Oct 7, 2019 at 7:39 PM Rick Moen <rick@linuxmafia.com> wrote:

The crux of the problem is that any USB device, if so reprogrammed by a
hostile party, can suddenly start acting like a different USB device
class than it appears to be, and taking actions hostile to the
adminstrator. 

For example the USB Rubber Ducky https://shop.hak5.org/products/usb-rubber-ducky-deluxe 
But you can also put the Raspberry Pi Zero into gadget mode and it can be plugged in and be a
HID device.  (Maybe next Pi meeting someone would like to try)  Though the Zero is small it is 
not small enough to fool anyone.  

 
I believe I've seen a few stabs at a hardware
countermeasure like a dongle you interpose between your computer's USB
port and an outboard device.  You set a control on the dongle to permit,
say, only USB HID-class (human interface device, such as keyboard and
mouse) operations.  If the device attempts to suddenly say to the host
computer 'OK, I'm actually a mountable mass storage device', the dongle
intercepts that USB instruction and doesn't allow it through.  Likewise
if it's supposed to be a scanner, just a USB cable, etc., but upon
connection it says the host computer 'Actually, I'm an HID-class
device.'  But I cannot remember where I saw that implemented, or
(actually) if I merely saw the idea discussed but not yet implemented.

Like a USB condom.  But internet search brings up dongles that protect when plugging 
into chargers.  https://shop.syncstop.com/collections/buy 
But I have seen some USB devices that are also flash drives (with the needed Windows 
drivers.)  There are also some keyboards with integrated touchpads and so would present as 
two HIDs.  
The Raspberry Pi Zero supposedly can be two gadgets at once.  

Then there is the possibility of real maliciousness: USBkiller  
Kinda like the famous etherkiller:   http://www.fiftythree.org/etherkiller/ or the 
BOFH story: http://www.plig.net/bofh/lastbastard.html

USB killer:  https://hackaday.com/2015/10/10/the-usb-killer-version-2-0/ or the true link 
in Russian:  https://habr.com/en/post/268421/
Instructible (build your own)  https://www.instructables.com/id/How-to-Make-USB-Killer-From-Bug-Zapper-Racket-/

I have just been thinking about power on USB because I have a small HDMI display with 
5V input.  And I thought to solder a USB cable instead.  (Most of the time the display can get 
enough juice from the HDMI)  So I was looking at the spec to see if I would need to do 
anything with the data lines of the cable.  Then I thought USBkiller and of course someone 
has already done it.  
Btw I don't need to do anything with the data lines for display power.  It is on the power 
supply side where you have to mess with those lines.  See:  https://learn.adafruit.com/minty-boost/icharging


Thomas 

--
You received this message because you are subscribed to the Google Groups "BerkeleyLUG" group.
To unsubscribe from this group and stop receiving emails from it, send an email to berkeleylug+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/berkeleylug/CAGpvfsq0G3xW_cEVTrvXnDV%2BeksQn14ngPG6fVAKZDBpiDK0aw%40mail.gmail.com.