USB Rubber Ducky — a device which resembles a regular USB flash drive. When connected to a computer, it claims to be a keyboard and quickly enters all its commands. It’s a pretty cool thing and very useful for pentests, but why pay 40 dollars or more if a regular USB flash drive can be taught the same tricks?
WARNING
Don’t forget that making the described changes to your USB flash drive may not only void the device’s warranty but may also kill it. Experiment at your own risk!
Introduction
Last year’s Black Hat was full of many interesting reports. One of the most discussed was a report on the fatal vulnerability of USB devices, which allows regular USB flash drives to be turned into a tool for spreading malware. The attack was called BadUSB, but later jokes appeared on the Internet referring to USBola, comparing this attack to the well-known virus. Similar ideas for using HID devices for malicious purposes have been around for a while. It’s a sin not to use the fact that the OS trusts devices connected to a USB interface. If we search the magazine’s archives, we can find an article on a similar topic describing the technique of using a special Teensy device to control a PC running Windows 7 (actually, with any OS). The device disguised itself as a regular USB flash drive. All this suggested that the same trick could also be played with flash drives.
Prerequisites
A USB is a really universal interface. Just think how many devices we connect it to and how many devices it works with! Mouses, keyboards, printers, scanners, gamepads, modems, access points, web cameras, telephones, etc. Without thinking, we plug the USB into the socket and the OS automatically determines the type of device and loads the required drivers.
How flash drives work
In fact, the OS knows nothing about the connected device. It has to wait until the device tells it what kind it is. Let’s consider a simple example. When we plug a USB flash drive into a USB socket, the flash drive informs the operating system of its type and volume. It is worth remembering our shrewd Chinese colleagues, who learned how to produce higher capacity flash drives (some almost 2 TB). To figure out how this is possible, let’s remember (or learn) how the OS recognizes USB devices.
USB device initialization algorithm
The purpose of USB devices is defined by class codes communicated to the USB host for installation of the necessary drivers. The class codes allow the host to work with single-type devices from different manufacturers. The device may support one or several classes, the number of which is determined by the number of USB endpoints. When connected, the host requests a range of standard details from the devices (descriptors), which it uses to decide on how to work with it. The descriptors contain information about the manufacturer and device type, which the host uses to select the program driver. A regular USB flash drive will have class code 08h (Mass Storage Device — MSD), while a web camera equipped with a microphone will have two codes: 01h (Audio) and 0Eh (Video Device Class).
