Keyboards, mice and thumb drives used to hide malware, and computers powerless to detect it

Keyboards, mice and thumb drives used to load malware computers aren't built to detect; it can control your system, corrupt or destroy data

PUBLISHED : Friday, 01 August, 2014, 12:57am
UPDATED : Friday, 01 August, 2014, 12:57am

USB devices such as keyboards, thumb drives and mice can be used to hack into personal computers in a potential new class of attacks that evade all known security protections, a top computer researcher revealed yesterday.

Karsten Nohl, chief scientist with Berlin's SR Labs, said hackers could load malicious software onto tiny, low-cost computer chips that control functions of USB devices but which have no built-in shields against tampering with their code.

Computers do not detect the infections when tainted devices are inserted because anti-virus programs are only designed to scan for software written onto memory and do not scan the "firmware" that controls the functioning of those devices.

"You cannot tell where the virus came from. It is almost like a magic trick," said Nohl, whose research firm is known for uncovering major flaws in mobile phone technology.

The finding shows that bugs in software used to run tiny electronics components that are invisible to the average computer user can be extremely dangerous when hackers figure out how to exploit them. Security researchers have increasingly turned their attention to uncovering such flaws.

Nohl said his firm had performed attacks by writing malicious code onto USB control chips used in thumb drives and smartphones. Once the USB device is attached to a computer, the malicious software can log keystrokes, spy on communications and destroy data, he said.

Nohl and Jakob Lell, a security researcher at SR Labs, will describe their attack method at next week's Black Hat hacking conference in Las Vegas, in a presentation titled: "Bad USB - On Accessories that Turn Evil."

Thousands of security professionals attend the annual conference to hear about the latest hacking techniques, including ones that threaten business computers, consumer electronics and critical infrastructure.

Nohl said he would not be surprised if intelligence agencies, like the US National Security Agency, have already figured out how to launch attacks using this technique. Last year, he presented research at the conference on breakthrough methods for remotely attacking SIM cards on mobile phones.

In December, documents leaked by former NSA contractor Edward Snowden, who has been granted temporary asylum in Russia, demonstrated that the US spy agency was using a similar technique for surveillance.

An NSA spokeswoman declined to comment.

SR Labs tested the technique by infecting controller chips made by major Taiwanese manufacturer Phison Electronics and placing them in USB memory drives and smartphones running Google's Android operating system.

Alex Chiu, an attorney with Phison, said Nohl contacted the company in May.

"Mr. Nohl did not offer detailed analysis together with work product to prove his finding," Chiu said. "Phison does not have grounds to comment (on) his allegation."

Similar chips are made by Silicon Motion Technology and Alcor Micro. Nohl said his firm did not test devices with chips from those manufacturers.

Google did not respond to requests for comment. Officials with Silicon Motion and Alcor Micro could not immediately be reached.

Nohl believed hackers would have a "high chance" of corrupting other kinds of controller chips besides those made by Phison, because their manufacturers are not required to secure software.

He said those chips, once infected, could be used to infect mice, keyboards and other devices that connect via USB.

"The sky is the limit. You can do anything at all," he said.

In his tests, Nohl said he was able to gain remote access to a computer by having the USB instruct the computer to download a malicious program with instructions that the PC believed were coming from a keyboard.

He was also able to change what are known as DNS network settings on a computer, essentially instructing the machine to route internet traffic through malicious servers.