Bizarre RS Components USB drive keyboard thing?

[ataradov]

And it does not matter how much you lock down your corporate machines. If someone targets a specific company, they will make sure that malware works on home PCs as well. Same sprinkled flash drives will get plugged in into a home computer. All malware needs to do now is to wait a login into Outlook Web Access, Salesforce or any other online system of interest. It can be quite efficient if you are targeting a specific organization.

[robertbaruch]

I bought an Android-based head unit from carjoying.com. It worked pretty well, a lot of people I spoke to in person and on forums like them. But it shipped with a USB stick. It was a beautiful thing, looked like porcelain with blue painting, had a nice heft, and a nice red decorative string through the loop at the top. After admiring it, I said, "Who the f-bomb would plug this in?!"

I think I threw it out.

[stj]

you should have plugged it into a Linux box and wiped the partitions.
or fill it with "FF" using the DD command.

[jeremy]

you should have plugged it into a Linux box and wiped the partitions.
or fill it with "FF" using the DD command.

No partitions, it wasn't a mass storage device.

update on the acetone: it did bugger all. Might be PE or PP. Perhaps when the rest of the world receives them, someone with some methylene chloride or MEK handy could give it a go...

[ataradov]

you should have plugged it into a Linux box and wiped the partitions.
or fill it with "FF" using the DD command.

Google "bad usb". Putting malware in autorun is last century. Nowdays you get flash drives with modified controller firmware.

[stj]

you should have plugged it into a Linux box and wiped the partitions.
or fill it with "FF" using the DD command.

No partitions, it wasn't a mass storage device.

update on the acetone: it did bugger all. Might be PE or PP. Perhaps when the rest of the world receives them, someone with some methylene chloride or MEK handy could give it a go...

if i get one, i'll try hot air from a 2.5mm nozzle or something.

[stj]

you should have plugged it into a Linux box and wiped the partitions.
or fill it with "FF" using the DD command.

Google "bad usb". Putting malware in autorun is last century. Nowdays you get flash drives with modified controller firmware.

then atleast DD it to a file and check it with a hex editor.
no point wasting good usb devices, and when DO you trust them???

[ataradov]

then atleast DD it to a file and check it with a hex editor.

What that going to do? Controller can be programmed to be a normal flash drive and 30 minutes later re-enumerate as a composite device - USB drive + HID. Or create a virtual file on the fly. It is all limited only by your imagination.

no point wasting good usb devices, and when DO you trust them???

You can't 100% trust anything, but I trust a drive from Transcend or SanDisk more than I trust a random Chinese drive. Random drives are typically very slow as well.

[stj]

well i wouldnt, a couple of big names have had the supply chain contaminated in the past.

[AGRGale]

So i just got one of these funny little things.. looking on this thing, I see a trace cut at the top of the circuit board, maybe that to finalise the programming? or change it from program mode to hid mode? or its just mine has a defect from someone/thing nicking it..

[jeremy]

I don't think mine had any cuts. But there were two sneaky little pads inside the USB connector which I assume were for programming.

[AGRGale]

Hmm, I'm going to strap a rs-232 to them points, see what it comes up with..

[AGRGale]

So i popped mine appart.. it looks like a flatpack, custom leads (usb) on it..

Heres some pictures:







as for strapping serial to it... sorry, forgot

[AGRGale]

once I see what serial has to say, if anything, then we can look into the FW, but hell, in that format, that litttle package, you could push it into a usb socket, no one will know till someone attempts to shove something else in. simple deployment payloader..

[stj]

probably not.
you could set up a mass-storage and keyboard etc.
but the keyboard wont help unless there is a control-sequence to open a command line or similar.
even then, there is no way to know the path to the usb storage partition.
you could try hitting several dozen possible variations or target a specific common machine though.

[helius]

Nothing prevents enumerating as a mouse too and clicking on the Start menu (or its equivalent in other OSes). There are key sequences that emulate mouse movement, too.