Jump to content

This published hack could be the beginning of the end for USB

Akolyte
 Share
Posted

*Quoted From The Verge*

Share on Facebook (16) Tweet (1)

In July, researchers Karsten Nohl and Jakob Lell announced that they'd found a critical security flaw they called BadUSB, allowing attackers to smuggle malware on the devices effectively undetected. Even worse, there didn't seem to be a clear fix for the attack. Anyone who plugged in a USB stick was opening themselves up to the attack, and because the bad code was residing in USB firmware, it was hard to protect against it without completely redesigning the system. The only good news was that Nohl and Lell didn't publish the code, so the industry had some time to prepare for a world without USB.

"YOU HAVE TO PROVE TO THE WORLD THAT IT'S PRACTICAL."

 

As of this week, that's no longer true. In a joint talk at DerbyCon, Adam Caudill and Brandon Wilson announced they had successfully reverse-engineered BadUSB, and they didn't share Nohl and Lell's concerns about publishing the code. The pair has published the code on GitHub, and demonstrated various uses for it, including an attack that takes over a user's keyboard input and turns control over to the attacker. According to Caudill, the motive for the release was to put pressure on manufacturers. "If the only people who can do this are those with significant budgets, the manufacturers will never do anything about it," he told Wired's Andy Greenberg. "You have to prove to the world that it’s practical, that anyone can do it."

Still, the net effect is unlikely to be a push for USB security. As long as attackers can reprogram USB firmware, attacks like this will be a serious threat. The only way to fix the vulnerability is a new layer of security around firmware, but that would mean a full update to the USB standard itself, which mean years of insecurity. However the industry responds, we're likely to be living with it for a long, long time.

In the meantime, any time you plug a USB drive into your computer, you'll be opening up a huge vector of attack. It's easy to imagine a pile of dirty USBs being dumped onto a table at CES or desk at your local Kinko's. Unless you can track a device's provenance from the factory to your computer, the only real protection avoiding USB drives and devices at every turn — covering over your USB ports the same way you might cover your laptop camera. It's an extreme response, but not an unreasonable one. And for large portions of the peripheral hardware industry, it could be a very scary thought.

*Quoted From the verge*

 

 

 

I personally think this is the time we need to make something more secure and faster and reliable than USB, I also believe sadly this will never get much attention from the majority of the public.  

 

I think this was going to happen anyways.  I don't really have anything much else to say.  But I hope you enjoyed the post :)

 

Source - TheVerge 

 

For dark theme users:

 

Here is the link to the article. http://www.theverge.com/2014/10/2/6896095/this-published-hack-could-be-the-beginning-of-the-end-for-usb

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

what about usb c, maybe they can do a overhaul in more than just the connectors

My Rig  

 
PCPartPicker part list: http://ca.pcpartpicker.com/p/kGNksY

 

CPU: Intel Core i7-4770 3.4GHz Quad-Core Processor  ($379.00 @ shopRBC) 

CPU Cooler: RAIJINTEK THEMIS 65.7 CFM Sleeve Bearing CPU Cooler  ($34.99 @ NCIX) 

Motherboard: MSI CSM-H87M-G43 Micro ATX LGA1150 Motherboard  ($78.83 @ DirectCanada) 

Memory: Kingston HyperX 16GB (4 x 4GB) DDR3-1600 Memory  ($139.99 @ Memory Express) 

Storage: Kingston Fury 120GB 2.5" Solid State Drive  ($71.34 @ DirectCanada) 

Storage: Seagate Barracuda 2TB 3.5" 7200RPM Internal Hard Drive  ($92.95 @ Vuugo) 

Video Card: Gigabyte Radeon R9 280X 3GB Video Card  ($298.98 @ Newegg Canada) 

Case: Fractal Design Define R4 w/Window (Black Pearl) ATX Mid Tower Case  ($125.98 @ Newegg Canada) 

Power Supply: Corsair CX 600W 80+ Bronze Certified Semi-Modular ATX Power Supply  ($66.99 @ NCIX) 

Operating System: Microsoft Windows 8.1 - 64-bit (OEM) (64-bit)  ($116.00 @ shopRBC) 

Case Fan: Cougar Turbine 120 (4-Pack) 60.4 CFM 120mm  Fans  ($23.99 @ NCIX) 

Monitor: HP 22xi 60Hz 21.5" Monitor  ($187.11 @ Amazon Canada) 

Monitor: HP 22xi 60Hz 21.5" Monitor  ($187.11 @ Amazon Canada) 

Keyboard: Logitech G710 Wired Gaming Keyboard  ($114.99 @ NCIX) 

Mouse: Razer DeathAdder 2013 Wired Optical Mouse  ($76.99 @ Amazon Canada) 

Headphones: Kingston HyperX Cloud Pro Headset  ($78.98 @ DirectCanada) 

Total: $2074.22

Prices include shipping, taxes, and discounts when availableGenerated by PCPartPicker 2015-04-10 15:33 EDT-0400Build log http://linustechtips.com/main/topic/303263-the-dell-from-hell/#entry4121100 

Phone Compassion Spreadsheet https://docs.google.com/spreadsheets/d/1EN6s426gyxqPloIqT4wQ7Y7yovkkQy_5B3djVN-N-R8/edit#gid=0


Gta V Pc Online Crew http://linustechtips.com/main/topic/344773-unofficial-linus-tech-tips-gta-v-crew-pc/

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

didn't this happen ages ago, and even get demonstrated a couple months ago?

USB C hasn't been finalized IIRC, so there could be efforts to fix these exploits.

INTEL CORE I5 4670K | NVIDIA GTX 980 | NOCTUA NH-L9i | GIGABYTE GA-Z97X-SLI | KINGSTON 120GB V300

CM STORM QUICKFIRE TK | BENQ XL2420TE | ROCCAT SAVU | FRACTAL DEFINE R4

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I also agree that we need a faster and better way to replace USB. It is getting quite dated.

Also just to make the rest of the night-theme users happy.

[spoiler=Fix please. :)]

0bb326f4a48b3cb2cff0ddeddbd107af.png

 

Spoiler

Senor Shiny: Main- CPU Intel i7 6700k 4.7GHz @1.42v | RAM G.Skill TridentZ CL16 3200 | GPU Asus Strix GTX 1070 (2100/2152) | Motherboard ASRock Z170 OC Formula | HDD Seagate 1TB x2 | SSD 850 EVO 120GB | CASE NZXT S340 (Black) | PSU Supernova G2 750W  | Cooling NZXT Kraken X62 w/Vardars
Secondary (Plex): CPU Intel Xeon E3-1230 v3 @1.099v | RAM Samsun Wonder 16GB CL9 1600 (sadly no oc) | GPU Asus GTX 680 4GB DCII | Motherboard ASRock H97M-Pro4 | HDDs Seagate 1TB, WD Blue 1TB, WD Blue 3TB | Case Corsair Air 240 (Black) | PSU EVGA 600B | Cooling GeminII S524

Spoiler

(Deceased) DangerousNotDell- CPU AMD AMD FX 8120 @4.8GHz 1.42v | GPU Asus GTX 680 4GB DCII | RAM Samsung Wonder 8GB (CL9 2133MHz 1.6v) | Motherboard Asus Crosshair V Formula-Z | Cooling EVO 212 | Case Rosewill Redbone | PSU EVGA 600B | HDD Seagate 1TB

DangerousNotDell New Parts For Main Rig Build Log, Señor Shiny  I am a beautiful person. The comments for your help. I have to be a good book. I have to be a good book. I have to be a good book.

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Build a better mouse trap and they'll build a better mouse.  No one should be thinking "just ditch USB for something better" because there is no such thing as "something better" when it comes to security, there is only "better for now".

 

 

I think they did the right thing, most of us and most of the business world can implement policies to control what USB devices they use while a solution is being implemented.

Grammar and spelling is not indicative of intelligence/knowledge.  Not having the same opinion does not always mean lack of understanding.  

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

I also agree that we need a faster and better way to replace USB. It is getting quite dated.

Also just to make the rest of the night-theme users happy.

[spoiler=Fix please. :)]

0bb326f4a48b3cb2cff0ddeddbd107af.png

What font is normal?  I tried to change it to Arial.  I can't find the regular font :/

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

firmwares on anything has always had a security issue

hard drives / USB sticks / motherboards etc

Yes.  

 

But I'm not sure if it will be as easy and someone just releasing a new firmware to patch a vulnerability.  I don't think it can be done.  

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

What font is normal?  I tried to change it to Arial.  I can't find the regular font :/

Set the font color to automatic.

3c3f168d6d7e8a09f833d0f98c6a4c95.png

 

Spoiler

Senor Shiny: Main- CPU Intel i7 6700k 4.7GHz @1.42v | RAM G.Skill TridentZ CL16 3200 | GPU Asus Strix GTX 1070 (2100/2152) | Motherboard ASRock Z170 OC Formula | HDD Seagate 1TB x2 | SSD 850 EVO 120GB | CASE NZXT S340 (Black) | PSU Supernova G2 750W  | Cooling NZXT Kraken X62 w/Vardars
Secondary (Plex): CPU Intel Xeon E3-1230 v3 @1.099v | RAM Samsun Wonder 16GB CL9 1600 (sadly no oc) | GPU Asus GTX 680 4GB DCII | Motherboard ASRock H97M-Pro4 | HDDs Seagate 1TB, WD Blue 1TB, WD Blue 3TB | Case Corsair Air 240 (Black) | PSU EVGA 600B | Cooling GeminII S524

Spoiler

(Deceased) DangerousNotDell- CPU AMD AMD FX 8120 @4.8GHz 1.42v | GPU Asus GTX 680 4GB DCII | RAM Samsung Wonder 8GB (CL9 2133MHz 1.6v) | Motherboard Asus Crosshair V Formula-Z | Cooling EVO 212 | Case Rosewill Redbone | PSU EVGA 600B | HDD Seagate 1TB

DangerousNotDell New Parts For Main Rig Build Log, Señor Shiny  I am a beautiful person. The comments for your help. I have to be a good book. I have to be a good book. I have to be a good book.

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

didn't this happen ages ago, and even get demonstrated a couple months ago?

USB C hasn't been finalized IIRC, so there could be efforts to fix these exploits.

There could be yeah.   

 

So, i think if USB-C gets this exploit fixed it would be awesome!  

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

Set the font color to automatic.

3c3f168d6d7e8a09f833d0f98c6a4c95.png

done. 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

what about usb c, maybe they can do a overhaul in more than just the connectors

Yeah, that was what I was thinking too.  

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

These people are idiots. USB revisions are what, 5 years to do. You need to get EVERY SINGLE manufacturer of ANYTHING with USB ready to update. They're just fucking stupid and have exposed the entire world to risk for several years.

 

Plus, every fucking computer in the world will have to be updated. What they've done is shitty and they're awful human beings.

 

For fucks sake, at least expose something that can be fixed in a fucking week

CPU: AMD Ryzen 7 3700X - CPU Cooler: Deepcool Castle 240EX - Motherboard: MSI B450 GAMING PRO CARBON AC

RAM: 2 x 8GB Corsair Vengeance Pro RBG 3200MHz - GPU: MSI RTX 3080 GAMING X TRIO

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Yes.  

 

But I'm not sure if it will be as easy and someone just releasing a new firmware to patch a vulnerability.  I don't think it can be done.  

even if it did happen it would be useless

the mass majority of  consumers dont know anything about this

If your grave doesn't say "rest in peace" on it You are automatically drafted into the skeleton war.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

fix the font colour pls.

 

unreadable in night theme

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Yeah, that was what I was thinking too.  

 

Good luck getting every peripheral manufacturer on the planet to change to type C overnight when every factory in the world is tooled for old standards

CPU: AMD Ryzen 7 3700X - CPU Cooler: Deepcool Castle 240EX - Motherboard: MSI B450 GAMING PRO CARBON AC

RAM: 2 x 8GB Corsair Vengeance Pro RBG 3200MHz - GPU: MSI RTX 3080 GAMING X TRIO

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

These people are idiots. USB revisions are what, 5 years to do. You need to get EVERY SINGLE manufacturer of ANYTHING with USB ready to update. They're just fucking stupid and have exposed the entire world to risk for several years.

 

Plus, every fucking computer in the world will have to be updated. What they've done is shitty and they're awful human beings.

 

For fucks sake, at least expose something that can be fixed in a fucking week

I guess you could put it that way.  

 

I get your point.  

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

This has been well known for years. It's logic. 

muh specs 

Gaming and HTPC (reparations)- ASUS 1080, MSI X99A SLI Plus, 5820k- 4.5GHz @ 1.25v, asetek based 360mm AIO, RM 1000x, 16GB memory, 750D with front USB 2.0 replaced with 3.0  ports, 2 250GB 850 EVOs in Raid 0 (why not, only has games on it), some hard drives

Screens- Acer preditor XB241H (1080p, 144Hz Gsync), LG 1080p ultrawide, (all mounted) directly wired to TV in other room

Stuff- k70 with reds, steel series rival, g13, full desk covering mouse mat

All parts black

Workstation(desk)- 3770k, 970 reference, 16GB of some crucial memory, a motherboard of some kind I don't remember, Micomsoft SC-512N1-L/DVI, CM Storm Trooper (It's got a handle, can you handle that?), 240mm Asetek based AIO, Crucial M550 256GB (upgrade soon), some hard drives, disc drives, and hot swap bays

Screens- 3  ASUS VN248H-P IPS 1080p screens mounted on a stand, some old tv on the wall above it. 

Stuff- Epicgear defiant (solderless swappable switches), g600, moutned mic and other stuff. 

Laptop docking area- 2 1440p korean monitors mounted, one AHVA matte, one samsung PLS gloss (very annoying, yes). Trashy Razer blackwidow chroma...I mean like the J key doesn't click anymore. I got a model M i use on it to, but its time for a new keyboard. Some edgy Utechsmart mouse similar to g600. Hooked to laptop dock for both of my dell precision laptops. (not only docking area)

Shelf- i7-2600 non-k (has vt-d), 380t, some ASUS sandy itx board, intel quad nic. Currently hosts shared files, setting up as pfsense box in VM. Also acts as spare gaming PC with a 580 or whatever someone brings. Hooked into laptop dock area via usb switch

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

fix the font colour pls.

 

unreadable in night theme

I keep changing the font to normal!  :o  Its not working!!!! 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I guess you could put it that way.  

 

I get your point.  

 

It's like they're expecting manufacturers to be able to replace everyone in the world computers. People are still using the password "password". Why in the hell are they going to update this? Plus, even rolling it into an OS would do nothing for old computers as people still use system as old as Win 98 and older.

CPU: AMD Ryzen 7 3700X - CPU Cooler: Deepcool Castle 240EX - Motherboard: MSI B450 GAMING PRO CARBON AC

RAM: 2 x 8GB Corsair Vengeance Pro RBG 3200MHz - GPU: MSI RTX 3080 GAMING X TRIO

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Anything that needs firmware or drivers is vulnerable to low-level code attacks. ANYTHING. USB is just one interface, you can do the same on anything that needs drivers, even sata. The thing is that USB is universal, and everyone uses it, so thats why it would be targeted for stuff like this.

 

The point is, it cannot be fixed. Just like you cant prevent hackers from accessing the internet.

NEW PC build: Blank Heaven   minimalist white and black PC     Old S340 build log "White Heaven"        The "LIGHTCANON" flashlight build log        Project AntiRoll (prototype)        Custom speaker project

Spoiler

Ryzen 3950X | AMD Vega Frontier Edition | ASUS X570 Pro WS | Corsair Vengeance LPX 64GB | NZXT H500 | Seasonic Prime Fanless TX-700 | Custom loop | Coolermaster SK630 White | Logitech MX Master 2S | Samsung 980 Pro 1TB + 970 Pro 512GB | Samsung 58" 4k TV | Scarlett 2i4 | 2x AT2020

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

This has been well known for years. It's logic. 

 

The code hasn't been known to many for ages. Now it's open freaking source.

CPU: AMD Ryzen 7 3700X - CPU Cooler: Deepcool Castle 240EX - Motherboard: MSI B450 GAMING PRO CARBON AC

RAM: 2 x 8GB Corsair Vengeance Pro RBG 3200MHz - GPU: MSI RTX 3080 GAMING X TRIO

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

The code hasn't been known to many for ages. Now it's open freaking source.

There are many ways to do malicious things with usb on the hardware/firmware side. This isn't the only way.

muh specs 

Gaming and HTPC (reparations)- ASUS 1080, MSI X99A SLI Plus, 5820k- 4.5GHz @ 1.25v, asetek based 360mm AIO, RM 1000x, 16GB memory, 750D with front USB 2.0 replaced with 3.0  ports, 2 250GB 850 EVOs in Raid 0 (why not, only has games on it), some hard drives

Screens- Acer preditor XB241H (1080p, 144Hz Gsync), LG 1080p ultrawide, (all mounted) directly wired to TV in other room

Stuff- k70 with reds, steel series rival, g13, full desk covering mouse mat

All parts black

Workstation(desk)- 3770k, 970 reference, 16GB of some crucial memory, a motherboard of some kind I don't remember, Micomsoft SC-512N1-L/DVI, CM Storm Trooper (It's got a handle, can you handle that?), 240mm Asetek based AIO, Crucial M550 256GB (upgrade soon), some hard drives, disc drives, and hot swap bays

Screens- 3  ASUS VN248H-P IPS 1080p screens mounted on a stand, some old tv on the wall above it. 

Stuff- Epicgear defiant (solderless swappable switches), g600, moutned mic and other stuff. 

Laptop docking area- 2 1440p korean monitors mounted, one AHVA matte, one samsung PLS gloss (very annoying, yes). Trashy Razer blackwidow chroma...I mean like the J key doesn't click anymore. I got a model M i use on it to, but its time for a new keyboard. Some edgy Utechsmart mouse similar to g600. Hooked to laptop dock for both of my dell precision laptops. (not only docking area)

Shelf- i7-2600 non-k (has vt-d), 380t, some ASUS sandy itx board, intel quad nic. Currently hosts shared files, setting up as pfsense box in VM. Also acts as spare gaming PC with a 580 or whatever someone brings. Hooked into laptop dock area via usb switch

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Oh, so they were worried it could be a problem for the world, so they released it.....because reasons.

Ketchup is better than mustard.

GUI is better than Command Line Interface.

Dubs are better than subs

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Tech News

×