Last 3 months I read an article about how USB drives have a flaw that can’t be detected, which means the USB drives can be used to exploit some heavy hacking into other people computer automatically with commands. The exploit was created by SR Labs researcher Karsten Nohl and Brandon Wilson, who wanted to demonstrate the exploited and to prove to manufactures that there isn’t much anything they can do to protect the users from it.
Today there is a user by the name is Samy Kamkar who created the code name “USBdriveby” which basically just pwns the living shit out of any OS X machines it gets plugged into so long as they are unlocked. The concept is pretty hilariously and terrifyingly simple; when the a USBdriveby device—a roughly thumb drive-sized microcontroller attached to a USB port—gets plugged into an open port on a Mac, it immediately identifies itself as a mouse and keyboard and starts going to town. It opens the terminal, messes with network settings, installs a backdoor, and then tidies up after itself in about a minute. And while its at work, the screen looks possessed, like something out of a hacker movie.
OS X isn’t completely vulnerable to attacks like this—some of the more important settings refuse to be changed with just a keyboard. But Kamkar found ways around this with clumsy but effective blind mouse movements. At least if the computer is locked, you’re still safe. The example here is based on OS X, but Kamkar says it’d be easily portable to Windows or Linux. Only time will tell, but if a system’s security can reliably be torn down with blind keyboard and mouse movements, it’s seems pretty likely.
Its crazy how the usb has the capability to emulate the mouse and keyboard and do this deploy so fast, watching the thing infront of my face makes me want to scream with terror.
You can protect yourself with just locking your computer before you leave and hope that these hackers don’t figure out how to use the exploid outside of the usb and into a simple Email. Hacks designed by thieves and cybercriminals that don’t share their plans in YouTube or wear microcontrollers around their necks (cool hack but that’s nerdy as shit, bro). It’s a scary world out there, so just be careful where you leave that laptop and what you plug into it.
USB condoms anyone?
