Re: [Discuss] code for hacked USB drive (BadUSB) released on Github

2014-10-06 Thread Tom Metro
Chuck Anderson wrote: > Tom Metro wrote: >> I don't think it can pose as both simultaneously. > > Why couldn't it pose as both simultaneoulsy? As Drew pointed out, a bus reset is required to get the host computer to recognize it as a new device. > Couldn't it embed a USB hub to present more tha

Re: [Discuss] code for hacked USB drive (BadUSB) released on Github

2014-10-06 Thread Richard Pieri
On 10/6/2014 12:51 PM, Drew Van Zandt wrote: > I'm not saying "arbitrary USB devices can do this", I'm saying "it is > trivially easy to design a USB device to do this". That's not what I inferred from "It is, however, not difficult to have a USB device reset itself and then change its answer when

Re: [Discuss] code for hacked USB drive (BadUSB) released on Github

2014-10-06 Thread Drew Van Zandt
Rich, I have designed hardware for several USB devices that can, in fact, work that way. The USB VID/PID are just registers, they can be rewritten, and kicking your own reset line is easy in most cases. I'm not saying "arbitrary USB devices can do this", I'm saying "it is trivially easy to design

Re: [Discuss] code for hacked USB drive (BadUSB) released on Github

2014-10-06 Thread Richard Pieri
On 10/6/2014 11:13 AM, Drew Van Zandt wrote: > It is, however, not difficult to have a USB device reset itself and then > change its answer when re-initialized. USB doesn't work that way. Neither does BadUSB. If you flash a BadUSB custom firmware to a USB device then that device becomes what you f

Re: [Discuss] code for hacked USB drive (BadUSB) released on Github

2014-10-06 Thread Drew Van Zandt
It is, however, not difficult to have a USB device reset itself and then change its answer when re-initialized. *Drew Van Zandt* On Mon, Oct 6, 2014 at 11:06 AM, Richard Pieri wrote: > On 10/6/2014 3:06 AM, Tom Metro wrote: > > If these drives look like an ordinary USB storage drive when first

Re: [Discuss] code for hacked USB drive (BadUSB) released on Github

2014-10-06 Thread Richard Pieri
On 10/6/2014 3:06 AM, Tom Metro wrote: > If these drives look like an ordinary USB storage drive when first > attached, I wonder what they are using as a trigger to have them switch They don't switch. A USB device can be only one kind (class) of device at a time. This is set when the device is ini

Re: [Discuss] code for hacked USB drive (BadUSB) released on Github

2014-10-06 Thread Chuck Anderson
On Mon, Oct 06, 2014 at 03:06:44AM -0400, Tom Metro wrote: > If these drives look like an ordinary USB storage drive when first > attached, I wonder what they are using as a trigger to have them switch > into malicious keyboard mode? I don't think it can pose as both > simultaneously. The switch mi

[Discuss] code for hacked USB drive (BadUSB) released on Github

2014-10-06 Thread Tom Metro
Tom Metro wrote: > Something like a USB Rubber Ducky could help implement this: > > https://hakshop.myshopify.com/collections/usb-rubber-ducky/products/usb-rubber-ducky-deluxe > > A pass phrase can be stored on them, and it'll replay it with the press > of a button. > ... > With the discovery th