{"id":38409,"date":"2014-10-06T15:58:10","date_gmt":"2014-10-06T22:58:10","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=38409"},"modified":"2025-08-17T20:31:12","modified_gmt":"2025-08-18T03:31:12","slug":"hackers-new-best-friend-could-be-usb","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/hackers-new-best-friend-could-be-usb\/","title":{"rendered":"The Hacker\u2019s New Best Friend Could be Your USB Port"},"content":{"rendered":"

It\u2019s tiny and portable, yet perfect for storing large items. I\u2019m talking about the good ol\u2019 Universal Serial Bus (a.k.a USB) drive, the giveaway of choice at tradeshows across the world, and perfect for the easy storage and transfer of photos, documents, music and more. But you might want to think twice before plugging a free USB into your machine. The reason: USBs can now contract an undetectable\u2014and unfixable<\/a>\u2014virus that can be spread quite easily.<\/p>\n

News of this potent malicious software (often referred to as malware<\/a>) has circled around the information security industry since researchers Karsten Noh and Jakob Lell described their new attack to a packed room at this year\u2019s Black Hat security conference in early August.<\/p>\n

The malware, dubbed BadUSB, can take over a computer, as well as redirect Internet-bound traffic to different site. But BadUSB\u2019s danger doesn\u2019t lie with its ability to execute code\u2014this type of malware, called auto-run (because it runs automatically when the USB drive is inserted into your device), has been around for some time now. The danger lies with its ability to never be detected. BadUSB exploits how the USB standard was built and coded, and mixes malware with the device\u2019s firmware\u2014the code that tells the USB stick how to work. This intermingling of code makes the malware indistinguishable from normal, safe firmware.<\/p>\n

Because of the danger this particular form of malware posed to the public at large, the pair refrained from releasing the code to attendees. That reasoning, however, didn\u2019t sit well with another pair of researchers, who did <\/em>publish the infectious malware after reverse engineering it. The malware that freaked out two security researchers enough to make them refrain from publishing their work is now out in the open.<\/p>\n

USBs, long considered secure (perhaps incorrectly<\/a>), are now major liabilities to consumers everywhere. So the question now is, should you be worried?<\/p>\n

The answer is yes and no.<\/p>\n

The good thing about this malware variant is that it\u2019s isolated to just USB devices. But that\u2019s also its danger: USB devices are so ubiquitous that consumers typically don\u2019t pay them any attention\u2014the best sort of attack vector hackers could hope for. Hackers could also hide this malware within a larger package and could, theoretically, infect a computer that would subsequently infect any and all USB devices that connect with that machine\u2014thereby spreading the malware even further. All in all it\u2019s pretty bad news.<\/p>\n

So why did these researchers knowingly, and publicly, publish such dangerous malware? Because they want to see this security issue fixed, and the only way they\u2019re convinced it\u2019ll be fixed is by lighting a fire under USB manufacturers.<\/p>\n

They\u2019re not entirely wrong, either. Manufacturers, largely for business reasons, have been notoriously slow in fixing security issues (called patching), and USB drives are no different. By publicly making this code available, the pair of researchers will deny USB manufacturers the ability to claim that they weren\u2019t aware of security vulnerabilities on USB. That knowledge, it\u2019s theorized, will drive better security further down the road.<\/p>\n

How to Protect Yourself from Attacks<\/h2>\n

Publishing this code was well intentioned, and, truthfully, is a fairly standard practice in the information security industry. But this particular malware is going to cause a lot of headaches for quite a few years (likely a decade<\/a>). So what can you do to protect yourself while this newfound attack vector is out in the wild? Well there are a few options available:<\/p>\n