Dangerous new trend in USB key marketing from companies - Page 1
Forum section: electronics / general

author: edy
author_rank: Super Contributor
timestamp: November 30, 2018, 12:38:21 am
content: Hi folks,I just received a package from Colgate promoting some new toothpaste and there was a little "card" packaged in there. See the attached images....[Aside: I can't stand companies sending USB keys like this. I would rather they provide a normal 8 GB or 16 GB USB that is actually *useful* to me and happens to be pre-loaded with their marketing material, which I can choose to either keep or wipe. Then at least the key is branded with their name and logo and I can always be reminded how generous they were].Anyways, back to Colgate...So immediate I looked at this "USB key" and if it was anything like another one I received last year, it would have barely enough memory to hold some PDF files and would not be erasable, and even if it did, it may hold 200-300 MB total, making it completely useless.Being skeptical, I plugged it into my Linux machine so I could try to mount it manually, investigate the filesystem and stop any auto-loads, etc. To my bewilderment, a bunch of CHROME BROWSER instances started to pop up, loading *nothing* (URL was blank) and the longer I left the key in the machine, the more browsers would launch, one on top of the other, every few seconds, blank.NO USB DRIVE WAS APPEARING IN THE FILE SYSTEM!!!!!So I found an old WinXP machine and plugged it in there and found that in a blink of an eye, the "Start" menu popped up, something got typed into a "Run..." dialog (the URLhttp://srt.red/CAEnglish) and then the ENTER key must have been pressed!I opened up a Notepad and kept pressing on it (to make it the active focus) and when I plugged in the key it typed exactly that URL into Notepad. SO IS THIS WHAT I AM THINKING IT IS??Rather than a drive of some sort, this USB key is acting like a "keyboard" or HID device injecting keystrokes into the computer when plugged in! It seems to hit the Windows-key or Win-R to activate a run dialog (which by the way I also enabled the shortcut on my Linux machine since I use it to open my menu), and then types "http://srt.red/CAEnglish" into it, which then proceeds to launch my default browser Chrome to go to that URL.IS THIS RIDICULOUS OR WHAT?Why would this company make this piece of garbage to shuffle you off to some Bitly shortcut link (srt.red) only to then forward you to some other website? Why not just print the website link on their marketing material? The behaviour of this key and any future use of this disturbing trend is very concerning!!!A few questions come to mind. First, is there a way I can capture all the keystrokes more effectively? Second is how does the key know that the launcher is active, or is it a "one-shot" device where it sends the keystrokes upon insertion and then stops? That seemed to be the case on the WinXP machine but on my Linux machine it did NOT actually stop, but kept repeating (perhaps this is a behaviour of Linux mounting a USB device where it is constantly refreshing it?).Second, why the actual command didn't work on Linux? When I manually press the Win-key or Win-R and then type in that URL, it seems to load up the site. But when I insert the key, I guess it is so fast that I don't see it... whereas on the older WinXP machine, while it is very fast indeed, I can still see it and that's how I discovered this was a keystroke injector.OK! I've finished my rant. I just had to share this, in case anyone else sees these "USB keys" showing up. They register as "WEBKEY" on WinXP but show up in the Keyboards section of Device Manager as HID Keyboard Device.A f*&*k!ng keystroke injector simply to launch a browser to their website!

author: Wan Huang Luo
author_rank: Regular Contributor
timestamp: November 30, 2018, 12:45:09 am
content: That’s definitely sketchy. That’s as sketchy as can be.

author: Bassman59
author_rank: Super Contributor
timestamp: November 30, 2018, 12:49:55 am
content: Quote from: edy on November 30, 2018, 12:38:21 amIt might be worth contacting someone high up in the Colgate marketing food chain, as well as in their legal office, and explain to them what kind of virus you were given.

author: cdev
author_rank: Super Contributor
timestamp: November 30, 2018, 12:57:32 am
content: You need to send this to the top security web sites so someone with a global audience can write it up and explain why that kind of thing should be understood to be crossing a line that shouldn't be crossed in marketing.Is it a flash driveor a MCU pretending to be a flash drive?Edit: wrote that before I read your whole post - still I would love to know exactly what it was doing.What is the lsusb information that is shown? What shows up in your kernel log and dmesg?Can it be imaged? What is shown as the partition type if you run a utility like GNU 'parted'or better yet "disktype"on it?http://disktype.sf.netBunnie Huang has written extensively about flash memory. You might find something about this kind of thing on his site. Most people don't realize this but every SD card has a small computer in it. They are more powerful than people think.These kinds of things are being used to compromise the security of peoples computers and install spyware.

author: tsman
author_rank: Frequent Contributor
timestamp: November 30, 2018, 01:04:28 am
content: Look athttp://blog.opensecurityresearch.com/2012/10/hacking-usb-webkeys.htmlandhttps://github.com/OpenSecurityResearch/webkey_toolsfor a tool to capture everything it types.Quote from: edy on November 30, 2018, 12:38:21 amIt doesn't know. It just automatically sends out the predefined keystrokes and then should stop. No idea why it would be continually resetting under Linux.

author: ataradov
author_rank: Super Contributor
timestamp: November 30, 2018, 01:14:36 am
content: It is a one shot device. There is a stock example in Atmel Studio for Atmel MCUs that launches a notepad.exe and types some text in there right on plugging in. Attacker heaven, especially given that it is not hard to put malicious device like that into someone's mailbox.I plug stuff like this into RPi that is not connected anywhere else.

author: Whales
author_rank: Super Contributor
timestamp: November 30, 2018, 01:18:48 am
content: It's a standard USB keyboard. Your OS happily accepts it and any keystrokes it sends. Your OS has no clue that it's not really a keyboard, it has no way of knowing.It will have no notable flash inside, just an MCU (possibly with program flash, but that's nothing like a USB drive's flash).

author: xrunner
author_rank: Super Contributor
timestamp: November 30, 2018, 01:20:37 am
content: Quote from: Whales on November 30, 2018, 01:18:48 amNice - what will they think of next?

author: coppercone2
author_rank: Super Contributor
timestamp: November 30, 2018, 01:33:44 am
content: lol that used to be a common/popular hack, basically the idea was you can get a malicious 'keyboard' to install a virus by going to the right website or something really quick, or to turn off antivirus or whatever.

author: coppercone2
author_rank: Super Contributor
timestamp: November 30, 2018, 01:38:04 am
content: how do you scan a USB drive to detect if its trying to be something else? on linux bsd etc.

author: ataradov
author_rank: Super Contributor
timestamp: November 30, 2018, 01:39:21 am
content: Quote from: coppercone2 on November 30, 2018, 01:38:04 amlsusb and study the descriptor.But it may enumerate as another device in the middle of the night, do its deed and enumerate back as a USB drive.There is no 100% way to protect against this. But on the other side there is no 100% way to make an undetectable device, so if this was happening on a mass scale, we would notice.Although if USB drive may be smart. If it sees a file named "SUPER SECRET NSA STUFF.ppt", it can trigger and send that file and go dormant again. There is a number of heuristics you can employ to limit a number of activations, so lowering the chance of detection.

author: coppercone2
author_rank: Super Contributor
timestamp: November 30, 2018, 01:42:12 am
content: hmm can you leave it plugged in an keep it monitored?The USB protocol is such that it can hide a state change?does anyone have a script?

author: ataradov
author_rank: Super Contributor
timestamp: November 30, 2018, 01:43:18 am
content: Quote from: coppercone2 on November 30, 2018, 01:42:12 amYou can, but I don't know if any standard software can do this.Actually, just monitor the output of the 'dmesg' command or corresponding log files. There is no way to bypass that and they will contain all enumerations.

author: coppercone2
author_rank: Super Contributor
timestamp: November 30, 2018, 01:44:54 am
content: can you lock up linux/bsd to require a password to change any memory space associated with DMSG? read only without a special password or some shit. otherwise you would need to sniff that memory some how one way.Does it get automatically flagged by the hardware/driver as soon as it tries or do you need to poll it? like device reinserted or renegotiated or something?

author: coppercone2
author_rank: Super Contributor
timestamp: November 30, 2018, 01:46:53 am
content: basically so that no matter how quick it is, it can't hide its behavior change.

author: ataradov
author_rank: Super Contributor
timestamp: November 30, 2018, 01:48:41 am
content: dmesg outputs the log from the Linux kernel. So there is no way to modify or disable that from a regular user. Provided that there are no other bugs that give you privilege escalation.And even then it is far too tricky to do with just typing and no feedback.

author: Mr. Scram
author_rank: Super Contributor
timestamp: November 30, 2018, 02:04:25 am
content: Even if it didn't inject keystrokes sending USB items out is bad form. You don't plug unknown devices into your computer.

author: ataradov
author_rank: Super Contributor
timestamp: November 30, 2018, 02:05:13 am
content: Quote from: Mr. Scram on November 30, 2018, 02:04:25 amMarketing people that came up with this idea do.

author: coppercone2
author_rank: Super Contributor
timestamp: November 30, 2018, 02:07:32 am
content: you can have marketing wank or marketing doo-doo. this is defiantly doo doo. Then you have rootkits integrated into software, thats marketing 'dog got into the chocolate again'.

author: edy
author_rank: Super Contributor
timestamp: November 30, 2018, 02:12:47 am
content: Thanks for all the input. I didn't realize these things were so prolific. I will give a try using some of the Linux commands and sharing the logs and outputs next week as I left the key at work. I may need some help as I am on Ubuntu and have not used those much (dmesg, lsusb, etc). The annoying thing is that my browser keeps getting invoked and I can't change focus for long as the second I click on a terminal, another browser window opens on top and takes my focus away! I may have to set terminal "always on top" or just run something which constantly runs and monitors the USB enumeration or logs keystrokes and saves them, then I plug in key, record the behaviour and unplug.Very very annoying and stupid practice of making these keystrokers! Must be ultra-cheap but to save a few seconds of a user typing a shortcut URL? REALLY? And did they send French people thehttp://srt.red/CAFrenchkey! Or what abouthttp://srt.red/USEnglish?

author: Sredni
author_rank: Frequent Contributor
timestamp: November 30, 2018, 02:14:51 am
content: Colgate's rootcanalkit(Where I live colgate is known for the toothpaste)

author: amyk
author_rank: Super Contributor
timestamp: November 30, 2018, 02:16:24 am
content: It is extremely unusual to have more than one keyboard attached to a computer, so IMHO the USB drivers should realise that you already have a keyboard and prompt whether to enable them when subsequent ones appear.

author: fsr
author_rank: Regular Contributor
timestamp: November 30, 2018, 02:21:15 am
content: I have seen worse:http://www.cexx.org/phoenix.htmhttp://www.tomshardware.com/forum/112783-30-phoenixnethttps://www.theregister.co.uk/2001/07/19/phoenix_answers_all_our_phonehome/

author: langwadt
author_rank: Super Contributor
timestamp: November 30, 2018, 02:42:27 am
content: Quote from: amyk on November 30, 2018, 02:16:24 amso something that pretends to be a keyboard can prevent you from attaching a keyboard?

author: edy
author_rank: Super Contributor
timestamp: November 30, 2018, 03:05:25 am
content: Quote from: Sredni on November 30, 2018, 02:14:51 amI think it finds all instances of CREST and competitor brochures and Web sites and blocks access to them from your computer!

author: Brumby
author_rank: Unknown
timestamp: November 30, 2018, 03:16:40 am
content: Quote from: edy on November 30, 2018, 12:38:21 amDodgy as hell. (And you have no idea how polite that statement is in relation to the feelings I'm having right now)If I had come across it, I'd have stormed up to the local corporate office breathing fire!Message to ALL marketing and corporate types thinking of doing this:DON'T !!!!

author: edy
author_rank: Super Contributor
timestamp: November 30, 2018, 03:58:08 am
content: While I see how they might have thought it would be cool 10 years ago (even then it should have been better thought out), to see this garbage continuing today in marketing materials deployed by a major corporation deserves them a kick in their shiny Colgate-brushed teeth and a giant facepalm.Here is the WHOIS info on srt.red that is the URL forwarding to colgateprofessional.com:WHOIS Srt.redDomain Name: SRT.REDRegistry Domain ID: D503300000185503755-LRMSRegistrar WHOIS Server:Registrar URL:https://www.gandi.net/whoisUpdated Date: 2018-10-03T00:21:28ZCreation Date: 2018-10-03T00:10:39ZRegistry Expiry Date: 2019-10-03T00:10:39ZRegistrar Registration Expiration Date:Registrar: Gandi SASRegistrar IANA ID: 81Registrar Abuse Contact Email: abuse@support.gandi.netRegistrar Abuse Contact Phone: +33.170377661Reseller:Domain Status: clientTransferProhibitedhttps://icann.org/epp#clientTransferProhibitedDomain Status: serverTransferProhibitedhttps://icann.org/epp#serverTransferProhibitedDomain Status: addPeriodhttps://icann.org/epp#addPeriodRegistrant Organization:Registrant State/Province: NYRegistrant Country: USName Server: NS-297.AWSDNS-37.COMName Server: NS-1689.AWSDNS-19.CO.UKName Server: NS-1089.AWSDNS-08.ORGName Server: NS-858.AWSDNS-43.NETDNSSEC: unsignedURL of the ICANN Whois Inaccuracy Complaint Form ishttps://www.icann.org/wicf/The Registrar of Record identified in this output may have an RDDS service that can be queried for additional information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.So what I gather is someone in Colgate marketing or the people who printed and made these cards are providing some forwarding service through srt.red which recognizes certain keywords and forwards to the appropriate site. For example, I was able to see CAEnglish on my key. However, USEnglish also works. CAFrench also gets forwarded to a Colgate site but says page not found. USSpanish gives error (some bit.ly page). Why not have just put website directly on webkey? Why create what seems to be a 3rd party forwarding intermediary (except to track and log stats or change the site in case something goes terribly wrong)? How is Gandi and Bitly involved in all of this? Why is registrant organization blank?

author: tsman
author_rank: Frequent Contributor
timestamp: November 30, 2018, 04:55:03 am
content: Quote from: edy on November 30, 2018, 03:58:08 amSo you can still change where the webkey sends people to even after giving them out.Quote from: edy on November 30, 2018, 03:58:08 amDomain was registered using Gandi. Bitly is who actually runs their URL shortening service on it. No idea who actually owns srt.red. It isn't Gandi or Bitly. Might be Colgate or a marketing company they're using.Quote from: edy on November 30, 2018, 03:58:08 amBecause Gandi's domain privacy service leaves that field empty. My personal domain is registered via Gandi and it doesn't show anything in that field either. GDPR has meant most registrars now give you the domain privacy service for free now.

author: edy
author_rank: Super Contributor
timestamp: December 03, 2018, 05:40:01 pm
content: Ok, back to work! I tried a few things with the Webkey on my Linux machine and here's the output from lsusb after inserted, and then removed:Code:edy@edy-ASUS:~$ lsusbBus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching HubBus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hubBus 001 Device 003: ID 13d3:5165 IMC NetworksBus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching HubBus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hubBus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hubBus 003 Device 038: ID 05ac:6662 Apple, Inc.Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub... and after device removed...Code:edy@edy-ASUS:~$ lsusbBus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching HubBus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hubBus 001 Device 003: ID 13d3:5165 IMC NetworksBus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching HubBus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hubBus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hubBus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hubNotice the difference is:Bus 003 Device 038: ID 05ac:6662 Apple, Inc.Ok, so I also dumped the output of dmesg to a file and found this (some non-standard characters, not sure if it will show up in the forum properly):Code:[14749.993937] usb 3-2: new full-speed USB device number 24 using xhci_hcd[14750.121599] usb 3-2: New USB device found, idVendor=05ac, idProduct=6662[14750.121603] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0[14750.121605] usb 3-2: Product: WEBKEY[14750.121607] usb 3-2: Manufacturer: ŵࠅę̩ʑ֕[14750.125795] input: ŵࠅę̩ʑ֕ WEBKEY as /devices/pci0000:00/0000:00:14.0/usb3/3-2/3-2:1.0/0003:05AC:6662.0017/input/input52[14750.177815] hid-generic 0003:05AC:6662.0017: input,hidraw0: USB HID v1.10 Keyboard [ŵࠅę̩ʑ֕ WEBKEY] on usb-0000:00:14.0-2/input0[14750.921158] usb 3-2: USB disconnect, device number 24I've attached the dmesg output since the plugging in of the Webkey (see attachment "webkey.txt"), showing how it is inactivating, then activating repeatedly (I am not taking it in and out), thereby causing new instances of the Google Browser to continuously pop up yet IMPROPERLY passing the URL, so it is just opening blank windows that go nowhere! There are some what I assume to be Universal Firewall Block messages in there [UFW Block] showing also some activity going on... Not sure if it is due to the Webkey trying to do something.So if you look at that manufacturer, I assume that is Chinese characters improperly being displayed??? Can anyone figure out who this company is based on the vendor or product ID? Why is it showing up as an "APPLE" device when I use lsusb?Finally, one more interesting bit of random sh!t that happened while I was playing around with the Webkey. I had my terminal window open and tried to type something while I inserted the webkey and all of a sudden I got this long string of numbers appearing in my terminal prompt:Code:104116116112115058047047115114116046114101100047067065069110103108105115104This seems weird but now I understand what may have been going on.... It seems that under Windows, when you press "ALT" key and type numbers on the num-pad, you can type in the ASCII-CODE equivalent of the characters. Probably the Webkey is finding a way to launch a browser (not sure how yet) and then holds down the "Alt" key while it sends that string of digits, which translates to:104 = h116 = t116 = t112 = p115 = s058 = :047 = /047 = /115 = s114 = r116 = t046 = .114 = r101 = e100 = d047 = /067 = C065 = A069 = E110 = n103 = g108 = l105 = i115 = s104 = hYes! It's....https://srt.red/CAEnglishBut it seems to be doing this by sending a string of numbers? And since Linux doesn't recognize the "Alt-" number combination like Windows does, we see just the string of numbers and not their ASCII-code equivalents (which would presumably appear if the "Alt" key was being pressed at the same time). Not sure what would happen on a Mac, but I am assuming the MCU in the Webkey would probably do some rudimentary check of the system and figure out what it was plugged into.Anyone else have any ideas? So they are FAKING an Apple Keyboard device too?

author: Wan Huang Luo
author_rank: Regular Contributor
timestamp: December 03, 2018, 05:53:43 pm
content: Quote from: edy on December 03, 2018, 05:40:01 pmIt looks like they have their bases covered on most all other platforms. I think its perfectly logical to conclude that they are faking an Apple keyboard device.Apple (I'm assuming) takes these things seriously and doesn't have a sense of humor.Wonder if reporting this to Apple Security would result in a cease & desist letter to Colgate?

author: tooki
author_rank: Super Contributor
timestamp: December 03, 2018, 05:56:26 pm
content: Quote from: amyk on November 30, 2018, 02:16:24 amExcept that it’s notthatrare. Most laptops now use internal USB keyboards, so plugging in an external one means... two keyboards. USB barcode scanners also appear as USB keyboards. So do some other random input devices.

author: tooki
author_rank: Super Contributor
timestamp: December 03, 2018, 05:57:23 pm
content: Quote from: Wan Huang Luo on December 03, 2018, 05:53:43 pmI doubt they can do an OS check. As for it being the Apple vendor ID, it literally just means they used one of Apple’s vendor ID hex codes.

author: free_electron
author_rank: Super Contributor
timestamp: December 03, 2018, 05:59:06 pm
content: Simple HDI keyboard emulator.going through an intermediate portal allows Colgate to change their website at will. if they relocate the page they update the intermediate portal and things keep working.nothing malicious. actually very clever.

author: Wan Huang Luo
author_rank: Regular Contributor
timestamp: December 03, 2018, 06:05:56 pm
content: Quote from: tooki on December 03, 2018, 05:57:23 pmYou're right.Apparently there was an American Express credit card-shaped device that did the exact same thing.Using the keyboard HID to inject text apparently has been used by marketers for some time.So my previous post is moot; Apple already tolerates this behavior.Further reading:https://superuser.com/questions/131897/can-i-reprogram-an-american-express-usb-driveInteresting note from one of the posts is that it is possible to reprogram the device to do anything you want. That's where it becomes scary.

author: edy
author_rank: Super Contributor
timestamp: December 03, 2018, 06:16:47 pm
content: Quote from: free_electron on December 03, 2018, 05:59:06 pmYes probably true (as to the nothing malicious part)... But clever? To distribute a Webkey with a fake Apple vendor ID simply to launch a website (bit.ly shortened URL) is bad practice, not to mention it doesn't work on all systems and can cause strange behaviour (like on my Linux system). It also has a much greater potential to backfire on them (due to the security concerns) than whatever possible benefit they could gain. It is not clever at all.Not that a Colgate-Branded USB storage key would be any better security-wise (it could be just as easily abused) but at least it would give people something they could use to transfer files around. Put 16gb or 32gb on there, make it look like a toothbrush or toothpaste (or whatever they want) and give that out.It would at least be something I would keep around, remind me of the brand. No... instead all I have is this stupid "card" with a flip-out USB-chip part that registers as a keyboard and types 25 characters into my computer when I plug it in, without my knowledge, potentially f*&cking up my system. Thanks Colgate!

author: edy
author_rank: Super Contributor
timestamp: December 03, 2018, 06:30:35 pm
content: Hi, I've taken it apart and photographed the board. There is an unpopulated spot for an 8-pin chip U1 and everything else seems to be potted/glob topped. They didn't even include R1 or C2-C4.... Wow this thing was built down to a price! Mine is similar to a guy who posted on this blog link that his Hyundai-branded one also was missing the EEPROM on top:https://hackaday.com/2012/10/02/disassembling-and-reprogramming-webkeys/

author: Kleinstein
author_rank: Super Contributor
timestamp: December 03, 2018, 06:43:56 pm
content: Quote from: edy on November 30, 2018, 02:12:47 amMust be really cheap stuff, as it has to compete with an QR code printed on paper. I would prefer the paper version.Is it possible to reprogram such an device ? If yes, the original one may be not as bad as a manipulated one.

author: Whales
author_rank: Super Contributor
timestamp: December 03, 2018, 08:51:14 pm
content: Quote from: amyk on November 30, 2018, 02:16:24 amYes and no. It gets more complicated, USB does not have this scenario/problem in mind holistically.On boot: which device should be chosen as the correct one? You can't wait until the OS boots up and remembers (from past history), before then the keyboard will have BIOS and bootloader access.On hub reset: make sure you enforce the same rules. In bad situations this might look like all the keyboards were "unplugged" and then "replugged" in, rather than a proper hub reset/failure. Could be exploited by electronics thataccidentallyresets the hub occasionally.Quote from: free_electron on December 03, 2018, 05:59:06 pmThe could do this on their own site, rather than relying on a 3rd party. This would avoid scenarios such as the 3rd party going down or malicious; which would mean branded materials (eg Colgate USB key) start taking you to the wrong places.Most companies probably don't consider, know or understand the risks in this particular scenarios. It's just one small feature of an advertising agreement/contract/whatever with an external party.

author: fsr
author_rank: Regular Contributor
timestamp: December 03, 2018, 11:11:45 pm
content: It probably uses ALT-ASCII typing to avoid problems with different keyboard regional settings, as the keyboard can only send the key scancode, and not the character directly. I suppose Alt and the numeric keys are always the same scancode, no matter the keyboard layout and regional settings.

author: ataradov
author_rank: Super Contributor
timestamp: December 03, 2018, 11:14:41 pm
content: And it also makes it Windows-only. At least on Linux Alt-Numpad thing does not work.

author: amyk
author_rank: Super Contributor
timestamp: December 04, 2018, 02:30:13 am
content: Quote from: Whales on December 03, 2018, 08:51:14 pmIf the BIOS is already big enough to contain a USB stack (or enough of one to recognise and work with keyboards in any case) it could similarly remember the ID of the correct one in NVRAM.QuoteNot really a difficult problem to solve. Re-enumeration simply picks the last known good device and any additional ones cause prompting.QuoteOnce again it's a matter of giving "consent" to unknown input devices --- the ones you've allowed will automatically be enabled, others won't. Before USB you had to explicitly "allow" by installing the driver for the device (unless it was a standard one like a PS/2 keyboard/mouse.) With USB, devices can be automatically detected and allowed, and what I'm saying is that this automatic/implicit always-allow behaviour is what should be changed.

author: tooki
author_rank: Super Contributor
timestamp: December 04, 2018, 12:33:12 pm
content: Quote from: ataradov on December 03, 2018, 11:14:41 pmAs far as I know, the Alt+numpad thing is Windows-only. It doesn’t work on Mac, either. (Oh, the irony, when using an Apple vendor ID!) Compared to Windows, the Mac has always had much, much smarter/obvious key combinations for special characters — it helps to have an extra modifier key! (I have no idea how Linux does it.)

author: bd139
author_rank: Super Contributor
timestamp: December 04, 2018, 12:37:03 pm
content: Hahahaha this is hilarious and a really nasty marketing idea to think that it is acceptable.Google “USB rubber ducky”. I own a couple for penetration testing purposes. They are extremely effective. You can own a whole network in under a second with one and physical access.Edit: save Googling:https://shop.hak5.org/products/usb-rubber-ducky-deluxeRandom USB stick is like using an anonymous glory hole. Don’t ever even go there.

author: BradC
author_rank: Super Contributor
timestamp: December 04, 2018, 12:46:19 pm
content: Quote from: bd139 on December 04, 2018, 12:37:03 pmNot having heard that term before, I googled it. Sights I can't un-see.

author: tszaboo
author_rank: Super Contributor
timestamp: December 04, 2018, 12:58:45 pm
content: Yes, USB device can be really damaging, if it is used in conjunction with other technologies. Imagine a composite device, with keyboard and a flash drive. Keyboard typesStart + Rcmdcd /dir /s > d:/filelist.txt (and tries it with all other drives)Basically they just copied the list of all files to the drive, with a microcontroller or even a small CPU on it, and it doesn't even need network access. The "flash drive" could even have other built in radio interfaces, Ethernet over USB, or an SoC smart enough to try multiple ways of attack. Or connect to the neighbour's unsecured wifi, and send the data that way.

author: RoGeorge
author_rank: Super Contributor
timestamp: December 04, 2018, 01:26:17 pm
content: That is why one MUST never plug unknown USB devices, even if the USB port is disabled (there are even idiots that thought making an USB stick to discharge a few kV on the data lines in order to destroy the host device might be a fun prank).I never understood why the OS blindly trust the USB devices. The OS asks me for admin rights to install updates from the official repositories, yet it blindly trust an unknown USB device.Why the OS doesnotask for the admin password at the first detection of a new device, before enumerating and/or installing the new USB device?

author: dmills
author_rank: Super Contributor
timestamp: December 04, 2018, 01:50:22 pm
content: Firewire was more fun because the external device could get the firewire controller to do arbitraryDMAon its behalf! Enumerating as something where the OS had a built in driver (Hard drive or video camera were good contenders) and then issuing DMA transfers to grab the contents of userspace ram was a good game for a while.I suppose something similar might be possible with thunderbolt (Anyone know for sure), and of course exposed PCI-E is fair game this way.IOAPICs reduce the fun of course, but device drivers for external busses are not always as paranoid as they should be, and you can enumerate as anything so it only takes finding one broken one....As ever, with physical access it is game over.Regards, Dan.

author: tooki
author_rank: Super Contributor
timestamp: December 04, 2018, 02:16:43 pm
content: Quote from: RoGeorge on December 04, 2018, 01:26:17 pmSo... how would you authorize a new keyboard when your old one fails?Another issue is that some OSes, like Windows, appear to configure the drivers, etc for a given USB device not per-device, but per-port, in that if you unplug a configured USB device from one port and then plug it into another port on the same machine (even another port on a hub!) it must re-configure the drivers again. So on Windows at least, this would likely mean needing to authorize a device again just because you plugged it into a different port.Moreover, how do you positively identify a device? Does each get a serial number? You could spoof that just as easily as the vendor ID and device ID (as these things already do, pretending to be an Apple Pro Keyboard). Ok, so use encryption keys and digital signatures... well, and then we’d have handshaking failures like we sometimes see on HDMI.Ultimately, as dmills said, once you have access to the hardware, all bets are off. There will always be a need for “dumb” low-ish level hardware access.

author: Kleinstein
author_rank: Super Contributor
timestamp: December 04, 2018, 02:37:11 pm
content: Quote from: tooki on December 04, 2018, 02:16:43 pmThat one is relatively easy: just ask for the password before anything else can be done with the KB. Even it this is a simple password that is noted on a sticker on the PC, this would help a lot.So I see no real hurdle for the OS to not blindly trust hardware added to the USB port. With drivers linked to ports one could also limit the keyboard to a specific USB port.

author: Mr. Scram
author_rank: Super Contributor
timestamp: December 04, 2018, 11:44:13 pm
content: Quote from: free_electron on December 03, 2018, 05:59:06 pmA tool to direct a computer system to any undisclosed website at will and without warning? That sounds totally harmless!

author: bd139
author_rank: Super Contributor
timestamp: December 05, 2018, 12:25:50 am
content: It makes me want to leave goatse USB sticks in the street. Track hit count via a URL shortening service 1561 people disgusted since 2018If you don't know what it is, don't google goatse. I mean it

author: edy
author_rank: Super Contributor
timestamp: December 05, 2018, 12:46:21 am
content: That Colgate Professional can be handing out this turd-on-a-USB-stick (card) to their professional dentist clients in 2018 (nay, almost 2019) is simply shocking! I can understand this maybe being "innovative" (but still a bad idea) in 2013.... but for their marketing department to approve some 3rd party to be making these for distribution NOW? I don't think they have a clue what is going on and what red flags it sets off... although it is ironic their link passes through srt.redas an intermediary.Did you see that motto on the card? "Plug into your computer to open the possibilities". Perhaps we are also being a bit too surprised (although rightfully harsh) that this is still going on, as most people who are unaware of technology would not even think twice about sticking in a company-branded stick (or even any stick they find laying on the ground). Not that it is smart to do, but let's face it... your average person has no idea of the possible ramifications of plugging in a USB device they find, or visiting a website, or opening an email attachment, etc.NOTE: That intermediary link may offer additional statistics-gathering capability for either themselves (the 3rd party maker of the USB-wanker) or Colgate. For example, it can log IP address connections, browser identifiers, region, time of day of access, and many other possibly useful data that can be mined, either by Colgate or the marketing company who wants to approach other potential corporate clients with the same type of service.

author: ataradov
author_rank: Super Contributor
timestamp: December 05, 2018, 12:48:40 am
content: This happens because marketing people simply hire companies that provide "comprehensive services" and the company itself may not even know what is going on. They should, but they don't.

author: Mr. Scram
author_rank: Super Contributor
timestamp: December 05, 2018, 01:53:26 am
content: You'd be surprised how many companies still give out branded thumb drives at trade shows. I tried explaining the issue to some representatives, but it seems they mostly think you're annoying. They're completely oblivious.

author: BradC
author_rank: Super Contributor
timestamp: December 05, 2018, 03:10:00 am
content: Quote from: Mr. Scram on December 05, 2018, 01:53:26 amI love 'em. Take them home, stick them in my desktop (which doesn't auto-mount anything), zero them out, format and pop them in the drawer for later use.I haven't bought a USB drive in years.

author: MrMobodies
author_rank: Super Contributor
timestamp: December 05, 2018, 03:51:30 am
content: That is worrying and now wonder they switch off USB ports in some companies I have worked at.Now I have open them up to see what is inside.That could be very convincing if the keyboard typing was timed to open up in conjunction with something genuine bundled within Windows like the Windows update and request administrator's permissions to run it and trick the user so they can take over that way.

author: edy
author_rank: Super Contributor
timestamp: December 05, 2018, 04:00:20 am
content: Quote from: BradC on December 05, 2018, 03:10:00 amWell that's the problem... they either don't give you decent USB flash drives anymore, or they give you garbage that isn't even a drive (but a keystroke injector)! Of the last few drives I got in recent years, they contained just enough memory (a few MB's) to hold the few documents they wanted to share. Some were *maybe* 1 GB if you were lucky, most were well below. Some were even "faked" to indicate higher capacity and then when you tried to load above a certain size file, the data was corrupted beyond the true capacity (and you only figure that out after you try to read it back)!

author: MrMobodies
author_rank: Super Contributor
timestamp: December 05, 2018, 04:28:21 am
content: They could cram a lot more virtual things like that on sdcards.Toshiba Flashair:Eye-fi has been making them since 2005.

author: perieanuo
author_rank: Frequent Contributor
timestamp: December 05, 2018, 09:02:48 am
content: Quote from: amyk on November 30, 2018, 02:16:24 amit is extremely usual tl have one.I say just yubikey for exampleEnvoyé de mon HUAWEI NXT-L29 en utilisant Tapatalk

author: perieanuo
author_rank: Frequent Contributor
timestamp: December 05, 2018, 09:39:55 am
content: Quote from: RoGeorge on December 04, 2018, 01:26:17 pmI understood your point, but it's limited a little bit.same goes to PCI/PCIE,Comm/.lpt ports,Firewire ports and I can go forever.That's why they made antiviruses and firewallscordialement, pierre

author: perieanuo
author_rank: Frequent Contributor
timestamp: December 05, 2018, 09:44:42 am
content: Quote from: BradC on December 05, 2018, 03:10:00 amYou're seeing only a part of the iceberg.you format flash.what does the firmware behind the microcontroller chip you have zero idea.that one you can't 'zero' it without reflashing flash and eep of controller itself.got the idea?in your case, your pc/network is just an open door.

author: bd139
author_rank: Super Contributor
timestamp: December 05, 2018, 09:45:28 am
content: I do actually keep all the free marketing USB sticks. Being a sociopath, I just give them to people I don't like

author: perieanuo
author_rank: Frequent Contributor
timestamp: December 05, 2018, 09:46:38 am
content: Quote from: bd139 on December 05, 2018, 09:45:28 amyep, good ideea, tks!

author: bd139
author_rank: Super Contributor
timestamp: December 05, 2018, 10:01:28 am
content: Actually I meant to say this earlier. My mother, in her 80s, is mostly technology aware and capable but she can't resist a bargain. So whenever she goes in charity shops here she seems to pick up unknown USB sticks. Apparently there is a big basket of them that are £1 each and they range from around 4GB to 16GB. I reckon if you just walked in there and chucked a handful of rubber ducky sticks they would just quite happily say thank you and let you walk out.Anyone seen 12 monkeys? computer version of that

author: Terry01
author_rank: Frequent Contributor
timestamp: December 05, 2018, 10:13:30 am
content: I can't believe i'm reading this post this morning.Last night my Mrs who works with 1 of the biggest banks out there came home from work and handed me a USB stick in the shape of a bottle opener. One of the guys in here team was at some get together or other for all the companies they work with and there was free 4GB UBS sticks being handed out. He got a few and handed them out to my Mrs and the rest of their team and my Mrs gave me hers saying "here there's something for you to use".I don't really know about these things but something made me not just stick in in my laptop to see what it was. I don't know what made me wary. I think it is just a blank USB stick and I doubt very much there is anything dodgy on it but not 100% sure.Anyways like I say it's funny to read this post this morning with you guys talking about these after getting 1 last night.

author: bd139
author_rank: Super Contributor
timestamp: December 05, 2018, 10:17:26 am
content: UBS doesn't surprise me. Not well known for their security prowess in the sector. Dispose of it, preferably in fire.Another more malicious device potentially:https://usbkill.com/

author: Rerouter
author_rank: Super Contributor
timestamp: December 05, 2018, 10:23:34 am
content: There is another bad flavor of USB's I've come across, where they can only be formatted to 1 file system, generally fat32, and have the marketing material persist after formatting, (saw 2 back in 2016 when a friend was asking why he couldn't erase the files)Obviously its tweaked firmware, but if anything it makes me hate there company 20 times more,

author: Terry01
author_rank: Frequent Contributor
timestamp: December 05, 2018, 10:29:22 am
content: Quote from: bd139 on December 05, 2018, 10:17:26 amK thanks for the heads up. It will go in the bin next time i'm passing. I don't have a fire.... unless I start 1!

author: Tomorokoshi
author_rank: Super Contributor
timestamp: December 05, 2018, 03:40:07 pm
content: On the radio here there are occasional advertisements from the USB organization talking about how there are billions of USB devices out there.With such high market access, why would they need to promote the interface?Someone with a cynical point of view might suspect that the USB organization is trying to counter potential bad publicity with good publicity.

author: Mr. Scram
author_rank: Super Contributor
timestamp: December 05, 2018, 05:59:53 pm
content: Quote from: BradC on December 05, 2018, 03:10:00 amThey're generally cheap drives anyway, so not recommended for anything important. It's also important to note that without auto mounting it's still a risk, but I see perieanuo already explained that.

author: Bassman59
author_rank: Super Contributor
timestamp: December 06, 2018, 08:49:52 pm
content: Quote from: Wan Huang Luo on December 03, 2018, 05:53:43 pmThe Vendor ID string you see here is programmed into the device and reported to the host computer as part of enumeration. There's no database lookup or anything smart going on when you dump the descriptors.So the assholes who made this thing decided to be clever and put "Apple Computer" in as the Vendor ID of their malware, reasoning that anyone glancing at the list of enumerated USB devices will see Apple and think that there's nothing suspicious going on.

author: Bassman59
author_rank: Super Contributor
timestamp: December 06, 2018, 08:53:36 pm
content: Quote from: tooki on December 03, 2018, 05:57:23 pmAccording tothis list, the Vendor ID is indeed Apple's but there's no such device. I still think the assholes who make this thing just used Apple's VID and entered "Apple, Inc" as the manufacturer string, just to throw off someone who might be glancing at the list of enumerated devices.

author: Whales
author_rank: Super Contributor
timestamp: December 07, 2018, 06:18:31 am
content: Quote from: Rerouter on December 05, 2018, 10:23:34 amThis I want to see!

author: ataradov
author_rank: Super Contributor
timestamp: December 07, 2018, 06:20:23 am
content: Quote from: Whales on December 07, 2018, 06:18:31 amIt is pretty easy to do to any flash drive. You can do this through a service utility for the controller. It just sets the whole array to be read only.

author: Brumby
author_rank: Unknown
timestamp: December 07, 2018, 06:57:00 am
content: Quote from: Bassman59 on December 06, 2018, 08:53:36 pmNOWis the time Apple needs to step in with a trademark claim!

author: ataradov
author_rank: Super Contributor
timestamp: December 07, 2018, 06:58:33 am
content: VID is just a number, you can't copyright numbers.There is absolutely noting they can do here.

author: Brumby
author_rank: Unknown
timestamp: December 07, 2018, 07:09:24 am
content: Something is identified as Apple - by whatever means - and that isnota trademark issue?Having trouble seeing that.

author: ataradov
author_rank: Super Contributor
timestamp: December 07, 2018, 07:15:38 am
content: Quote from: Brumby on December 07, 2018, 07:09:24 amIt did not identify as Apple. Linux matched its USB Vendor ID to a database and printed Apple. It is not device's fault. The device itself identified as :Code:[14750.121605] usb 3-2: Product: WEBKEY[14750.121607] usb 3-2: Manufacturer: ŵࠅę̩ʑ֕

author: Brumby
author_rank: Unknown
timestamp: December 07, 2018, 07:20:05 am
content: Then I'm curious as to how it picked out Apple.

author: ataradov
author_rank: Super Contributor
timestamp: December 07, 2018, 07:32:05 am
content: What "it"? The device picked a "random" number. In this case it ended up being 0x05ac. The fact that Linux comes with a text file matching this number to a string "Apple" is a pure coincidence.USB requires VID/PID to work, and USB IF does not make it easy to get them. So people just put random numbers.

author: xaxaxa
author_rank: Regular Contributor
timestamp: December 07, 2018, 09:02:10 am
content: Quote from: ataradov on December 07, 2018, 07:32:05 amOr spoof a specific VID/PID, which I had to do in one of my products, otherwise windows will not recognize it as stupid windows has no concept of "device class" but rather ties drivers to VID/PID.

author: perieanuo
author_rank: Frequent Contributor
timestamp: December 07, 2018, 12:55:07 pm
content: Quote from: xaxaxa on December 07, 2018, 09:02:10 amyep, can do this, but here you can got yourself a big nice copyright lawsuit.why not buy original ftdi and use it as it is with his original vid/pid...we made products like you did with some pid/vid different from original and build own drivers.but wat the hell maybe I'm missing somethingregards,pierre

author: bd139
author_rank: Super Contributor
timestamp: December 07, 2018, 01:55:46 pm
content: I think people who build their own drivers and get IDs changed should be shot because it's a PITA getting the generic drivers working on MacOS X then.

author: edy
author_rank: Super Contributor
timestamp: December 07, 2018, 03:02:16 pm
content: The list of USB VID's is here:http://www.linux-usb.org/usb.idsScroll down to 05ac Apple, Inc., you will see lots and lots of PID's associated with various Apple products. I assume that this vendor ID is reserved for Apple use only, so as they add more products they can fill in their PID's as needed. Note that this WEBKEY uses an unpopulated PID 6662. Apple doesn't use it, *yet*. They end at about 1500 and then jump to 8005 in the list.Linux doesn't know, and I doubt that in the future Apple will just "Release" a subset of their VID PID's to another company. So they *are* infringing on what seems to be a reserved Apple range of PID's... certainly by claiming to be them as a vendor for sure, and then in the future potentially conflicting with something Apple may release. They should not have used that VID, regardless of what PID they are using (even though Apple doesn't currently have anything listed). One other note.... I do not know if this Linux-USB list is comprehensive (probably not) and so there must be a USB consortium or some other organization that handles this... i.e. here:https://www.usb.org/getting-vendor-idThere-in lies the potential legal ramifications... the company could potentially be sued by USB.org. They also have tools here:https://www.usb.org/usb2tools, and there is a Company list you can download if you are a member (maybe someone on the forum is and can check the relevant codes and rules). Anyways, like I said before it seems that if you make USB devices you probably need to comply to this organization's rules but it may be "suggested" and not legally enforceable (and I doubt the law extends to China which seems to do whatever it wants anyways).

author: ataradov
author_rank: Super Contributor
timestamp: December 07, 2018, 03:50:03 pm
content: Quote from: edy on December 07, 2018, 03:02:16 pmIt is not an infringement in a legal sense. In order to use USB peripheral in a microcontroller, you don't have to know about the list of existence of USB IF.Quote from: edy on December 07, 2018, 03:02:16 pmNo, they can't. Unless it is a frivolous lawsuit.It is a contractual issue. They can be used for contract violation (as those companies that tried to resell PIDs). But if they have not entered into a contract in a first place, they can't be sued for violating it.USB IF can pursue copyright infringement if you use their logo on the product. But that's it.BTW, everyone is "infringing" whey they use I2C addresses, since NXP maintains a list of officially assigned addresses.

author: Bassman59
author_rank: Super Contributor
timestamp: December 07, 2018, 08:16:41 pm
content: Quote from: Brumby on December 07, 2018, 07:20:05 amSimple. The Manufacturer ID is a string stored in the device and returned to the host during enumeration.

author: ataradov
author_rank: Super Contributor
timestamp: December 07, 2018, 08:37:39 pm
content: This is not the case here. Manufacturer ID string is not Apple here.

author: edy
author_rank: Super Contributor
timestamp: December 19, 2018, 05:17:51 am
content: I had some time so I put together a video summarizing this thread for others to watch and hopefully learn about this terrible practice. Maybe somebody from Colgate or Apple will see this and take notice!DESCRIPTION:I received this marketing material from Colgate and in the package was this plastic card with a flip-out USB key that I thought was a USB drive with Colgate brochures/videos. Instead, the device turned out to be a keystroke injector, taking over the keyboard input to launch a browser on your computer. This is a sneaky and dangerous practice, susceptible to hacks and total waste!The URL it types is 25 characters, but can be entered only as 17 characters (srt.red/CAEnglish) without the "https://", and if they shortened it more could easily be 10 (srt.red/CE) as they can control the bitly shortcut. They could have just printed in big letters to go to "srt.red/CE" (English), or "srt.red/CF" (French) or "srt.red/US" (USA) instead of making this useless piece of garbage that causes issues on Linux machines, has the potential to mess up your system and does stuff you don't expect!At least if they provided a useful USB Storage Drive (e.g. 16GB) with their name on it, it would have some utility and more impact. Instead, this promo material is used once and trashed! It only shows how ridiculous marketing is getting and I am sure Colgate is unaware or doesn't know this is bad practice or likely to leave a negative impression.

author: Richard Crowley
author_rank: Super Contributor
timestamp: December 19, 2018, 05:43:16 am
content: Quote from: amyk on November 30, 2018, 02:16:24 amThat is completely contrary to my experience. Windows at least will happily accept any kind of HID (Human Interface Device) and automatically install drivers (if necessary), etc. Keyboards and Mice are only two types of HID. Many other types are in wide use. For example, barcode readers, RFID readers, etc.QuoteLots of dumb users would find it annoying to have to click through several authorization windows just to plug in their mouse. There probably isn't much difference to the OS between a keyboard and a mouse.For years, we have seen movies and TV where the good guy (or the bad guy) sneaks in and plugs in a USB gadget to copy all the secret files or give remote access to the controllers out in the panel van on the street, etc.