Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
USB Emulation Evaluation
BadUSB
BadUSB was a talk at blackhat about how USBs can be reprogrammed to become malware. The focus is on overwriting the original firmware of the USBUniversal Serial Bus device controller with customized firmware. The USBUniversal Serial Bus device controller acts as the interface between the host and the USBUniversal Serial Bus device. Customizing the firmware on the USBUniversal Serial Bus device controller offer numerous opportunities. By controlling the USBUniversal Serial Bus device controller, the user (person programming the firmware) can choose how he/she wants the device to interact with the host. Parts of the USBUniversal Serial Bus device can be hidden, for instance, if it is a mass storage device or emulating a mass storage device, parts of the storage can be hidden from the host. If done correctly, the host should not be able to tell what the device really is. You could spoof the firmware so that if the host asks for it, the host is given the firmware the device wants you to think it has on it, rather than the firmware that is actually on it.
It was also mention that badUSB can infect other USBUniversal Serial Bus devices and overwrite their firmware as well. This part I am hazy on. I don't understand how exact the original device overwrites the USBUniversal Serial Bus device controller firmware. This capability could greatly extend the scope of badUSB. It could be used as gap-jumping malware that infects the peripherial USBUniversal Serial Bus devices on a computer making it difficult to detect and get rid of.
Something I think believe would be worth looking into is utilizing the hidden partions of a mass storage device combined with the USBRubberDucky capabilities to be able to both input and output to a host.
USBRubberDucky
USBRubberDucky is a keyboard emulator. It sends keystrokes to the host as if the device was a keyboard that someone was typing on. The device has the same capabilities as a keyboard which is both good and bad. If a keyboard cannot do something, then the USBRubberDucky cannnot do it either. It does allow for the key typing process to be automated making it faster and more accurate than someone typing. The downside is that it is automated so it cannot react like a human could if something went wrong or something unexpected occurred. A point the highlight is that by acting as a keyboard, the computer trusts the USBUniversal Serial Bus device once it is connected, allowing it to bypass virus scanners. This can enable you to type out an executable and then run it.
Goodfet / Facedancer