USB coffee-cup warmer could be stealing your data

ARE you sure that the keyboard or mouse you are using today is the one that was attached to your computer yesterday? It might have been swapped for a compromised device that could transmit data to a snooper.

The problem stems from a shortcoming in the way the Universal Serial Bus (USB) works. This allows almost all USB-connected devices, such as mice and printers, to be turned into tools for data theft, says a team that has exploited the flaw.
Welcome to the murky world of the "hardware trojan". Until now, hardware trojans were considered to be modified circuits. For example, if hackers manage to get hold of a microchip when it is still in the factory, they could introduce subtle changes allowing them to crash the device that the chip gets built into (New Scientist, 1 July 2009, p 18).

Computer engineers John Clark, Sylvain Leblanc and Scott Knight at the Royal Military College of Canada in Kingston, Ontario, wondered if a hardware trojan attack could be carried out by other means. They calculated that the easiest way to introduce a hardware trojan might be via a computer's USB ports.

The trio found they could exploit a weakness in USB's plug-and-play functionality. The USB protocol trusts any device being plugged in to report its identity correctly. But find out the make and model of a target user's keyboard, say, swap it with a compromised device that reports the same information - and that doesn't even have to be a keyboard - and the computer won't realise.

Quote:

---

Swap a USB keyboard for a device that reports the same model number, and the computer won't know

---

The team designed a USB keyboard containing a circuit that successfully stole data from the hard drive and transmitted it in two ways: by flashing an LED, Morse-code style, and by encoding data as a subtle warbling output from the sound card (Future Generation Computer Systems, DOI: 10.1016/j.future.2010.04.008). They could have chosen more efficient methods to transmit the data, such as email, but Leblanc says their main goal was to see if they could steal data without anyone noticing.

"We've shown any USB device could contain a hardware trojan," he says. Security software, if it checks USB devices at all, tends to look only for malware on USB memory sticks.

"This work opens many cans of worms," says Vasilios Katos, a computer scientist at the Democritus University of Thrace in Greece. "A USB device cannot now be trusted - it may have hidden processing capabilities." He's right, says Leblanc. "You could mount a hardware trojan attack with a USB coffee-cup warmer."

Woops, forgot to include the Source. :)

Code:

---

http://www.newscientist.com/article/mg20727676.300-usb-coffeecup-warmer-could-be-stealing-your-data

---

also be careful where you stick your USB!
http://risky.biz/big-wirus

PNP have given us a plethora of hilarious exploits. One of my favorites is a bank VP receiving a free palm pilot randomly and then plugging it into his computer, which then became infected all of a sudden >.< Sigh, most people will say 'if I see a USB stick on the ground I will take it home and plug it in.' Making road apples a very efficient way to grab a random box >.<

It looks as if the mitigating factor is the need for physical access as well as the right skills and equipment.

I haven't read anything about it recently, but there have been several articles on the potential for firmware trojans (CD/DVD/HDD/Videocard). I believe that this could be done remotely?

Quote:

---

Originally Posted by SnugglesTheBear

also be careful where you stick your USB!

---

Your post wasn't EXACTLY what I thought first when I read that statement, but I think the end result is more or less the same. Brings a new thought to Butt Plugs though doesn't it?

Hello everyone :)

Very interesting indeed. Now i have a nooby question regarding this. Would this threat affect 'any' OS by default? Or would it be like viruses, that have to be individually created for a specific OS? This also might be affected by what kind of data is to be collected (hence a NIC might be different from a keyboard) etc....

Bottom line (to be a bit selfish here), would a slackware system be affected by the contents of this article, or would it have to be a very custom hardware device specifically 'for' slackware?

In addition... what do you folks recomend as a countermeasure?

Cheers.

Plug n Play is the main culprit. As long as you are not running that, you should be okay. Slackware by default does not have PnP running I do believe.

Hmmmmm,

Most of the answer is physical security and vigilance. For a human interface device you should notice that it has been substituted by a new one? and it would be nearly impossible to exactly match the individual characteristics that they soon pick up. Also a lot of my stuff would be hard for an attacker to find, either because of its age or obscure manufacturer.:D

As we are talking about hardware and firmware; then anything that will run on your system or in your environment will also run the malware as soon as it gets recognised by the BIOS. The mitigation here would be that as you are not running FAT* or NTFS, it probably wouldn't be able to do much, unless it can phone home or you have poor physical security that lets people at your systems unattended and with the ability to launch bootable media.

My basic point is that we are talking about the hardware level interface here, not the OS/application (user) level one, so Slackware won't protect you, even by obscurity.

A great mitigation is the fact that malware authors are percentage players and always go for the low hanging fruit. Most of the attacks we are discussing (apart from PnP) are just too much effort for them IMO.

Mostly I guess that this sort of stuff belongs in the realms of theoretical research, rather than real life, but I would be slightly more wary of publicly accessible systems nowadays?

Just my £0.01 :)

Every country pays off some gook to sabotage parts. They do everything from adding extra undocumented opcodes to processors to adding lead based paints to foods. Anyone who uses these parts to create some "super-dooper secret usb spy device" would be an idiot.

When you see a James Bond movie... don't you ever find it funny how he carrys a swiss watch with lasers pointed at his wrists? Or drives these American/german sports cars that mysteriously explode on impact?

Quote:

---

Originally Posted by The-Spec

When you see a James Bond movie... don't you ever find it funny how he carrys a swiss watch with lasers pointed at his wrists? Or drives these American/german sports cars that mysteriously explode on impact?

---

Your like me, i like to point out those sorts of things while watching T.V, the GF absolutely hates it.. :D

Watch Jurassic Park... A T-Rex all of a sudden knocks a Jeep over a cliff where it was JUST standing 5 seconds ago? ....

Before that, the Scientist guy opens the door, yet when the camera show from the inside of that Trailer, he's puling from the WRONG side of the door... And when Mr "I'm rich" is cleaning that glass, the color of the rag changes about 3 times.

When that Dinosaur hops on the desk with the SGI machine, I screamed at the TV... It's funny that with all the mistakes in that movie, people said "OMG that's so not a Unix system!" when the girl says it lol. That made me laugh. It IS a Unix system, and it's SGI!

That file viewer comes straight from SGI. It IS however nice to know there is a company so good that even seasoned Unix people couldn't Believe that what they were seeing was real lol.

And if you're wondering what I screamed at the TV, it was mostly "Get off the SGI you ****ing lizard!".

Point being that even James Bond uses imported (sabotaged) spy gadgets. The parts used to make them are sabotaged themselves. And the machines used to build these parts are arranged to kill factory workers. And so on and so forth...

Its such a covert thing that apparently even the writers fail to see it as nothing more than a plot clich&#233;.

But in real life I guarantee this happends. Infact, I can prove it... open any electronic object and you'll either find a poison of some sort, parts that aren't needed for a device's normal purpose, and weakened metals and plastics that double as poisons or explosives.

Your computers are already backdoored before these USB devices even reach anyone's hands.

Why does Nihil keep scaring me :D Probably cause i hate the truth in this issue. Although i am not scared that much of having someone come into my house and start swapping stuff. I was actually refering a bit more to what The-Spec has said:

Quote:

---

Your computers are already backdoored before these USB devices even reach anyone's hands.

---

I can really easily imagine a few companies having deals with the GOV or other parties of privacy invasion interests, to actually manufacture backdoored hardware (tons of those no name keyboards you can buy at any supermarket for 3 euros). And let us not forget that some 'institutes' are technologically 10 years ahead of the private sector, making it very easy to spread 'infected' (my choice of words here" hardware to the mass. Wasnt there a story about an old P2 (or was it P3) chip that had a backdoor? The one where the CPU stuck to a card, that was inserted into a SLOT on the MB? Damn its so long ago i dont remember the details, nor the source for this info. But i remember it was an issue back then.

And i think the-spec also mentioned something about Sony a while back. Looking at how the new PS is being monitored online... it all makes more sense.

Quote:

---

Originally Posted by The-Spec

Your computers are already backdoored before these USB devices even reach anyone's hands.

---

That is some 0day! ;p meh, the joke sounded better going through my head >.< Any who, I do know that some vendors, both software and hardware, put backdoors in their products, but honestly they are usually found out very quickly and it is just really bad publicity from then on out for the company. That is why I feel that many of the prominent hardware manufacturers aren't really producing backdoors in their products. Shoot, there was a big ordeal over cisqo having a secret admin account/password which is more of a semi-backdoor since they used that account mostly for remote maintenance or whatever. Software is the same, a couple years ago there was a backdoor in openBSD. The openBSD community was ridiculed by their peers in the security world and then the backdoor was removed. All I can figure happening is that if a company does produce a backdoor, it is short lived and usually removed very hastily.

Quote:

---

Originally Posted by instronics

I can really easily imagine a few companies having deals with the GOV or other parties of privacy invasion interests

---

Yeah, they are ISPs ;)

Actually I find that everytime Kaspersky, for example, sends documents to their servers whether you want to submit them to be "evaluated" or not... its talked about but people either forget or keep using the crap.

Well AV software is a whole other realm >.< They have a "legitimate" excuse for stealing your data >.<

Hi, instronics.

Quote:

---

Why does Nihil keep scaring me :D Probably cause i hate the truth in this issue.

---

Hey, it was never my intention to scare you..............on the contrary, I wanted to reassure you whilst maintaining the quality of the discussion and examining some of the angles.

The-Spec does make some interesting comments, but I think that they are "tongue in cheek", which is a Brit expression for taking the p1ss :D He really has missed his vocation............he should be writing scripts for Hollywood.

1. If a distributor is up to this: it is commercial suicide.
2. If a government is up to this it is political suicide.
3. If a Vendor is up to this it is commercial suicide
4. Any private organisation involved has committed serious crimes
5. And China make everything...................but want to continue to do so?

When a census reports a statistic on accidental deaths the number crunchers in Washington look for ways to both replicate them and to bring the numbers up in other countrys. When is the last time you've seen one single company burn piles upon piles of recalled products? They don't. And everytime a country like Iran starts building weapons we WEAKEN trade embargoes by coincidence? No. We're looking to give them backdoored and dangerous products.

All that mercury and lead in your box of fruity-poop-loops cereal is simply an accident. And those additions to your computer are "features". Get it? And if all else fails people have no attention span at all.

Hell, most people wouldn't care about these USB devices as long as they get their poisoned, if not, mind-altering brew of coffee.

It happends and it happends with damn near impunity.

@ The-Spec

Quote:

---

When a census reports a statistic on accidental deaths the number crunchers in Washington look for ways to both replicate them and to bring the numbers up in other countries.

---

That is called "Lies, damned lies, and statistics".............which also happens to be the title of a very interesting little book about how to fiddle numerical presentations to suit your case ;)

Quote:

---

When is the last time you've seen one single company burn piles upon piles of recalled products? They don't.

---

Over here that would be a criminal offense (felony)............. they have to recycle them. They are not allowed to resell them as new either. In the US, I believe that you have to state the percentage of recycled parts there are in your products?..............anyone remember Packard Bell??????????? :chuck:

Quote:

---

All that mercury and lead in your box of fruity-poop-loops cereal is simply an accident.

---

Human ignorance!

Organo-phosphorus insecticides, DDT, Tricoethelene, Benzine, lead, mercury, antimony, arsenic, paraquat, carbon tetrachloride, to name but a few.

We are our own worst enemies because we sh1t in our own nests, and that passes up the food chain.

There are three things that drive homo sapiens:

1. Self-preservation.
2. Sex
3. Greed

Corporate greed seems more acceptable because it is collective, so no individual feels guilty?

All you are doing is pointing out some of the failings in the human race and in the laissez faire capitalist political model.

I have a couple of Linux distros you would like:

1. Nova Linux (Gentoo) from Cuba
2. Red Star Linux (Debian 5) from Argentina

You may not like the Linux, but you sound as if you would love the politics :D

BACK TO TOPIC:

I do not subscribe to these global conspiracy theories because:

1. They would be too easily detected by members of the electorate.
2. You could not keep the plot secret as someone would blow the whistle.
3. How the hell could you handle the volume of data generated?
4. Random is useless, because by very definition, it has no pattern, and surveillance relies on patterns.

Anyone remember "Predator"? ;)