[OPLIN 4cast] OPLIN 4cast #397: BadUSB

Wed Aug 6 10:30:13 EDT 2014

OPLIN 4Cast
Email not displaying correctly? View it in your browser. 
<http://www.oplin.org/4cast/>
OPLIN 4Cast

OPLIN 4cast #397: BadUSB
August 6th, 2014

USB driveAs if you needed something else to worry about, there seems to 
be a strong possibility that USB devices can be used in new and nasty 
ways to damage computers, such as the public computers in libraries. 
Security researchers Karsten Nohl and Jakob Lell are giving a briefing 
tomorrow about "BadUSB-on accessories that turn evil" at the Black Hat 
<https://www.blackhat.com/us-14/briefings.html> convention in Las Vegas. 
Their presentation has already received a lot of attention because they 
have found a way to reprogram the controller chip in a USB thumb drive 
so it acts like a different USB device, perhaps a keyboard or network 
card. And there doesn't seem to be any easy way (yet) to protect your 
computers.

  * Why the security of USB is fundamentally broken
    <http://www.wired.com/2014/07/usb-security/> (Wired | Andy
    Greenberg) "The malware they created, called BadUSB, can be
    installed on a USB device to completely take over a PC, invisibly
    alter files installed from the memory stick, or even redirect the
    user's internet traffic. Because BadUSB resides not in the flash
    memory storage of USB devices, but in the firmware that controls
    their basic functions, the attack code can remain hidden long after
    the contents of the device's memory would appear to the average user
    to be deleted."
  * Researchers warn about 'BadUSB' exploit
    <http://www.pcmag.com/article2/0,2817,2461717,00.asp> (PC Mag |
    David Murphy) "A device could, for example, emulate a USB-connected
    keyboard and automatically send over all sorts of keystrokes that,
    when combined, could lead to issues-installing malware, wiping key
    files off a drive, copying files over to the USB device, etc. And
    that's just the first example. SRLabs notes that a USB-connected
    device could also pretend that it's a network card and redirect the
    traffic to and from a system through a rogue DNS server. Or, better
    yet, it could infect that system with a boot-sector virus that could
    be a bit tougher to detect and remove than your average infection."
  * BadUSB: Big, bad USB security problems ahead
    <http://www.zdnet.com/badusb-big-bad-usb-security-problems-ahead-7000032211/>
    (ZDNet | Steven J. Vaughan-Nichols) "The hackers claim that 'Simply
    reinstalling the operating system - the standard response to
    otherwise ineradicable malware - does not address BadUSB infections
    at their root. The USB thumb drive, from which the operating system
    is reinstalled, may already be infected, as may the hardwired webcam
    or other USB components inside the computer. A BadUSB device may
    even have replaced the computer's BIOS - again by emulating a
    keyboard and unlocking a hidden file on the USB thumb drive.' In
    short, 'Once infected, computers and their USB peripherals can never
    be trusted again.'"
  * Don't panic over the latest USB flaw
    <http://www.tomsguide.com/us/badusb-dont-panic,news-19258.html>
    (Tom's Guide | Marshall Honorof) "BadUSB is a proof-of-concept
    attack, designed by security researchers. They're not going to
    release it into the wild[...] Furthermore, demonstrating something
    like BadUSB at a conference like Black Hat is basically an open
    invitation for the security community to fix this vulnerability
    before it becomes widespread."

*/Articles from Ohio Web Library <http://ohioweblibrary.org>:/*

  * Auto, smartphone, point-of-sale (POS) system and airport security
    hacks among first 100 talks chosen for Black Hat USA 2014
    <http://web.b.ebscohost.com.proxy.oplin.org/ehost/detail/detail?sid=74f41cbf-334b-4dbc-b939-c06e0948790d%40sessionmgr111&vid=0&hid=103&bdata=JnNpdGU9ZWhvc3QtbGl2ZQ%3d%3d#db=bwh&AN=201405291200PR.NEWS.USPR.SF37647>.
    (/PR Newswire US/, 05/29/2014)
  * Thieves used USB sticks to infect ATMs, withdraw large amounts of
    cash
    <http://www.fofweb.com.proxy.oplin.org/Science/LowerFrame.asp?SID=5&iPin=UPI-1-20131230-184339-bc-germany-atmhack&rID=1&InputText=usb>.
    (In /Science online/, United Press International, Dec. 30, 2013)
  * Embedded devices gird up against cyber threats
    <http://web.a.ebscohost.com.proxy.oplin.org/ehost/detail/detail?sid=f944dd9b-f1d5-4ad4-bfdc-167a0bb52947%40sessionmgr4003&vid=0&hid=4209&bdata=JnNpdGU9ZWhvc3QtbGl2ZQ%3d%3d#db=cph&AN=88934227>.
    (/Electronic Design/, 6/20/2013, p18-21 | Bill Wong)

------------------------------------------------------------------------
The */OPLIN 4cast/* is a weekly compilation of recent headlines, topics, 
and trends that could impact public libraries. You can subscribe to it 
in a variety of ways, such as:

  * *RSS feed.* You can receive the OPLIN 4cast via RSS feed by
    subscribing to the following URL:
    http://www.oplin.org/4cast/index.php/?feed=rss2.
  * *Live Bookmark.* If you're using the Firefox web browser, you can go
    to the 4cast website (http://www.oplin.org/4cast/) and click on the
    orange "radio wave" icon on the right side of the address bar. In
    Internet Explorer 7, click on the same icon to view or subscribe to
    the 4cast RSS feed.
  * *E-mail.* You can have the OPLIN 4cast delivered via e-mail (a'la
    OPLINlist and OPLINtech) by subscribing to the 4cast mailing list at
    http://mail.oplin.org/mailman/listinfo/OPLIN4cast.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.oplin.org/pipermail/oplin4cast/attachments/20140806/fa1fd43a/attachment-0003.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: kubrickheader.jpg
Type: image/jpeg
Size: 38379 bytes
Desc: not available
URL: <http://lists.oplin.org/pipermail/oplin4cast/attachments/20140806/fa1fd43a/attachment-0003.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: usb-drive.png
Type: image/png
Size: 14970 bytes
Desc: not available
URL: <http://lists.oplin.org/pipermail/oplin4cast/attachments/20140806/fa1fd43a/attachment-0003.png>