The following presentation explores the ability to attack the USB vector using USB toolkits and HID devices. The presentation also looks at what is necessary to defend against these attacks

1. Attacking the USB Vector
Brandon Greene

2. Quick Scope
● Information given with an emphasis on Windows 7
● Presentation will focus on USB attacks and
countermeasures
● Presentation will cover countermeasures tailored to USB
defense, rather than all potential defenses

3. Basic USB Process
● Device connected
● Address designation
● Descriptors read
● Configurations established
● Device is ready for use

4. USB Attacks
● USB Toolkit
● HID USB Devices

5. USB Toolkits (USB Attacks)
● Easy To Use
● Modular
● Versatile
● Not Always Easily Detectable

6. USB Toolkits (USB Attacks cont.)
● Hacksaw
– Easy to set up
– Modular
– Most successful versions rely on U3 technology
● Katana
– Offers bootable OS

7. HID Devices (USB Attacks)
● Abuse the trust relationship between human and
machine
● Devices that rely on input device emulation
● Allows keyboard input at faster rates than humans
● Attacks generally work on anything with a USB port that
takes in input

8. HID Devices (USB Attacks)
● USB Rubber Ducky
– Open Source
– Configurable
– Offers opportunity to alter firmware to modify device
functionality
– Anything that can be done from a keyboard, can be
emulated by this device

9. Attack Device Demo

10. Notable USB Malware
● Stuxnet
– Propagates mainly via USB
– Avoids network traffic
– Updates and acts via C&C
– Infects intelligently
– Made to infect SCADA and Windows systems using
zero day exploits (at least 4)
– Modified behavior based on AV vendors

11. Countermeasures
● Security Policy
● Personnel
● Physical
● Firmware
● Software
● System Policy
● Host/Network Specific

12. Security Policy (Countermeasure)
● Who is allowed where
● Where USB devices are allowed/disallowed
● Specifications on what USB devices may be used
● Company provided USB drives

13. Personnel (Countermeasure)
● EDUCATION!!!
– Don't use dropped USB drives. TURN THEM IN!
– Don't use admin account when unnecessary
– If you're not using your computer, lock it!
– Use a password
– Educate why ALL of these things are important!

14. Physical (Countermeasure)
● Critical machines should
be in a locked and
monitored environment
● Personnel to ensure
device tampering doesn't
happen
● USB Port Locks
● Chassis Lock

15. Firmware (Countermeasure)
● Password Firmware
Access
● Lower USB on the Boot
Order

16. Firmware (Countermeasure)
● Disable USB If It Is Not
Needed

17. Firmware (Countermeasure)
● Chassis Intrusion
Detection

18. Software (Countermeasure)
● AV
– Password the AV where possible
● USB port scan software

19. Policy (Countermeasure)
● Disable Autorun for all
● Enforce UAC
● Whitelisting/Blacklisting
● Autorun.inf parsing

20. Host/Network Specific
(Countermeasures)
● Network AV
● Firewalls
● HIDS/HIPS

21. Ecology based Countermeasures
● Military and Government Computers
● Enterprise Based Computers
● Public Computers
● Personal Computers

22. After Thoughts
● Security of Whitelisting: how secure is it?
● AV vs. Custom Malware
● Countermeasure effectiveness vs. convenience
● USB Banning vs. restricting
● How to spread this knowledge to those who don't know it
is needed?
● Is it possible to stop an attack, even with these
countermeasures in an espionage-prone environment?

23. Why Should You Care?