Elvis Wiki - User contributions [en]

USB Hacking

2024-11-22T14:27:24Z

AFries:

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.
The O.MG Cable Elite also has the function of keylogging.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

=== Payload ===
To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

[[File:Payloadexample.png|650px]]

=== Keylogging ===
To perform a keylogger attack, the O.MG Cable must be connected between the keyboard and the computer. Then, navigate to the KEYLOG section in the web interface and press Start. Optionally, enable LIVEVIEW to see the output in real-time. The keystrokes will now be recorded and displayed. It is important to note that the O.MG Cable only supports FULL-Speed USB.

[[File:O.MG-Cable_keylogger.png|650px]]

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

{| class="wikitable" style="margin:auto"
|-
! <b>OMG Cable</b> !! <b>NinjaUSB</b>
|-
| DuckyScript Payloads || Arduino IDE
|-
| Always simulates keyboard and mouse || Simulates either keyboard or mouse
|-
| Payloads are sent over a WiFi connection or when connecting the cable || Payloads are sent when connecting the cable, in a loop or with a remote
|-
| Does not need to be flashed when the payload changes || Needs to be flashed whenever the payload changes
|-
| Has the ability for keylogging whit the Elite version ||
|}

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/
* https://hackerwarehouse.com/product/usb-ninja-cable/
* http://192.168.4.1/omg.html.gz#
* https://o.mg.lol/setup/
* https://o-mg.github.io/WebFlasher/
* https://shop.hak5.org/products/omg-cable
* https://github.com/O-MG/O.MG-Firmware/wiki/Keylogger

[[Category:Documentation]]

File:O.MG-Cable keylogger.png

2024-11-22T14:19:20Z

AFries: Show the keylogger funktion of the O.MG cable

== Summary ==
Show the keylogger funktion of the O.MG cable

USB Protocol

2024-11-22T13:59:17Z

AFries:

== Introduction ==

The USB protocol is a cornerstone of modern computer communication, offering high flexibility and universal compatibility with a wide range of devices. However, this versatility comes with significant security risks. This document provides an overview of the USB protocol, highlighting its key features, such as composite device support and device enumeration. It also explores the associated security threats, including malware transmission, abuse of HID devices, and vulnerabilities due to unencrypted data transmission. By examining these aspects, the document sheds light on the balance between functionality and security in USB technology.

== Protocol ==

The USB protocol is characterized by its high flexibility, particularly in its support for so-called composite devices. Composite devices can contain multiple configurations and interfaces, with each interface functioning as an independent unit. A typical example is a USB headset, which features a configuration that includes four interfaces: a keyboard for volume control, a microphone, and two speakers. This flexibility enables various functions to be combined into a single USB device.

=== General Class Specifications ===

Since the introduction of USB 1.0, the concept of "Common Class Specifications" has been established to standardize various types of peripheral devices. A USB class is a group of one or more interfaces that collectively provide enhanced functionality. One of the most well-known classes is the "Human Interface Device" (HID) class, which allows the USB host controller to communicate with input devices such as keyboards and mice. Another significant class is the USB Mass Storage class, which defines how data is transferred between the host and storage devices.

Composite devices combine multiple classes to provide more comprehensive functionality. For example, a USB headset can utilize both the HID class and the Audio class to support input and output functions. While this design principle has increased the flexibility of the USB protocol, it has also introduced security challenges.

=== USB Device Enumeration ===

When a USB device is connected to a host system, the USB host controller detects the presence of the device and its transfer speed by monitoring voltage changes on the data pins. This triggers the process known as enumeration, which involves identifying and configuring the device. The process begins with the GetDeviceDescriptors command, where the host queries the device for identification information such as the manufacturer, Vendor ID (VID), Product ID (PID), and serial number.

After querying, the host controller resets the device and assigns it an address for future communication. This is followed by a GetConfigDescriptors request to retrieve all available configurations of the device. USB devices can have one or more configurations, but only one configuration can be active at a time. Each configuration may include one or more interfaces, which are identified through the GetInterfaceDescriptors request. These interfaces represent the essential functional units handled by different drivers within the operating system. After completing these steps, the operating system loads the appropriate drivers, and device-specific subprotocols (e.g., HID, Storage) are activated.

[[File:USB_enumeration_procedure.png]]

== Security threads ==

USB devices pose a significant security risk because, despite their widespread use, they offer low security. A particular risk with USB devices is USB sticks, which are often used as carriers for malware such as viruses, worms, and Trojans. This malware can spread easily since USB sticks can be quickly exchanged between different computers. A well-known example of a vulnerability is the AutoRun feature in older versions of Windows, especially Windows XP. This feature allowed USB devices to automatically start programs as soon as they were connected to a computer. While this was often used to install drivers, it was also exploited to execute malware unnoticed. In later versions of Windows, this feature was significantly restricted to minimize the risk.

Another serious risk with USB devices is the possibility of abusing HID (Human Interface Device) devices. Since HID devices are considered trustworthy, they can easily be used as an attack vector. For instance, a manipulated USB device can impersonate a keyboard and execute malicious inputs unnoticed to steal data or install malware. Such attacks, like those carried out using the O.MG Cable, exploit the fact that most operating systems trust HID devices and automatically grant them rights for user inputs. These attacks allow adversaries to execute commands undetected and gain access to sensitive data, posing significant security and privacy risks.

Another major problem with USB technology is the lack of encryption for data transmission. The data transferred between USB devices and the host computer is sent in plaintext, making it vulnerable to passive eavesdropping attacks. Attackers can intercept the data traffic on the bus line with relatively simple methods and capture sensitive information. Keyboards are particularly vulnerable since they are often used to input sensitive data, such as passwords.

== References ==

* Jing Tian, Nolen Scaife, Deepak Kumar, Michael Bailey, Adam Bates, and Kevin Butler. Sok: ”plug pray” today – understanding usb insecurity in versions 1 through c. In 2018 IEEE Symposium on Security and Privacy (SP), pages 1032–1047, 2018.
* Chengzhi Sun, Jiyu Lu, and Yunqing Liu. Analysis and prevention of information security of usb. In 2021 International Conference on Electronic Information Engineering and Computer Science (EIECS), pages 25–32, 2021
* Nongmeikapam Thoiba Singh, Aditya Shukla, Ajay Nagar, Kartavya Arya,Ashwani Tiwari, and Yash Varun. Keylogger development: Technical aspects, ethical considerations, and mitigation strategies. In 2023 International Conference on Energy, Materials and Communication Engineering (ICEMCE), pages 1-5, 2023
* Daniel Noyes, Hong Liu, and Paul Fortier. Security analysis and improvement of usb technology. In 2016 IEEE Symposium on Technologies for Homeland Security (HST), pages 1–3, 2016
* yungroul Lee, Wansoo Kim, Kwangjin Bae, and Kangbin Yim. A solution to protecting usb keyboard data. In 2010 International Conference on Broadband, Wireless Computing, Communication and Applications, pages 108–111, 2010

[[Category:Documentation]]

USB protocol

2024-11-22T13:53:58Z

AFries: AFries moved page USB protocol to USB Protocol

#REDIRECT [[USB Protocol]]

USB Protocol

2024-11-22T13:53:58Z

AFries: AFries moved page USB protocol to USB Protocol

== Introduction ==

The USB protocol is a cornerstone of modern computer communication, offering high flexibility and universal compatibility with a wide range of devices. However, this versatility comes with significant security risks. This document provides an overview of the USB protocol, highlighting its key features, such as composite device support and device enumeration. It also explores the associated security threats, including malware transmission, abuse of HID devices, and vulnerabilities due to unencrypted data transmission. By examining these aspects, the document sheds light on the balance between functionality and security in USB technology.

== Protocol ==

The USB protocol is characterized by its high flexibility, particularly in its support for so-called composite devices. Composite devices can contain multiple configurations and interfaces, with each interface functioning as an independent unit. A typical example is a USB headset, which features a configuration that includes four interfaces: a keyboard for volume control, a microphone, and two speakers. This flexibility enables various functions to be combined into a single USB device.

=== General Class Specifications ===

Since the introduction of USB 1.0, the concept of "Common Class Specifications" has been established to standardize various types of peripheral devices. A USB class is a group of one or more interfaces that collectively provide enhanced functionality. One of the most well-known classes is the "Human Interface Device" (HID) class, which allows the USB host controller to communicate with input devices such as keyboards and mice. Another significant class is the USB Mass Storage class, which defines how data is transferred between the host and storage devices.

Composite devices combine multiple classes to provide more comprehensive functionality. For example, a USB headset can utilize both the HID class and the Audio class to support input and output functions. While this design principle has increased the flexibility of the USB protocol, it has also introduced security challenges.

=== USB Device Enumeration ===

When a USB device is connected to a host system, the USB host controller detects the presence of the device and its transfer speed by monitoring voltage changes on the data pins. This triggers the process known as enumeration, which involves identifying and configuring the device. The process begins with the GetDeviceDescriptors command, where the host queries the device for identification information such as the manufacturer, Vendor ID (VID), Product ID (PID), and serial number.

After querying, the host controller resets the device and assigns it an address for future communication. This is followed by a GetConfigDescriptors request to retrieve all available configurations of the device. USB devices can have one or more configurations, but only one configuration can be active at a time. Each configuration may include one or more interfaces, which are identified through the GetInterfaceDescriptors request. These interfaces represent the essential functional units handled by different drivers within the operating system. After completing these steps, the operating system loads the appropriate drivers, and device-specific subprotocols (e.g., HID, Storage) are activated.

== Security threads ==

USB devices pose a significant security risk because, despite their widespread use, they offer low security. A particular risk with USB devices is USB sticks, which are often used as carriers for malware such as viruses, worms, and Trojans. This malware can spread easily since USB sticks can be quickly exchanged between different computers. A well-known example of a vulnerability is the AutoRun feature in older versions of Windows, especially Windows XP. This feature allowed USB devices to automatically start programs as soon as they were connected to a computer. While this was often used to install drivers, it was also exploited to execute malware unnoticed. In later versions of Windows, this feature was significantly restricted to minimize the risk.

Another serious risk with USB devices is the possibility of abusing HID (Human Interface Device) devices. Since HID devices are considered trustworthy, they can easily be used as an attack vector. For instance, a manipulated USB device can impersonate a keyboard and execute malicious inputs unnoticed to steal data or install malware. Such attacks, like those carried out using the O.MG Cable, exploit the fact that most operating systems trust HID devices and automatically grant them rights for user inputs. These attacks allow adversaries to execute commands undetected and gain access to sensitive data, posing significant security and privacy risks.

Another major problem with USB technology is the lack of encryption for data transmission. The data transferred between USB devices and the host computer is sent in plaintext, making it vulnerable to passive eavesdropping attacks. Attackers can intercept the data traffic on the bus line with relatively simple methods and capture sensitive information. Keyboards are particularly vulnerable since they are often used to input sensitive data, such as passwords.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

File:USB enumeration procedure.png

2024-11-22T13:53:00Z

AFries: This file describes the enumeration procedure of a USB connection.

== Summary ==
This file describes the enumeration procedure of a USB connection.

USB Protocol

2024-11-22T13:49:28Z

AFries:

== Introduction ==

The USB protocol is a cornerstone of modern computer communication, offering high flexibility and universal compatibility with a wide range of devices. However, this versatility comes with significant security risks. This document provides an overview of the USB protocol, highlighting its key features, such as composite device support and device enumeration. It also explores the associated security threats, including malware transmission, abuse of HID devices, and vulnerabilities due to unencrypted data transmission. By examining these aspects, the document sheds light on the balance between functionality and security in USB technology.

== Protocol ==

The USB protocol is characterized by its high flexibility, particularly in its support for so-called composite devices. Composite devices can contain multiple configurations and interfaces, with each interface functioning as an independent unit. A typical example is a USB headset, which features a configuration that includes four interfaces: a keyboard for volume control, a microphone, and two speakers. This flexibility enables various functions to be combined into a single USB device.

=== General Class Specifications ===

Since the introduction of USB 1.0, the concept of "Common Class Specifications" has been established to standardize various types of peripheral devices. A USB class is a group of one or more interfaces that collectively provide enhanced functionality. One of the most well-known classes is the "Human Interface Device" (HID) class, which allows the USB host controller to communicate with input devices such as keyboards and mice. Another significant class is the USB Mass Storage class, which defines how data is transferred between the host and storage devices.

Composite devices combine multiple classes to provide more comprehensive functionality. For example, a USB headset can utilize both the HID class and the Audio class to support input and output functions. While this design principle has increased the flexibility of the USB protocol, it has also introduced security challenges.

=== USB Device Enumeration ===

When a USB device is connected to a host system, the USB host controller detects the presence of the device and its transfer speed by monitoring voltage changes on the data pins. This triggers the process known as enumeration, which involves identifying and configuring the device. The process begins with the GetDeviceDescriptors command, where the host queries the device for identification information such as the manufacturer, Vendor ID (VID), Product ID (PID), and serial number.

After querying, the host controller resets the device and assigns it an address for future communication. This is followed by a GetConfigDescriptors request to retrieve all available configurations of the device. USB devices can have one or more configurations, but only one configuration can be active at a time. Each configuration may include one or more interfaces, which are identified through the GetInterfaceDescriptors request. These interfaces represent the essential functional units handled by different drivers within the operating system. After completing these steps, the operating system loads the appropriate drivers, and device-specific subprotocols (e.g., HID, Storage) are activated.

== Security threads ==

USB devices pose a significant security risk because, despite their widespread use, they offer low security. A particular risk with USB devices is USB sticks, which are often used as carriers for malware such as viruses, worms, and Trojans. This malware can spread easily since USB sticks can be quickly exchanged between different computers. A well-known example of a vulnerability is the AutoRun feature in older versions of Windows, especially Windows XP. This feature allowed USB devices to automatically start programs as soon as they were connected to a computer. While this was often used to install drivers, it was also exploited to execute malware unnoticed. In later versions of Windows, this feature was significantly restricted to minimize the risk.

Another serious risk with USB devices is the possibility of abusing HID (Human Interface Device) devices. Since HID devices are considered trustworthy, they can easily be used as an attack vector. For instance, a manipulated USB device can impersonate a keyboard and execute malicious inputs unnoticed to steal data or install malware. Such attacks, like those carried out using the O.MG Cable, exploit the fact that most operating systems trust HID devices and automatically grant them rights for user inputs. These attacks allow adversaries to execute commands undetected and gain access to sensitive data, posing significant security and privacy risks.

Another major problem with USB technology is the lack of encryption for data transmission. The data transferred between USB devices and the host computer is sent in plaintext, making it vulnerable to passive eavesdropping attacks. Attackers can intercept the data traffic on the bus line with relatively simple methods and capture sensitive information. Keyboards are particularly vulnerable since they are often used to input sensitive data, such as passwords.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

USB Security

2024-11-22T13:42:29Z

AFries: AFries moved page USB Security to USB protocol

#REDIRECT [[USB protocol]]

USB Protocol

2024-11-22T13:42:29Z

AFries: AFries moved page USB Security to USB protocol

== Introduction ==

Description what this documentation is about.

== Security threads ==

USB-Geräte stellen ein großes Sicherheitsrisiko dar, weil sie trotz ihrer weiten Verbreitung eine geringe Sicherheit bieten. Ein besonderes Risiko bei USB-Geräten ist der USB-Stick. Dieser wird häufig als Träger von Schadsoftware wie Viren, Würmern und Trojanern missbraucht. Diese Schadsoftware kann sich leicht verbreiten, da USB-Sticks einfach zwischen verschiedenen Computern ausgetauscht werden können. Ein bekanntes Beispiel für eine Schwachstelle ist die AutoRun-Funktion in älteren Windows-Versionen, insbesondere Windows XP. Diese Funktion ermöglichte es USB-Geräten, Programme automatisch zu starten, sobald sie an einen Computer angeschlossen wurden. Dies wurde häufig genutzt, um Treiber zu installieren, aber auch, um unbemerkt Schadsoftware auszuführen. In späteren Windows-Versionen wurde diese Funktion jedoch stark eingeschränkt, um das Risiko zu minimieren.

Ein weiteres ernsthaftes Risiko bei USB-Geräten besteht in der Möglichkeit, HID-Geräte zu missbrauchen. Da HID-Geräte vertrauenswürdig erscheinen, können sie leicht als Angriffsvektor genutzt werden. Beispielsweise kann ein manipuliertes USB-Gerät als Tastatur auftreten und unbemerkt schädliche Eingaben ausführen, um Daten zu stehlen oder Malware zu installieren. Diese Angriffe, wie etwa das O.MG Cable, nutzen die Tatsache aus, dass die meisten Betriebssysteme HID-Geräten vertrauen und ihnen automatisch Rechte für Benutzereingaben einräumen. Durch solche Angriffe können Angreifer unbemerkt Befehle ausführen und Zugang zu sensiblen Daten erlangen, was erhebliche Sicherheits- und Datenschutzrisiken birgt.

Ein weiteres Hauptproblem bei der USB-Technologie ist zudem die fehlende Verschlüsselung des Datenverkehrs. Die Datenübertragung zwischen USB-Geräten und dem Host-Rechner erfolgt im Klartext, was sie für passive Abhörangriffe anfällig macht. Angreifer können mit relativ einfachen Mitteln den Datenverkehr auf der Busleitung mitschneiden und sensible Informationen abfangen. Dabei stellt die Tastatur die größte Gefährdung dar, weil sie häufig zur Eingabe sensibler Daten, wie etwa Passwörter, verwendet wird.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

USB Protocol

2024-11-22T13:41:54Z

AFries:

USB Protocol

2024-11-22T13:37:26Z

AFries: Created page with "== Introduction == Description what this documentation is about. == USB protocol == Das USB-Protokoll zeichnet sich durch seine hohe Flexibilit¨at aus, die sich insbeson- dere in der Unterst¨utzung sogenannter Kompositger¨ate zeigt. Kompositger¨ate k¨onnen mehrere Konfigurationen und Schnittstellen enthalten, wobei jede Schnittstelle als eigenst¨andige Einheit fungiert. Ein typisches Beispiel ist ein USB-Headset, das eine Konfiguration aufweist, welche wiederum..."

== Introduction ==

Description what this documentation is about.

== USB protocol ==

Das USB-Protokoll zeichnet sich durch seine hohe Flexibilit¨at aus, die sich insbeson-
dere in der Unterst¨utzung sogenannter Kompositger¨ate zeigt. Kompositger¨ate k¨onnen
mehrere Konfigurationen und Schnittstellen enthalten, wobei jede Schnittstelle als
eigenst¨andige Einheit fungiert. Ein typisches Beispiel ist ein USB-Headset, das eine
Konfiguration aufweist, welche wiederum vier Schnittstellen umfasst: eine Tastatur zur
Lautst¨arkeregelung, ein Mikrofon und zwei Lautsprecher. Diese Flexibilit¨at erm¨oglicht
es, verschiedene Funktionen in einem einzigen USB-Ger¨at zu kombinieren. Allgemeine
Klassenspezifikationen
Seit der Einf¨uhrung von USB 1.0 wurde das Konzept der ”Common Class Specifi-
cations” etabliert, um eine Standardisierung verschiedener Arten von Peripherieger¨aten
zu gew¨ahrleisten. Eine USB-Klasse ist eine Gruppe von einer oder mehreren Schnittstellen,
die zusammen eine erweiterte Funktionalit¨at bieten. Eine der bekanntesten Klassen ist
die ”Human Interface Device” (HID) Klasse, die es dem USB-Hostcontroller erm¨oglicht,
mit Eingabeger¨aten wie Tastaturen und M¨ausen zu kommunizieren. Eine weitere be-
deutende Klasse ist die USB-Massenspeicherklasse, die definiert, wie Daten zwischen
dem Host und Speicherger¨aten ¨ubertragen werden.
4
Chapter 2. Technischer Hintergrund
Kompositger¨ate kombinieren mehrere Klassen, um eine umfassendere Funktion-
alit¨at zu bieten. Beispielsweise kann ein USB-Headset sowohl die HID-Klasse als auch
die Audioklasse nutzen, um sowohl Eingaben als auch Audioausgaben zu erm¨oglichen.
Dieses Designprinzip, bei dem USB-Peripherieger¨ate durch die Kombination mehrerer
Klassen geschaffen werden, hat nicht nur die Flexibilit¨at des USB-Protokolls erh¨oht,
sondern auch Sicherheitsherausforderungen mit sich gebracht.
Nach dem Anschluss eines USB-Ger¨ats an ein Hostsystem erkennt der USB-Hostcontroller
die Anwesenheit des Ger¨ats und dessen ¨Ubertragungsgeschwindigkeit, indem er die
Spannungs¨anderungen an den Datenpins ¨uberpr¨uft. Daraufhin beginnt die sogenannte
Enumeration, eine Prozedur zur Identifikation und Konfiguration des Ger¨ats. Dieser
Prozess startet mit dem Befehl GetDeviceDescriptors, bei dem der Host nach Identi-
fikationsinformationen des Ger¨ats fragt, wie beispielsweise Hersteller, Vendor ID (VID),
Produkt ID (PID) und Seriennummer.
Nach der Abfrage setzt der Hostcontroller das Ger¨at zur¨uck und weist ihm eine
Adresse f¨ur die zuk¨unftige Kommunikation zu. Anschließend erfolgt eine GetConfigDescriptors-
Anfrage, um alle verf¨ugbaren Konfigurationen des Ger¨ats abzurufen. USB-Ger¨ate
k¨onnen eine oder mehrere Konfigurationen haben, wobei jedoch immer nur eine Konfig-
uration aktiv sein kann. Jede Konfiguration kann eine oder mehrere Schnittstellen en-
thalten, die ¨uber die GetInterfaceDescriptors-Anfrage ermittelt werden. Diese Schnittstellen
repr¨asentieren die essenziellen funktionalen Einheiten, die von verschiedenen Treibern
im Betriebssystem bedient werden. Nach Abschluss dieser Anfrage l¨adt das Betrieb-
ssystem die entsprechenden Treiber und ger¨atespezifische Subprotokolle (z. B. HID,
Storage) treten in Betrieb.

== Security threads ==

USB-Ger¨ate stellen ein großes Sicherheitsrisiko da, weil sie trotz ihrer weiten verbre-
itung eine geringe Sicherheit bieten. Ein besonderes Risiko bei USB-Ger¨aten ist der
USB-Stick. Er wird h¨aufig als Tr¨ager von Schadsoftware wie Viren, W¨urmern und
5
Chapter 2. Technischer Hintergrund
Trojanern misbraucht. Diese Schadsoftware kann sich leicht verbreiten, da USB-Sticks
einfach zwischen verschiedenen Computern ausgetauscht werden k¨onnen. Ein bekan-
ntes Beispiel f¨ur eine Schwachstelle ist die AutoRun-Funktion in ¨alteren Windows-
Versionen, insbesondere Windows XP. Diese Funktion erm¨oglichte es USB-Ger¨aten,
Programme automatisch zu starten, sobald sie an einen Computer angeschlossen wur-
den. Dies wurde h¨aufig genutzt, um Treiber zu installieren, aber auch, um unbemerkt
Schadsoftware auszuf¨uhren. In sp¨ateren Windows-Versionen wurde diese Funktion je-
doch stark eingeschr¨ankt, um das Risiko zu minimieren. [SLL21] [TSK+18]
Ein weiteres ernsthaftes Risiko bei USB-Ger¨aten besteht in der M¨oglichkeit, HID-
Ger¨ate zu missbrauchen. Da HID-Ger¨ate vertrauensw¨urdig erscheinen, k¨onnen sie
leicht als Angriffsvektor genutzt werden. Beispielsweise kann ein manipuliertes USB-
Ger¨at als Tastatur auftreten und unbemerkt sch¨adliche Eingaben ausf¨uhren, um Daten
zu stehlen oder Malware zu installieren. Diese Angriffe, wie etwa das O.MG Cable,
nutzen die Tatsache aus, dass die meisten Betriebssysteme HID-Ger¨aten vertrauen
und ihnen automatisch Rechte f¨ur Benutzereingaben einr¨aumen. Durch solche An-
griffe k¨onnen Angreifer unbemerkt Befehle ausf¨uhren und Zugang zu sensiblen Daten
erlangen, was erhebliche Sicherheits- und Datenschutzrisiken birgt. [SSN+23]
Ein weitere Hauptprobleme bei der USB-Technologie ist zudem die fehlende Ver-
schl¨usselung des Datenverkehrs. Die Daten¨ubertragung zwischen USB-Ger¨aten und
dem Host-Rechner erfolgt im Klartext, was sie f¨ur passive Abh¨orangriffe anf¨allig macht.
Angreifer k¨onnen mit relativ einfachen Mitteln den Datenverkehr auf der Busleitung
mitschneiden und sensible Informationen abfangen.[NLF16] Dabei stellt die Tastertur
die gr¨oßte gef¨ahrdung da, weil sie als eingabe sensible Daten genutz wird z.B von
Passw¨orter

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]