Bizarre RS Components USB drive keyboard thing? - Page 1
Forum section: electronics / projects

author: jeremy
author_rank: Super Contributor
timestamp: October 10, 2016, 05:24:54 am
content: Hi, I received one of these in the mail today (pictures attached for your amusement). Sorry, I ripped it apart immediatelyThe little black thing was inside the cardboard.I assumed it would be a catalog on a USB drive, but no; it's a USB device which enumerates as a USB keyboard, does Windows Key + R, then types in some random URL which redirects to RS. Kind of creepy actually. Next thing they will send you a dongle which has "gksudo rm -fr /" to stop people using LinuxIs it really so difficult to put "RS" into my browser search bar and have it come up? Even if I used this stick thing, this is actually much slower (and I don't use windows, so it doesn't work).Very bizarre.

author: stj
author_rank: Super Contributor
timestamp: October 10, 2016, 05:48:26 am
content: so now you need to see if you can identify & reprogram iti want one!

author: jeremy
author_rank: Super Contributor
timestamp: October 10, 2016, 05:51:45 am
content: Yes, I'm going to go buy some acetone later because it looks like ABS plastic. Looks like I will also be able to get a second one from my brother who received one also.

author: helius
author_rank: Super Contributor
timestamp: October 10, 2016, 05:59:13 am
content: Really smart thinking, conditioning people to plug in random USB things they find in packages. I don't see what could possibly go wrong there.

author: jeremy
author_rank: Super Contributor
timestamp: October 10, 2016, 06:03:45 am
content: So there is some tiny writing on the bottom. first line is "Patented."Second line looks like: "ZL201020002751.4"Which links to a chinese patent for what looks like a rubik's cube:http://so.baiten.cn/detail/patentdetail/63/CN201020002751.4/18Here is the european version:https://register.epo.org/application?number=EP10195672&lng=en&tab=familyEven more bizarre.

author: ataradov
author_rank: Super Contributor
timestamp: October 10, 2016, 06:13:43 am
content: How about not plugging random garbage into USB?I use RPi if I really-really need to test something. RPi is disconnected from the network and after that the whole SD card is re-imaged.

author: Mr.B
author_rank: Unknown
timestamp: October 10, 2016, 06:24:16 am
content: Quote from: ataradov on October 10, 2016, 06:13:43 amAbsolutely!What were you thinking...

author: bktemp
author_rank: Super Contributor
timestamp: October 10, 2016, 06:25:59 am
content: Quote from: ataradov on October 10, 2016, 06:13:43 amIf one of the random USB things contains that, there is no need to re-image the SD card:http://usb-killer.com/

author: ataradov
author_rank: Super Contributor
timestamp: October 10, 2016, 06:27:41 am
content: Quote from: bktemp on October 10, 2016, 06:25:59 amAnd that's just one of the dumb things RPi protects against. At worst I'm risking killing RPi, which is not a big deal compared to killing my computer.

author: tggzzz
author_rank: Super Contributor
timestamp: October 10, 2016, 08:10:05 am
content: Count yourself lucky it wasn't a "USB Killer" stuffing several hundred volts into your PC.Example:https://www.usbkill.com/

author: Dubbie
author_rank: Unknown
timestamp: October 10, 2016, 08:15:38 am
content: I'm pretty sure the tinfoil hat you're wearing should protect you against that ataradov.Sent from my iPhone using Tapatalk

author: jeremy
author_rank: Super Contributor
timestamp: October 10, 2016, 08:22:02 am
content: FWIW, the usb-killer thing did cross my mind (briefly), but I decided that it wouldn't be that because it is about 2mm thick, which doesn't leave much room for the important parts of a high voltage SMPS

author: ataradov
author_rank: Super Contributor
timestamp: October 10, 2016, 08:25:15 am
content: Quote from: Dubbie on October 10, 2016, 08:15:38 amExcept that the threat here is real. That's how StuxNet got into air-gaped computers in Iran nuclear plants. That's how Yahoo-level attacks happen. It is a very well known and efficient tactic - just sprinkle some USB drives around the entrance of the company you want to target. Practice shows that significant number of the drives will get plugged into employee computers, because people are dumb.

author: Pjotr
author_rank: Frequent Contributor
timestamp: October 10, 2016, 08:29:33 am
content: Seems RS as well as Farnell have some marketing trainees at work for a while that have no idea what the customers are.

author: CJay
author_rank: Super Contributor
timestamp: October 10, 2016, 08:49:01 am
content: There are sites I work at from time to time where plugging anything other that approved devices (and that includes mice, keyboards etc. of specific make and model) into a USB port will cause the computer to lock down, it then has to be unlocked by security and you will receive very quickly be re-educated with a workplace disciplinary and interview with security.The human condition means that people are curious and will take 'calculated' risks like plugging in unknown USB devices, if security were taken seriously by those organisations that were penetrated then they would not have been penetrated.The old joke 'Just because I'm paranoid doesn't mean they're not out to get me' has a core message that many organisations would do well to listen to.As for the RS device, I suspect it's probably based around one of the ATTiny HID 'hacks' that are out there, could be fun to see if it can be reprogrammed, maybe there is an ISP connector hidden under a label or something

author: GreyWoolfe
author_rank: Unknown
timestamp: October 10, 2016, 11:53:48 am
content: CJay, my company is like that. There is no issue with keyboards and mice, but we can't just go plugging USB devices into our laptops. If it isn't company distributed, or getting something from one of my fellow techs, we are not supposed to plug any flash drive, SD card, etc in. Hard for me to imagine just plugging something in that you were sent in the mail, from whatever source, company or otherwise.

author: stj
author_rank: Super Contributor
timestamp: October 10, 2016, 03:15:34 pm
content: it's all a windows problem though,only windows mounts and try's to execute stuff on them automatically.similar problem with optical discs.

author: LabSpokane
author_rank: Super Contributor
timestamp: October 10, 2016, 03:20:31 pm
content: Quote from: ataradov on October 10, 2016, 08:25:15 amThis is why the US Government laughs at "air-gapped" networks. Even though it's a good security strategy, they know that someone will simply plug in a random USB-something to see what's on it or what it does.Having USB on a network that needs to be secure is a royal PITA.

author: CJay
author_rank: Super Contributor
timestamp: October 10, 2016, 03:39:19 pm
content: Quote from: stj on October 10, 2016, 03:15:34 pmAh, religious flame war starts here.But it's really not, if you have a USB key that emulates a HID then you can make any computer that enumerates it as such do whatever you want as it just appears to be a keyboard that's sending a string of typed characters.*bows out gracefully*

author: Fred27
author_rank: Unknown
timestamp: October 10, 2016, 04:36:44 pm
content: I worked at an investment bank that (many years ago) insisted on PS2 keyboards and hot glued all the USB ports. This was prompted by a USB keylogger found on a trader's PC.I agree with CJay that it's nothing to do with what OS is used. stj is just trolling (or misinformed).

author: stj
author_rank: Super Contributor
timestamp: October 10, 2016, 06:18:50 pm
content: not really, there are limits to what you can do with a "keyboard" unless it was plugged in by some asshole logged in as root.the investment bank is onto a loser btw, you can put a keylogger in the ps2 keyboard.i have been in places that epoxy the usb ports, but good training and a no nonsense set of rules.IE: "plug your own shit into the system and your sacked." is really the only way.i have also been to places where mobile phones must be put in a locker at the entrance.

author: Pjotr
author_rank: Frequent Contributor
timestamp: October 10, 2016, 06:46:23 pm
content: Yes fine, still the question is there: What ever possessed RS components to mail around such a thing.

author: Mr.B
author_rank: Unknown
timestamp: October 10, 2016, 06:58:06 pm
content: Quote from: LabSpokane on October 10, 2016, 03:20:31 pmWe have been using Lumension Device Control for many years.Very, very good at preventing anything from being introduced.It allows you to lock down USB, Optical Drives, eSATA, everything.It allows you to give permissions by device - e.g. The company digital cameras are allowed to connect via USB, but only JPG files may be read from them (after an enforced virus scan).https://www.lumension.com/device-control-software/usb-security-protection.aspxI don't work for the company, just a very satisfied customer.

author: stj
author_rank: Super Contributor
timestamp: October 10, 2016, 08:52:14 pm
content: Quote from: Mr.B on October 10, 2016, 06:58:06 pmbut what happens the next day when the system boots up and the bios scans the USB ports??

author: stj
author_rank: Super Contributor
timestamp: October 10, 2016, 08:54:00 pm
content: Quote from: Pjotr on October 10, 2016, 06:46:23 pmprobably the same thing that recently possesed a u.k. mobile phone provider/i.s.p. to mail out free usb-sticks to it's corporate customers - complete with pre-installed virus!!!http://www.theinquirer.net/inquirer/news/2467450/o2-sends-punters-usb-sticks-with-a-free-windows-virus-gift

author: ataradov
author_rank: Super Contributor
timestamp: October 10, 2016, 09:06:40 pm
content: And it does not matter how much you lock down your corporate machines. If someone targets a specific company, they will make sure that malware works on home PCs as well. Same sprinkled flash drives will get plugged in into a home computer. All malware needs to do now is to wait a login into Outlook Web Access, Salesforce or any other online system of interest. It can be quite efficient if you are targeting a specific organization.

author: robertbaruch
author_rank: Regular Contributor
timestamp: October 11, 2016, 01:47:35 am
content: I bought an Android-based head unit from carjoying.com. It worked pretty well, a lot of people I spoke to in person and on forums like them. But it shipped with a USB stick. It was a beautiful thing, looked like porcelain with blue painting, had a nice heft, and a nice red decorative string through the loop at the top. After admiring it, I said, "Who the f-bomb would plug this in?!"I think I threw it out.

author: stj
author_rank: Super Contributor
timestamp: October 11, 2016, 01:57:05 am
content: you should have plugged it into a Linux box and wiped the partitions.or fill it with "FF" using the DD command.

author: jeremy
author_rank: Super Contributor
timestamp: October 11, 2016, 01:58:41 am
content: Quote from: stj on October 11, 2016, 01:57:05 amNo partitions, it wasn't a mass storage device.update on the acetone: it did bugger all. Might be PE or PP. Perhaps when the rest of the world receives them, someone with some methylene chloride or MEK handy could give it a go...

author: ataradov
author_rank: Super Contributor
timestamp: October 11, 2016, 01:58:51 am
content: Quote from: stj on October 11, 2016, 01:57:05 amGoogle "bad usb". Putting malware in autorun is last century. Nowdays you get flash drives with modified controller firmware.

author: stj
author_rank: Super Contributor
timestamp: October 11, 2016, 02:54:26 am
content: Quote from: jeremy on October 11, 2016, 01:58:41 amif i get one, i'll try hot air from a 2.5mm nozzle or something.

author: stj
author_rank: Super Contributor
timestamp: October 11, 2016, 02:56:20 am
content: Quote from: ataradov on October 11, 2016, 01:58:51 amthen atleast DD it to a file and check it with a hex editor.no point wasting good usb devices, and when DO you trust them???

author: ataradov
author_rank: Super Contributor
timestamp: October 11, 2016, 03:00:42 am
content: Quote from: stj on October 11, 2016, 02:56:20 amWhat that going to do? Controller can be programmed to be a normal flash drive and 30 minutes later re-enumerate as a composite device - USB drive + HID. Or create a virtual file on the fly. It is all limited only by your imagination.Quote from: stj on October 11, 2016, 02:56:20 amYou can't 100% trust anything, but I trust a drive from Transcend or SanDisk more than I trust a random Chinese drive. Random drives are typically very slow as well.

author: stj
author_rank: Super Contributor
timestamp: October 11, 2016, 03:27:05 am
content: well i wouldnt, a couple of big names have had the supply chain contaminated in the past.

author: AGRGale
author_rank: Newbie
timestamp: October 17, 2016, 11:22:34 pm
content: So i just got one of these funny little things.. looking on this thing, I see a trace cut at the top of the circuit board, maybe that to finalise the programming? or change it from program mode to hid mode? or its just mine has a defect from someone/thing nicking it..

author: jeremy
author_rank: Super Contributor
timestamp: October 18, 2016, 12:05:23 am
content: I don't think mine had any cuts. But there were two sneaky little pads inside the USB connector which I assume were for programming.

author: AGRGale
author_rank: Newbie
timestamp: October 18, 2016, 12:20:04 am
content: Hmm, I'm going to strap a rs-232 to them points, see what it comes up with..

author: AGRGale
author_rank: Newbie
timestamp: October 26, 2016, 10:28:30 am
content: So i popped mine appart.. it looks like a flatpack, custom leads (usb) on it..Heres some pictures:as for strapping serial to it... sorry, forgot

author: AGRGale
author_rank: Newbie
timestamp: October 26, 2016, 10:54:17 am
content: once I see what serial has to say, if anything, then we can look into the FW, but hell, in that format, that litttle package, you could push it into a usb socket, no one will know till someone attempts to shove something else in. simple deployment payloader..

author: stj
author_rank: Super Contributor
timestamp: October 26, 2016, 11:05:30 am
content: probably not.you could set up a mass-storage and keyboard etc.but the keyboard wont help unless there is a control-sequence to open a command line or similar.even then, there is no way to know the path to the usb storage partition.you could try hitting several dozen possible variations or target a specific common machine though.

author: helius
author_rank: Super Contributor
timestamp: October 26, 2016, 03:33:57 pm
content: Nothing prevents enumerating as a mouse too and clicking on the Start menu (or its equivalent in other OSes). There are key sequences that emulate mouse movement, too.