usb, fundamental security flaw found!

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
1

Using that flaw it is possible to take over a PC, invisibly (not detected by anything)!!!

Site:

Link:
/usb-has-a-fundamental-security-flaw-that-you-cant-detec-1613833339

2

Newer article about it, discuses that not even behavioral blocker can spot it.

Site:

Link:
/2014/07/31/black_hat_hackers_drive_truck_through_hole_in_usb_security

3

Hmm, thought, would a USB device whitelist be possible? ??? I don’t mean a general whitelist that Comodo maintains but instead whenever you plug in a device using USB, the device is detected but not initialized, then you get an alert asking if you want to allow the device (and also if you want to whitelist it) … Iunno, it would stop malicious third parties from simply plugging in a USB device and taking over the computer, assuming the attacker doesn’t click Allow… hmm… Perhaps password protection…

Another idea, hash of firmware, upon each use of the usb device the firmware is hashed again, if there is a hash mismatch then the device isn’t allowed.

Meh, perhaps those weren’t good ideas after all, without knowing how this malware works more technically, it’s hard to think of a theoretical protection.

Edit: HIPS for USB devices? e.g “HID-compliant keyboard is trying to XYZ - Allow / Deny / Trust” etc… perhaps that wouldn’t work either…

4

[at]Sanya IV Litvyak

Your first idea can be done by the built-in GPO of windows 7,8.

using the first 2 scenarios of the following Microsoft guide:
Site:

Link:
/en-us/library/cc731387(WS.10).aspx

Here another link of a guy asking on the Microsoft forums about it:
Site:

Link:
/Forums/windowsserver/en-US/7ec228c5-d5cd-490d-908d-a7d14b4da424/usb-lockdown-with-gpo

The problem is the general people don’t have a clue about security,
however usb companies could sign their devices, again this may take years to happen.

5

There is no effective protection because antivirus products do not have access to the firmware(s) of USB devices.
Behavioral detection won’t be good since a malicious USB can switch to a different device type. Thus, the monitoring mechanism would record only a new USB device.
Moreover, at the moment, there is no firewall solution that could block certain device classes.

There are many possibilities :

  • may infect other USB components. E.g. WebCam, (USB) Keyboard.
  • may replace computer’s BIOS (by emulating a keyboard).
  • etc.

If this ‘threat’ is detected then all USB devices will be considered suspicious/infected. The only “real protection” would be restricting the use of USB devices.

6

Update regarding the USB flaw…

Site:

Link:
/badusb-attack-code-publicly-disclosed/108663

For Comodo developers, the source code can be found within the link above.

7

Is it not the case though, that whatever malware code injected via the BADUSB flaw does, if it can’t “phone home” it’s pretty useless? The CIS firewall (if properly configured) can prevent unknown programs from getting out on the network, so would that not prevent loss of personal data etc. (even though you’d still be infected of course)?

Or am I missing something here?

8

I don’t know exactly how it works but if it can also pretend to be a keyboard and a mouse, would it not, if sophisticated, be able to automatically accept such firewall alerts?

9

I don’t know either, but if any software can bypass or spoof the CIS firewall then the firewall is useless don’t you think?