USB Has a Huge Security Problem that Could Take Years to Fix

In July, Researchers, Karsten Nohl and Jakob Lell, Announced that, they'd Found a Critical Security Flaw they Called, "BadUSB", Allowing Attackers to Smuggle Malware on the Devices Effectively Undetected. Even Worse, there Didn't Seem to be a Clear Fix for the Attack. Anyone Who Plugged in a USB Stick was Opening Themselves Up to the Attack and because the Bad Code was Residing in USB Firmware, it was Hard to Protect Against it without Completely Redesigning the System. The Only Good News was that, Nohl and Lell, Didn't Publish the Code so, the Industry had Some Time to Prepare for a World without USB. As of this Week, that's No Longer True. In a Joint Talk at DerbyCon, Adam Caudill and Brandon Wilson Announced they Had Successfully Reverse-Engineered "BadUSB" and they Didn't Share Nohl and Lell's Concerns about Publishing the Code. The Pair has Published the Code on GitHub and Demonstrated Various Uses for it, including an Attack that Takes Over a User's Keyboard Input and Turns Control Over to the Attacker. According to Caudill, the Motive for the Release was to Put Pressure on Manufacturers. "If the only people who can do this are those with significant budgets, the manufacturers will never do anything about it", he Told Wired's, Andy Greenberg. "You have to prove to the world that it’s practical, that anyone can do it."


Still, the Net Effect is Unlikely to be a Push for USB Security. As Long as Attackers Can Reprogram USB Firmware, Attacks like this will be a Serious Threat. The Only Way to Fix the Vulnerability is a New Layer of Security Around Firmware but, that Would Mean a Full Update to the USB Standard itself, which Mean Years of Insecurity. However the Industry Responds, we're Likely to be Living with it for a Long, Long Time. In the Meantime, Anytime you Plug a USB Drive into your Computer, you'll be Opening Up a Huge Vector of Attack. It's Easy to Imagine a Pile of Dirty USBs being Dumped onto a Table at CES or Desk at your Local Kinko's. Unless you Can Track a Device's Provenance from the Factory to your Computer, the Only Real Protection Avoiding USB Drives and Devices at Every Turn — Covering over your USB Ports the Same Way you Might Cover your Laptop Camera. It's an Extreme Response but, Not an Unreasonable One. And for Large Portions of the Peripheral Hardware Industry, it Could be a Very Scary Thought.




Info Source:

http://www.wired.com/2014/10/code-published-for-unfixable-usb-attack