Why the Security of USB Is Fundamentally Broken

[steve2470]

http://www.wired.com/2014/07/usb-security/


Computer users pass around USB sticks like silicon business cards. Although we know they often carry malware infections, we depend on antivirus scans and the occasional reformatting to keep our thumbdrives from becoming the carrier for the next digital epidemic. But the security problems with USB devices run deeper than you think: Their risk isn’t just in what they carry, it’s built into the core of how they work.

That’s the takeaway from findings security researchers Karsten Nohl and Jakob Lell plan to present next week, demonstrating a collection of proof-of-concept malicious software that highlights how the security of USB devices has long been fundamentally broken. The malware they created, called BadUSB, can be installed on a USB device to completely take over a PC, invisibly alter files installed from the memory stick, or even redirect the user’s internet traffic. Because BadUSB resides not in the flash memory storage of USB devices, but in the firmware that controls their basic functions, the attack code can remain hidden long after the contents of the device’s memory would appear to the average user to be deleted. And the two researchers say there’s no easy fix: The kind of compromise they’re demonstrating is nearly impossible to counter without banning the sharing of USB devices or filling your port with superglue.

“These problems can’t be patched,” says Nohl, who will join Lell in presenting the research at the Black Hat security conference in Las Vegas. “We’re exploiting the very way that USB is designed.”

‘In this new way of thinking, you have to consider a USB infected and throw it away as soon as it touches a non-trusted computer.’

more at link above

[Erich Bloodaxe BSN]

1. Greaat

If hackers start exploiting this, you won't ever be able to trust those open bins of usb sticks at computer stores. They'll insert malware-inserted sticks into the bins, and simply let unaware users buy them and use them.

You'll only ever be able to (somewhat) trust sticks that are in those hard-shell cases straight from the manufacturer.

[IDemo]

2. Answer - nonupgradable hardware

The current products very likely use something such as NOR flash memory which allows for erase and write operations to enable firmware upgrades. That, or a protected area of the NAND flash memory used to store user files. Using a separate write-once type of chip technology (programmable read-only memory) would prevent the device from being hacked by all but someone with the technical chops to replace the chip with a BGA rework station.

[TM99]

3. Sure, but then the price goes up.

USB has become the new floppy. Numerous viruses were transmitted by floppy long before CD's and USB became common. Nothing will ever be 100% secure. It is an ever moving target.

[IDemo]

4. Probably not by all that much if security is an issue

OTP's are a mature technology and aren't all that expensive. If having your firmware potentially exposed to malicious writes by parking it on NOR or NAND flash is the only alternative, I would think most would be willing to safeguard their private data. The only downside - no upgrades for your thumb drive's firmware, but when was the last time you did that?