Introducing the USB Stick of Death
j00ru.vexillium.org
Introducing the USB Stick of Death
1–10 of 35 posts
Re: Introducing the USB Stick of Death
#2I've had an usb stick of death for years now. Any system you plug it in instantly freezes. No idea how I made it, but it was certainly not the goal! And whatever I do, I can't get it to overwrite whatever data is on there :P
Re: Introducing the USB Stick of Death
#3I've had an usb stick of death for years now. Any system you plug it in instantly freezes. No idea how I made it, but it was certainly not the goal! And whatever I do, I can't get it to overwrite whatever data is on there :P
Under Linux, if you get a stack trace they can fix this: they love fuzzing errors.
Re: Introducing the USB Stick of Death
#4As a security vulnerability, it's interesting but, as they stated, low-severity.
If you have physical access and a local user, it's much easier to use any Linux boot CD and one of the myriad "password recovery" systems.
I used Petter N Hagen's http://pogostick.net/~pnh/ntpasswd/
back in my tech support days (several years ago).
The current tech support guy swears by Hiren's BootCD
Re: Introducing the USB Stick of Death
#5As a security vulnerability, it's interesting but, as they stated, low-severity. If you have physical access and a local user, it's much easier to use any Linux boot CD and one of the myriad "password recovery" systems. I used Petter N Hagen's http://pogostick.net/~pnh/ntpasswd/ back in my tech support days (several years ago). The current tech support guy swears by Hiren's BootCD http://www.hiren.info/pages/bootcd
Severity isn't that low. If you hand out a USB stick to a friend and they run a .exe on it, you could surely trigger this exploit invisibly. It's probably not a broad vector attack, but surely would fit very well into a spearphishing scenario. Hand this to a less-than-savvy user and either auto-run via .inf (on older OSes) or dupe them into running some arbitrary binary to "unencrypt the volume" or something they wouldn't understand.
Many newer USB sticks even have preloaded binaries for the supporting software (SanDisk volume utilities come to mind) - this would be a perfectly innocuous location to load this sort of attack.
Re: Introducing the USB Stick of Death
#6I've had an usb stick of death for years now. Any system you plug it in instantly freezes. No idea how I made it, but it was certainly not the goal! And whatever I do, I can't get it to overwrite whatever data is on there :P
Post a stacktrace? You can take a photo for us of the kernel panic.
Re: Introducing the USB Stick of Death
#7As a security vulnerability, it's interesting but, as they stated, low-severity. If you have physical access and a local user, it's much easier to use any Linux boot CD and one of the myriad "password recovery" systems. I used Petter N Hagen's http://pogostick.net/~pnh/ntpasswd/ back in my tech support days (several years ago). The current tech support guy swears by Hiren's BootCD http://www.hiren.info/pages/bootcd
I've always assumed the attack vector was to leave the sticks lying around. If I'm not mistaken, some people have left them at banks in hopes that the employees will plug them into one of the computers there to see what's on it. Almost everyone I know has plugged a USB stick they don't own into their computer at one point or another.
Re: Introducing the USB Stick of Death
#8As a security vulnerability, it's interesting but, as they stated, low-severity. If you have physical access and a local user, it's much easier to use any Linux boot CD and one of the myriad "password recovery" systems. I used Petter N Hagen's http://pogostick.net/~pnh/ntpasswd/ back in my tech support days (several years ago). The current tech support guy swears by Hiren's BootCD http://www.hiren.info/pages/bootcd
I've always assumed the attack vector was to leave the sticks lying around. If I'm not mistaken, some people have left them at banks in hopes that the employees will plug them into one of the computers there to see what's on it. Almost everyone I know has plugged a USB stick they don't own into their computer at one point or another.
Many PCs are patched now so there's no default autorun.inf (or similar) functionality. So you'd have to run a binary on it to trigger this exploit it seems. Doable of course, but one step harder.
Re: Introducing the USB Stick of Death
#9As a security vulnerability, it's interesting but, as they stated, low-severity. If you have physical access and a local user, it's much easier to use any Linux boot CD and one of the myriad "password recovery" systems. I used Petter N Hagen's http://pogostick.net/~pnh/ntpasswd/ back in my tech support days (several years ago). The current tech support guy swears by Hiren's BootCD http://www.hiren.info/pages/bootcd
Most systems that are physically available with local users (e.g. libraries, college computer labs, etc.) will have booting from anything other than the hard drive disabled, and the BIOS password protected. You'd need to open up the machine and reset the CMOS to use this approach.
Re: Introducing the USB Stick of Death
#10As a security vulnerability, it's interesting but, as they stated, low-severity. If you have physical access and a local user, it's much easier to use any Linux boot CD and one of the myriad "password recovery" systems. I used Petter N Hagen's http://pogostick.net/~pnh/ntpasswd/ back in my tech support days (several years ago). The current tech support guy swears by Hiren's BootCD http://www.hiren.info/pages/bootcd
Most systems that are physically available with local users (e.g. libraries, college computer labs, etc.) will have booting from anything other than the hard drive disabled, and the BIOS password protected. You'd need to open up the machine and reset the CMOS to use this approach.
Worth noting that some BIOS flags can be resetted using an exploit, but usually it is just a blind guess.