USB Technology Has a Fundamental Security Vulnerability

The Citizen's Guide to the Future
July 31 2014 4:07 PM

USB Technology Has a Fundamental Security Vulnerability

usb
Wipe the flash memory all you want, it won't help with the real problem.

Image from Shutterstock/Ensuper.

Flash drives and USB peripherals—that is, basically every gadget—could be carrying malware without any evidence in their flash memory. According to new research that will be presented next week at the Black Hat security conference, it is possible to hide malware deep within USB technology at the firmware level. Oh, great.

Wired, which first reported on the findings, says that researchers Karsten Nohl and Jakob Lell from the security firm SR Labs can take over and control a PC with the BadUSB malware they developed to lurk in the base-level software that mediates between hardware and higher-level software like an operating system. They’re white hat hackers, trying to find and exploit security flaws as a proof of concept and a way of motivating the tech community to develop fixes.

Advertisement

Wiping a flash drive or scanning it with anti-virus software won’t detect the malware. Only reverse-engineering the firmware the way Nohl and Lell did can expose the foreign code lurking in it, and few consumers have the know-how to do that. Plus, even if you could do that, it might be hard to identify the malware code as malicious, because USB firmware varies and there isn’t a single standard to compare to.

So with BadUSB, or something like it, safely in place, the malware can do pretty much anything, like controlling a keyboard to type commands, leaving backdoors in software, or surveiling Internet use on a device. University of Pennsylvania computer science professor Matt Blaze also told Wired that he suspects the NSA has already developed attacks like this. “I wouldn’t be surprised if some of the things [Nohl and Lell] discovered are what we heard about in the NSA catalogue,” he said referring to Cottonmouth, an NSA malware distribution program that uses USB drives.

There’s no patch for this problem, so the best way to defend yourself for now is to think about how you protect yourself from getting sick and apply the same approach to your computer. Don’t share your thumb drives, don’t plug them into a public or untrusted computer, and don’t plug a USB peripheral or thumb drive that isn’t yours into your computer. It’s difficult to do, because we all use USB technology for easy sharing, but hopefully it’ll just be a stopgap measure while researchers work on long-term fixes. For example, USB firmware could have a signature that indicates if the original code has been tampered with or changed. And companies working on anti-virus for peripherals—like Red Balloon Security, which Slate reported on earlier this year—should be able to detect the changes.

Or what about USB condoms?! For now, you’ll have to practice safe sharing.

Future Tense is a partnership of SlateNew America, and Arizona State University.

Lily Hay Newman is lead blogger for Future Tense.

TODAY IN SLATE

Politics

Don’t Worry, Obama Isn’t Sending U.S. Troops to Fight ISIS

But the next president might. 

IOS 8 Comes Out Today. Do Not Put It on Your iPhone 4S.

Why Greenland’s “Dark Snow” Should Worry You

How Much Should You Loathe NFL Commissioner Roger Goodell?

Here are the facts.

Amazon Is Launching a Serious Run at Apple and Samsung

Television

Slim Pickings at the Network TV Bazaar

Three talented actresses in three terrible shows.

Foreigners

More Than Scottish Pride

Scotland’s referendum isn’t about nationalism. It’s about a system that failed, and a new generation looking to take a chance on itself. 

The Ungodly Horror of Having a Bug Crawl Into Your Ear and Scratch Away at Your Eardrum

We Could Fix Climate Change for Free. Now There’s Just One Thing Holding Us Back.

  News & Politics
Weigel
Sept. 17 2014 7:03 PM Once Again, a Climate Policy Hearing Descends Into Absurdity
  Business
Business Insider
Sept. 17 2014 1:36 PM Nate Silver Versus Princeton Professor: Who Has the Right Models?
  Life
Outward
Sept. 17 2014 6:53 PM LGBTQ Luminaries Honored With MacArthur “Genius” Fellowships
  Double X
The XX Factor
Sept. 17 2014 6:14 PM Today in Gender Gaps: Biking
  Slate Plus
Slate Fare
Sept. 17 2014 9:37 AM Is Slate Too Liberal?  A members-only open thread.
  Arts
Brow Beat
Sept. 17 2014 8:25 PM A New Song and Music Video From Angel Olsen, Indie’s Next Big Thing
  Technology
Future Tense
Sept. 17 2014 9:00 PM Amazon Is Now a Gadget Company
  Health & Science
Jurisprudence
Sept. 17 2014 4:49 PM Schooling the Supreme Court on Rap Music Is it art or a true threat of violence?
  Sports
Sports Nut
Sept. 17 2014 3:51 PM NFL Jerk Watch: Roger Goodell How much should you loathe the pro football commissioner?