Connecting a malicious thumb drive: An undetectable cyberattack

March 27, 2023 by

Bianca Gonzalez

When we think of preventing cyberattacks, many of us think of phishing, malware or ransomware attacks. But you just might be overlooking the power of an external drive.

How a fake USB drive can take over your computer

Did you know cybercriminals can pull off a nearly undetectable cyberattack using only a malicious thumb drive? Infosec Principal Security Researcher Keatron Evans explains in this episode of Cyber Work Applied.

Cyber Work listeners get free cybersecurity training resources. Click below to get your free courses and other materials.

Free Cybersecurity Trainings

Malicious USB: Example and demo

Below is the edited transcript of Keatron’s Malicious USB walkthrough, along with a portion of the code he uses.

Dangers of connecting unknown USB drives

(0:00-0:35) Hello, I'm Keatron Evans, and I'm going to show you one of the most overlooked ways people get hacked or compromised, plugging in USB thumb drives, external drives and other such media. The method I'm going to demonstrate is nearly undetectable.

We constantly drive home the message of being careful of what you download from the internet and how dangerous downloads can be, but one of the more devastating and harder-to-detect scenarios is plugging in a malicious or weaponized USB drive. We're going to take one, which I've hardware hacked and make it appear as if it's a human interface device, or in this case, a keyboard to the operating system.

See Infosec IQ in action

From gamified security awareness to award-winning training, phishing simulations, culture assessments and more, we want to show you what makes Infosec IQ an industry leader.

Demo Now

Making a fake USB drive with malware

(0:36-0:57) The actual malicious payload is loaded into the firmware on this keyboard controller that's inside here, as opposed to just being a file on an actual USB drive. So essentially, this thing is not a USB drive at all; it just appears to be one.

The fact that it's not actually external storage means Windows security will treat it differently because after all, what harm could come from plugging in a USB keyboard?

How the malicious USB drive works

(0:58- 1:31) What you see here on my screen is I've got a listener in Metasploit waiting for someone somewhere to plug a drive just like this one in. When they plug it in, the hardware code that I firmware hacked in the disk drive is going to tell their machine to connect back to my machine.

It's going to do that in the form of sending actual keystrokes to their keyboard and having them type the code up for me on the machine as if I were sitting at the machine typing the code, almost like having an alien plug into your brain and type something.

Demo of malicious USB leading to attacker control

(1:32-2:20) Let's go ahead and look at what's happening on my screen as we wait for the victim to plug in the drive. Right now, we see nothing on my screen; it's just waiting. And now the victim is plugging in the drive.

C:\Users\Administrator>

And as you can see, as a result of them plugging it in, I now have a command shell on that victim's machine, which we, at that point, can completely take control of. I can do IP config.

C:\Users\Administrator>ipconfig

I can get a list of files on that machine.

C:\Users\Administrator>dir

And I can even write a file to this machine's desktop and have it control that machine if I wanted to do that.

C:\Users\Administrator>echo

So from here on, that machine belongs to me, and all the victim had to do was simply plug in this drive and not do anything else, and the rest was done automatically.

Phishing simulations & training

Build the knowledge and skills to stay cyber secure at work and home with 2,000+ security awareness resources. Unlock the right subscription plan for you.

VIEW PRICING

More cybersecurity training resources

Want more free resources? Check out the weekly Cyber Work Podcast for in-depth conversations with cybersecurity practitioners and industry thought leaders.

Cyber Work listeners also get other free cybersecurity training resources. Check out the latest free courses and resources to keep learning!

Free Cybersecurity Training