A new security breach has been discovered that attacking mobile memory devices (Memory Flash Drives) and allowing hackers to steal information without being detected.
The bad news: It cannot be blocked…
The good news: Well, there’s no good news…
Many workplaces (particularly government and security sectors) tend to forbid the use of Flash Drives on organization’s computers. The concern of IT managers is that employees would connect their Flash Drive or any other mobile device such as laptop, tablet or smart phone to the internal network of the organization and infect computers and servers with viruses and other malware.
Recently, a new security breach called BadUSB was exposed and even demonstrated as part of hacking and security conference held last week in Kentucky. The demonstration showed how the mobile memory device got infected by “injection” of malicious code into the device firmware, hence the biggest problem is that even re-formatting the memory stick will not help because the code is already embedded in the firmware of the device.
Basically, anyone can overwrite the portable memory drive firmware, and even worse is that quite a few manufacturers use this element. Once inserted to any computer it gets infected and even could infect other mobile devices connected to the computer afterwards. An infected flash drive could produce any keystrokes, modify files, copy files back and forth and even create an invisible partition on the flash drive where it can store all kind of stolen information. Among other things, the conference demonstration showed how you can get the device password without any problems and how you can copy files to an invisible partition.
It is impossible to produce security patch against this breach, because it uses the most basic way in which the USB works, therefore it is very puzzling to me why the demonstrators have uploaded their breach code to the GitHub site, which stores various open source projects. Now the code is available for download by hackers and children alike. On the other hand, they say that they believe “everything must be open and public, nothing should remain a secret”.
Meanwhile, the only solution is to avoid using mobile memory device, something that is not really possible…
