BadUSB: Theoretical Malware Turned Reality

We reported in August that security researcher Karsten Nohl of SR Labs revealed a flaw in USB firmware that cripples the technology beyond repair. At the Black Hat security conference, it was revealed that USB devices of all kinds can be targeted by hidden malware. Nohl refused to release the code used in the research, due to being concerned that it would be used by the wrong hands, but it has been made public anyway, putting the masses at risk.

Adam Caudill and Brandon Wilson, hackers at the Derbycon conference, have found their own way to take advantage of the USB firmware. They have reverse-engineered the firmware used by Nohl, and posted the code publicly on Github. Why would they do this? The answer is simple: It's a challenge; an ultimatum to USB manufacturers. Either the makers of USB technology must resolve the issue, or let every single user of USB devices stay vulnerable to the threat.

It's a bold attempt at opening the eyes of the bigwigs in the technology industry. Nohl, who previously discovered the USB vulnerabilities, refrained from posting how to exploit the devices because he thought the vulnerability was unpatchable. By posting the code where hackers can get to it, Caudill and Wilson are hoping that the code can be studied and protected against. In an interview with WIRED magazine, Caudill states:

If the only people who can do this are those with significant budgets, the manufacturers will never do anything about it. You have to prove to the world that it's practical, that anyone can do it...That puts pressure on the manufactures to fix the real issue.

USB firmware can be reprogrammed and used to perform illicit activities. For example, the security professionals were able to make the infected USB device appear as a keyboard, and then use it to type keystrokes on another machine. Because it's the firmware inside the USB device that's altered, it's difficult to fix.

A patch won't work because the problem isn't in the device's software, and files that hold malicious activity within the firmware can easily be deleted, hidden, or possibly even disable the USB's security functions. Caudill describes USBs as more than storage devices; in fact, he says, "[People] don't realize there's a reprogrammable computer in their hands."

In order to fix this vulnerability, manufacturers have to completely change the architecture of the USB device to make accessing the code inside the device impossible. According to Nohl, assuming that the problem is resolved, it would take up to 10 years for problems concerning the current USB standard to dissolve. In the meantime, here are a few tips to help keep yourself safe from the USB-transmitted disease:

• Only allow trusted USB devices to connect to your PC. Don't let strangers charge their phones with your computer. Don't borrow someone else's USB device to move files from one PC to another. You're better off purchasing a new device and using it yourself.
• Keep your eyes on your PC, especially in public places. Obviously, you shouldn't leave your computer lying around in the open where anyone could walk up and plug in a USB drive containing the malware.
• Stay away from USB technology in general. This likely isn't an option, but it's the only way to truly keep yourself safe from the USB bug. Even devices like wireless mouses and keyboards can potentially hold the malware. Use wired mouses and keyboards, and transfer files using cloud services if you must.

Do you think that Caudill and Wilson did the right thing by releasing the code for BadUSB, or do you think they've unleashed a monster upon the world? Let us know in the comments.