There is a HUGE security flaw in the current hardware implantation of USB, that allows the USB slave to execute code on the USB host completely undetected. (take note of the third demonstration in the quote)
there will be a demonstration at the "blackhat conference" Aug 6th/7th
Nohl and Lell have discovered that USB controller chips' firmware offer no protection from reprogramming. Using a set of proof-of-concept tools they call BadUSB, they claim that an ordinary USB device, even a thumb drive, can be used to compromise computers in the following ways:
- A device can emulate a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install malware. Such malware, in turn, can infect the controller chips of other USB devices connected to the computer.
- The device can also spoof a network card and change the computer’s DNS setting to redirect traffic.
- A modified thumb drive or external hard disk can — when it detects that the computer is starting up — boot a small virus, which infects the computer’s operating system prior to boot.
there will be a demonstration at the "blackhat conference" Aug 6th/7th