BadUSB
"It's the struggle between simplicity and security. The power of USB is that you plug it in and it just works. This simplicity is exactly what's enabling these attacks."
-Karsten Nohl,2014[1]
BadUSBis acomputer securityattack usingUSBdevices that are programmed with malicious software.[2]For example,USB flash drivescan contain a programmableIntel 8051microcontroller, which can be reprogrammed, turning a USB flash drive into a malicious device.[3]This attack works by programming the fake USB flash drive to emulate a keyboard. Once it is plugged into a computer, it is automatically recognized and allowed to interact with the computer. It can than then initiate a series of keystrokes which open a command window and issue commands to download malware.
The BadUSB attack was first revealed during aBlack Hattalk in 2014 byKarsten Nohl,Sascha Krißler and Jakob Lell. Two months after the talk, other researchers published code that can be used to exploit the vulnerability.[4]In 2017, version 1.0 of the USG dongle, which acts like a hardware firewall, was released, which is designed to prevent BadUSB style attacks.[5]
Criminal usage
[edit]In March 2020, theFBIissued a warning that members of theFIN7cybercrime group had been targeting companies in the retail, restaurant, and hotel industries with BadUSB attacks designed to deliverREvilor BlackMatterransomware.[6]Packages have been sent to employees inIT,executive management,andhuman resourcesdepartments.[6]One intended target was sent a package in the mail which contained a fakegift cardfromBest Buyas well as a USB flash drive with a letter stating that the recipient should plug the drive into their computer to access a list of items that could be purchased with the gift card.[6][7]When tested, the USB drive emulated a keyboard, and then initiated a series of keystrokes which opened aPowerShellwindow and issued commands to download malware to the test computer, and then contacted servers inRussia.[6][7]
In January 2022, the FBI issued another warning that members of FIN7 were targeting transportation and insurance companies (since August 2021), and defense companies (since November 2021), with BadUSB attacks designed to deliver REvil or BlackMatter ransomware.[8][9]These targets were sent USB drives in packages claiming to be fromAmazonor theUnited States Department of Health and Human Services,with letters talking about free gift cards or COVID-19 protocols that were purportedly further explained by information on the USB drive.[8][9]As above, when plugged in, the USB drives emulate a keyboard, and then initiate a series of keystrokes which open a PowerShell window and issue commands to download malware.[8][9]
See also
[edit]Further reading
[edit]- Lu, Hongyi; Wu, Yechang; Li, Shuqing; Lin, You; Zhang, Chaozu; Zhang, Fengwei (May 2021)."BADUSB-C: Revisiting BadUSB with Type-C".2021 IEEE Security and Privacy Workshops (SPW).pp. 327–338.doi:10.1109/SPW53761.2021.00053.ISBN978-1-6654-3732-5.
References
[edit]- ^Goodin, Dan (July 31, 2014)."This thumbdrive hacks computers. 'BadUSB' exploit makes devices turn 'evil'".Ars Technica.Archivedfrom the original on 2017-09-09.Retrieved2021-09-07.
- ^Greenberg, Andy (July 31, 2014)."Why the Security of USB Is Fundamentally Broken".Wired.ISSN1059-1028.Retrieved2021-09-07.
- ^Nohl, Karsten;Krißler, Sascha; Lell, Jakob."BadUSB - On accessories that turn evil"(PDF).Archived(PDF)from the original on 2016-10-19.
- ^Greenberg, Andy (October 2, 2014)."The Unpatchable Malware That Infects USBs Is Now on the Loose".Wired.ISSN1059-1028.Retrieved2021-09-07.
- ^Doctorow, Cory (March 2, 2017)."USG: an open source anti-BadUSB hardware firewall for your USB port".Boing Boing.Archivedfrom the original on 2017-03-03.Retrieved2021-09-07.
- ^abcdIlascu, Ionut (2020-03-27)."FBI: Hackers Sending Malicious USB Drives & Teddy Bears via USPS".Bleeping Computer.
This is not a one-off incident, though. The FBI warns that FIN7 has mailed these packages via USPS to numerous businesses (retail, restaurant, hotel industry) where they target employees in human resources, IT, or executive management departments. These packages sometimes include "gifts" like teddy bears or gift cards. These USB drives are configured to emulate keystrokes that launch a PowerShell command to retrieve malware from server controlled by the attacker. Then, the USB device contacts domains or IP addresses in Russia.
- ^abCimpanu, Catalin (March 26, 2020)."Rare BadUSB attack detected in the wild against US hospitality provider".ZDNet.Archivedfrom the original on 2020-03-26.Retrieved2021-09-07.
- ^abcGatlan, Sergiu (2022-01-07)."FBI: Hackers use BadUSB to target defense firms with ransomware".Bleeping Computer.
FIN7 operators impersonated Amazon and the US Department of Health & Human Services (HHS) to trick the targets into opening the packages and connecting the USB drives to their systems. Since August, reports received by the FBI say that these malicious packages also contain letters about COVID-19 guidelines or counterfeit gift cards and forged thank you notes, depending on the impersonated entity.
- ^abcTung, Liam (2022-01-10)."Ransomware warning: Cyber criminals are mailing out USB drives that install malware".ZDNET.
Further reading
[edit]- "Can BadUSB be avoided by looking at the shapes and the controller model inside it?".Information Security Stack Exchange.Retrieved2023-01-31.