USBHarpoon – BadUSB Can Attack Your PC with a Charging Cable

USBHarpoon – BadUSB Appears 

Back in 2014 Black Hat Conference, crypto specialists introduced the concept of BadUSB. It is a USB security flaw, allowing attackers to turn a USB into a keyboard used to type in commands.

Now, USBHarpoon is a BadUSB attack with a twist. Several security experts from SYON Security have built a malicious USB charging cable. 

Once the cable is plugged in, it turns into a peripheral device capable of typing and launching commands, enabling hackers to transfer malware on your PC and compromise a computer in just a few seconds, even you don’t notice it.

USBHarpoon, as its makers call it, relies on the BadUSB vulnerability. The researchers say that the cable is based on an alternative chip and a different firmware. And attackers can reprogram USB drive’s controller chip and make it appear as a human-machine interface device (HID) on the computer.

How to Protect Your Computer from Viruses? (12 Methods)

In this post, we will show you how to protect your computer from viruses through different methods and a free file recovery tool to rescue your lost data.

Read More

BadUSB Attack Your Devices

HID type can be anything, including a keyboard that can give rapid commands and instructions, a network card, etc. With USBHarpoon, the USB drive is replaced with a charging cable by security experts. This situation is ubiquitous but you are less likely to be cautious.

The cable comes with modified connectors, allowing data and power to pass through so as to fulfill the expected function. Shockingly, this feature can let the cable be used with any type of device that powers through USB including smartphones, fans, etc.

Once the manipulated USB is inserted via the HID, the criminal can send off malicious codes like Trojan to those devices. More seriously, Windows, Linux, and Mac are vulnerable against the attack.

The USBHarpoon/BadUSB cable can attack unlocked computers to launch commands that download and execute a payload. In Windows, the commands can run directly from the Run prompt while the commands launch a terminal and work from there in Mac and Linux.

Hide the BadUSB Attack

All the operations can be visible on the screen, so the attackers try to come up with a way to hide it. Currently, Vincent Yiu and his team are working on a way to trigger the attack when the victim is away from the device.

To delay the action is one method they find. But they have other channels to get the desired response, for example, Bluetooth and radio signals may be part of the solution.

Defend against It

It is not easy to protect against attacks that rely on a USB connection. A potential way is to use a data-blocking device – USB condom which can be used to block the data pins on a USB cable and only allow power to go through.

However, the USB condom is also possible to be infected, thus, don’t trust them unless there is a way to audit them before use.

Although BadUSB is gradually climbing the ladder towards the mainstream cyber attacks, persons are also coming up with corresponding firewalls to cope with attacks of a new age.