We reported in August that security researcher KarstenNohl of SR Labs revealed a flaw in USB firmware that cripples the technology beyond repair. At the Black Hat security conference, it was revealed that USB devices of all kinds can be targeted by hidden malware. Nohl refused to release the code used in the research, concerned that it would fall into the wrong hands. Unfortunately it has been made public anyway, putting all USB users at risk.
Adam Caudill and Brandon Wilson, hackers at the Derbycon conference, have found their own way to exploit the USB firmware. They have reverse-engineered the firmware used by Nohl, and posted the code publicly on Github. Why would they do this? The answer is simple: It’s a challenge; an ultimatum to USB manufacturers. Either the makers of USB technology must resolve the issue, or let every single user of USB devices remain vulnerable to the threat.
It’s a bold attempt at opening the eyes of the leaders in the technology industry. Nohl, who previously discovered the USB vulnerabilities, refrained from posting how to exploit the devices because he thought the vulnerability was unpatchable. By posting the code where hackers can get to it, Caudill and Wilson are hoping that the code can be studied and protection against it can be found. In an interview with WIRED magazine, Caudill states:
If the only people who can do this are those with significant budgets, the manufacturers will never do anything about it. You have to prove to the world that it’s practical, that anyone can do it…That puts pressure on the manufactures to fix the real issue.
USB firmware can be reprogrammed and used to perform illegal activities. For example, the security professionals were able to make the infected USB device appear as a keyboard, and then use it to type keystrokes on another machine. Because it’s the firmware inside the USB device that’s altered, it’s difficult to fix.
A patch doesn’t work because the problem isn’t in the device’s software, and files that hold malicious activity within the firmware can easily be deleted, hidden, or possibly even disable the USB’s security functions. Caudill describes USBs as more than storage devices; in fact, he says, “[People] don’t realize there’s a reprogrammable computer in their hands.”
In order to fix this vulnerability, manufacturers have to completely change the design of the USB device to make accessing the code inside the device impossible. According to Nohl, assuming that the problem is resolved, it would take up to 10 years for problems concerning the current USB standard to disappear. In the meantime, here are a few tips to help keep yourself safe from the USB-transmitted disease:
Do you think that Caudill and Wilson did the right thing by releasing the code for BadUSB, or do you think they’ve unleashed a monster upon the world? Let us know in the comments.