USB Technology Has a Fundamental Security Vulnerability

The Citizen's Guide to the Future
July 31 2014 4:07 PM

USB Technology Has a Fundamental Security Vulnerability

usb
Wipe the flash memory all you want, it won't help with the real problem.

Image from Shutterstock/Ensuper.

Flash drives and USB peripherals—that is, basically every gadget—could be carrying malware without any evidence in their flash memory. According to new research that will be presented next week at the Black Hat security conference, it is possible to hide malware deep within USB technology at the firmware level. Oh, great.

Wired, which first reported on the findings, says that researchers Karsten Nohl and Jakob Lell from the security firm SR Labs can take over and control a PC with the BadUSB malware they developed to lurk in the base-level software that mediates between hardware and higher-level software like an operating system. They’re white hat hackers, trying to find and exploit security flaws as a proof of concept and a way of motivating the tech community to develop fixes.

Advertisement

Wiping a flash drive or scanning it with anti-virus software won’t detect the malware. Only reverse-engineering the firmware the way Nohl and Lell did can expose the foreign code lurking in it, and few consumers have the know-how to do that. Plus, even if you could do that, it might be hard to identify the malware code as malicious, because USB firmware varies and there isn’t a single standard to compare to.

So with BadUSB, or something like it, safely in place, the malware can do pretty much anything, like controlling a keyboard to type commands, leaving backdoors in software, or surveiling Internet use on a device. University of Pennsylvania computer science professor Matt Blaze also told Wired that he suspects the NSA has already developed attacks like this. “I wouldn’t be surprised if some of the things [Nohl and Lell] discovered are what we heard about in the NSA catalogue,” he said referring to Cottonmouth, an NSA malware distribution program that uses USB drives.

There’s no patch for this problem, so the best way to defend yourself for now is to think about how you protect yourself from getting sick and apply the same approach to your computer. Don’t share your thumb drives, don’t plug them into a public or untrusted computer, and don’t plug a USB peripheral or thumb drive that isn’t yours into your computer. It’s difficult to do, because we all use USB technology for easy sharing, but hopefully it’ll just be a stopgap measure while researchers work on long-term fixes. For example, USB firmware could have a signature that indicates if the original code has been tampered with or changed. And companies working on anti-virus for peripherals—like Red Balloon Security, which Slate reported on earlier this year—should be able to detect the changes.

Or what about USB condoms?! For now, you’ll have to practice safe sharing.

Future Tense is a partnership of SlateNew America, and Arizona State University.

Lily Hay Newman is lead blogger for Future Tense.

TODAY IN SLATE

Doublex

Crying Rape

False rape accusations exist, and they are a serious problem.

Scotland Is Just the Beginning. Expect More Political Earthquakes in Europe.

I Bought the Huge iPhone. I’m Already Thinking of Returning It.

The Music Industry Is Ignoring Some of the Best Black Women Singing R&B

How Will You Carry Around Your Huge New iPhone? Apple Pants!

Medical Examiner

The Most Terrifying Thing About Ebola 

The disease threatens humanity by preying on humanity.

Television

The Other Huxtable Effect

Thirty years ago, The Cosby Show gave us one of TV’s great feminists.

Lifetime Didn’t Find the Steubenville Rape Case Dramatic Enough. So They Added a Little Self-Immolation.

No, New York Times, Shonda Rhimes Is Not an “Angry Black Woman” 

Brow Beat
Sept. 19 2014 1:39 PM Shonda Rhimes Is Not an “Angry Black Woman,” New York Times. Neither Are Her Characters.
Behold
Sept. 19 2014 1:11 PM An Up-Close Look at the U.S.–Mexico Border
  News & Politics
Weigel
Sept. 19 2014 9:15 PM Chris Christie, Better Than Ever
  Business
Moneybox
Sept. 19 2014 6:35 PM Pabst Blue Ribbon is Being Sold to the Russians, Was So Over Anyway
  Life
Inside Higher Ed
Sept. 19 2014 1:34 PM Empty Seats, Fewer Donors? College football isn’t attracting the audience it used to.
  Double X
The XX Factor
Sept. 19 2014 4:58 PM Steubenville Gets the Lifetime Treatment (And a Cheerleader Erupts Into Flames)
  Slate Plus
Slate Picks
Sept. 19 2014 12:00 PM What Happened at Slate This Week? The Slatest editor tells us to read well-informed skepticism, media criticism, and more.
  Arts
Brow Beat
Sept. 19 2014 4:48 PM You Should Be Listening to Sbtrkt
  Technology
Future Tense
Sept. 19 2014 6:31 PM The One Big Problem With the Enormous New iPhone
  Health & Science
Medical Examiner
Sept. 19 2014 5:09 PM Did America Get Fat by Drinking Diet Soda?   A high-profile study points the finger at artificial sweeteners.
  Sports
Sports Nut
Sept. 18 2014 11:42 AM Grandmaster Clash One of the most amazing feats in chess history just happened, and no one noticed.