Upgrading and Repairing PCs Tip #14: USB Security Risks
Find more tips from Upgrading and Repairing PCs here.
From the book
From the book
From the book
USB storage devices, such as flash memory “thumb” drives, have long been known to be a potential security risk. USB drives have been used to spread many types of malware, so it’s not surprising that blocking USB storage devices is a typical Group Security Policy setting in many corporate installations of Microsoft Windows. Most types of infections carried in the storage area of USB drives can be detected and removed with anti-malware software. Unfortunately, research announced at the July BlackHat 2014 security conference (see http://www.wired.com/2014/07/usb-security/) revealed that the security risks of USB go far beyond storage devices.
Security researchers Karsten Nohl and Jakob Lell of SR Labs discovered that the firmware in many types of USB devices, including flash drives, webcams, keyboards, and so on, can be rewritten to contain malware that cannot be detected with conventional anti-malware apps.
Their proof-of-concept malware, which they dubbed “BadUSB,” (see https://srlabs.de/badusb/) could be used to take over the connected device, use it as a relay point for data, enter commands as if they’re being typed by the user, and perform many other types of malware attacks. Once a system is infected with USB firmware-based malware, it can infect the next USB storage device connected to it—again, without conventional anti-malware (or even anti-rootkit) apps being able to detect the infection. Even if you use a Group Security Policy setting that blocks USB storage devices, a USB device’s firmware can be altered so that a USB flash drive, for example, appears as a different (non-blocked) USB class and can infect the target device.
In November, SR Labs provided examples of typical attacks at PacSec 2014:
- Using an infected USB drive to emulate a keyboard and second drive to infect a computer during boot
- Using a Windows computer to infect a USB thumb drive that can grab the sudo password on a Linux system to gain root privileges
- Turning a USB thumb drive into a DNS server that can be used to redirect Internet traffic as desired by the attacker
- Attacking a virtual machine
- Using an Android phone connected to a Windows system for charging to intercept Internet traffic
The conclusion reached by SR Labs was sobering “As long as USB controllers are reprogrammable, USB peripherals should not be shared with others.”
To stop USB firmware attack vectors, a new generation of USB devices with unalterable firmware would need to be developed. Until this happens, there are precautions you can take to protect your information and devices:
- Don’t use USB devices from untrusted sources on your computer—Maybe it’s time to stop grabbing “free” USB flash drives at conferences or trade shows.
- Consider using other methods to distribute apps, utility programs, and updates—The venerable optical disc might be worth reviving as an alternative to the threat of USB infections.
- Use cloud storage or optical drives instead of USB flash drives to receive client data.
- Treat USB flash drives as “throwaways” if they are used to transfer data between trusted and untrusted devices.