Close
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • Networking

    USB Devices Can Crack Windows

    By
    Paul F. Roberts
    -
    July 22, 2005
    Share
    Facebook
    Twitter
    Linkedin

      Vulnerabilities in USB drivers for Windows could allow an attacker to take control of locked workstations using a specially programmed Universal Serial Bus device, according to an executive from SPI Dynamics, which discovered the security hole.

      The buffer-overflow vulnerabilities could enable an attacker to circumvent Windows security and gain administrative access to a users machine.

      This is just the latest example of a growing danger posed by peripheral devices that use USB (Universal Serial Bus), FireWire and wireless networking connections, which are often overlooked in the search for remotely exploitable security holes, experts say.

      The buffer-overflow flaw is in device drivers that Windows loads whenever USB devices are inserted into computers running Windows 32-bit operating systems, including Windows XP and Windows 2000, said Caleb Sima, chief technology officer and founder of SPI Dynamics.

      SPI is still testing the hole, and hasnt informed Microsoft Corp. about the problem. The company will be demonstrating the vulnerability at this weeks Black Hat Briefings hacker conference in Las Vegas, but will not release details of the security hole, Sima said.

      A spokesperson for Microsofts Security Response Center confirmed that the company has not received a vulnerability report from SPI. The company strongly encouraged any researcher to contact the MSRC if they have a vulnerability to report.

      /zimages/4/28571.gifRead more here about Microsofts Security Response Center and how it creates patches.

      However, the flaw is with USB, not Windows, said David Dewey, a research engineer at SPI. Standards developed by the USB Implementers Forum Inc., the nonprofit corporation that governs USB, dont consider security, he said.

      For example, an attacker who knows of a vulnerability in a USB device driver can program one USB device—say a portable memory stick—to pose as the kind of device that uses the vulnerable driver, then plug the device into the host system and trigger the exploit when the host system loads the flawed driver, said Darrin Barrall, another SPI researcher.

      Flaws in standard USB drivers arent hard to find, either, Dewey and Barrall said. “Like many hardware drivers, USB drivers are written with very little data validation and security awareness. Theyre bare-bones drivers that focus on [speed],” Dewey said.

      Best of all, for attackers, the device drivers run with System-level privileges, giving an attacker full control of the host system once the exploit has been triggered. SPI tested attacks on Windows systems, but any operating system that is USB-compliant is probably vulnerable, he said.

      Researchers at Safend, of Tel Aviv, Israel, have discovered similar holes in USB and other protocols used by peripheral devices, said CEO Gil Sever, demonstrating a USB storage device that is programmed to automatically copy recently accessed files when inserted into a Windows PC.

      Attacks from peripheral devices usually require physical access to the host system, but janitors or contractors can easily exploit such access with a USB attack device, Sever said.

      On Thursday, Safend released a beta version of Safend Protector, which allows companies to lock down or assign security policies to peripheral devices on Windows systems.

      /zimages/4/28571.gifClick here to read an ExtremeTech comparison of Seagates 5GB Pocket Hard Drive and Iomegas 20GB Mini Hard Drive.

      Companies like Microsoft are just beginning to consider the security threat from peripheral devices, even as developments like the USBIFs Wireless USB standard will make it possible to remotely connect to PCs using high-speed, USB-based technology, Sever said.

      But IT administrators, and an increasing number of companies, are waking up to the threat. DeviceLock (formerly SafeLine Inc.) of San Ramon, Calif. and Milan, Italy, and SecureWave S.A. of Luxembourg also sell technology that can secure peripheral or “end point” devices.

      At Baptist Memorial Healthcare Corp., in Memphis, Tenn., IT administrators turned to Safend after some departments in the hospital network, such as Human Resources and Risk Management, started using portable USB “jump” drives to make backup copies of sensitive data after the hospital introduced new desktop systems that did not have floppy drives, said Lenny Goodman, director of the desktop management group at Baptist.

      Goodman initially waited for Microsoft to address the problem by adding better features for controlling peripheral devices into Windows, but has been disappointed by the companys lack of attention to the problem.

      “I was really looking to them to address this issue, but Microsoft feels that this is a hardware issue and doesnt see it as a problem,” he said.

      Baptist, which operates 15 hospitals in Tennessee, Mississippi and Arkansas, has been using Safends USB auditing tool and will be providing users with encrypted, password-protected USB drives to do local backups.

      The hospital is purchasing 6,000 licenses of Safends Port Protector product to block other, unauthorized peripheral devices, including insecure USB drives and iPods, he said.

      /zimages/4/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

      Paul F. Roberts
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×