Hiding your data in plain sight: USB hardware hiding

http://www.thice.nl/hide-your-data-in-plain-sight-usb-hardware-hiding/

by chaosmachine • 15 years ago

133 29 15 years ago

lamnk• 15 years ago

If you just want to hide the storage function, why waste the time tinkering with the mouse? I think I've seen an USB stick disguised as an USB extension cable somewhere.

pavel_lishin• 15 years ago

Carrying around and insisting on using your own mouse is more plausible than doing the same with an extension cable.

uxp• 15 years ago

Though probably not the same extension cable he was talking about, it reminded me of this article from back in 2008: http://www.evilmadscientist.com/article.php/usbkey

Which spawned a commercial item that ThinkGeek sold for a time, and Bruce Schneier talked about in this post: http://www.schneier.com/blog/archives/2008/12/disguised_usb_...

tomjen3• 15 years ago

I am not really sure. You can always complain that the mouse you have been issued has too short a cable.

Either they give you a new cable, in which case you can switch them, or you can use your own.

In neither case will anybody think you are actually stealing company stuff.

BlueZeniX• 15 years ago

Isn't it quite easy to block USB storage devices at the OS level? I mean hiding the stick is clever, but it shouldn't really matter. If you only allow HID devices, the mouse still works without getting access to the data on the stick.

dandelany• 15 years ago

Yes, but that isn't necessarily a good enough safeguard. See bigiain's comment about the USB Rubber Ducky... It would take more than a simple USB stick, but a device like that could disguise itself as a keyboard or mouse. Even if you blocked new disk volumes or something, a device emulating a keyboard could send keyboard signals to, say, open a terminal and copy files to/from a remote location.

wnight3• 15 years ago

You could use a keyboard as a data-storage device. Simply cat stdin into a file. That file would be a two-way communication program using the Caps Lock and other status lights for the reverse link. At that point it's as good as a drive, but slower.

justincormack• 15 years ago

A keyboard device that sends keystrokes to download malware is mentioned here https://media.blackhat.com/bh-dc-11/Larimer/BlackHat_DC_2011...

Its a good overview of usb malicious devices from the software side.

bigiain• 15 years ago

http://hakshop.com/products/usb-rubber-ducky

That'll probably fit into a suitably modified _cable_...

rlpb2• 15 years ago

Very nice! It doesn't feel to me that it's really hidden though, since plugging it in will give everything away.

How about a hidden switch on the mouse without which the USB stick isn't connected to the hub? Or how about a mercury switch that will only connect the USB stick when the mouse is upside-down? Not quite as good but less likely to be detected.

kabdib• 15 years ago

In principle you could do even more clever things, such as powering up ports on the hub based on external conditions, or timing, or counters. The sky's the limit.

Imagine a storage device that only enumerated when it was upside down, or in darkness, or at 2:30AM-2:35AM on Thursdays, or at just above freezing?

I wonder how large the market for something like this is?

jballanc• 15 years ago

Ok, you got me thinking and now I have to assume that someone must have already thought this up, because it would be so immensely useful! Imagine a USB key that behaves like a normal USB key, but if you invert it exactly 3 times in < 10s, then it activates a secondary storage partition. Put mundane family photos or music or such on the first portion, secret documents on the secondary. Sure, someone could disassemble the device to discover the hidden documents, but the point is that most people, after inserting the device and finding the photos and music, would just discard it as uninteresting...

dekz• 15 years ago

Hopefully they don't struggle plugging it in and accidentally rotate 3 times in that time frame, but your point is still valid. Also encrypt with truecrypt and this gets very interesting.

shabble3• 15 years ago

Stick an accelerometer on there, and detect spikes corresponding to someone tapping the device. Then implement some sort of rhythm-based security as desired :)

Turning it around would be pretty hard if it's plugged into a PC, and it can't really do the sensing unplugged unless it's got some sort of internal power, but tap-detection should be fairly robust.

You'd probably want to have it remain in whatever secret-mode until unplugged, to stop spurious jolts from accidentally un/re-mounting it (unless you're really paranoid)

Zash• 15 years ago

But then you need a battery or something. How about switching to the secondary memory if you plug it in, pull it out and plug it in again? Then you might be able to get away with a small capacitor that would get charged on the first connection, and could activate secondary paths afterwards.

wnight3• 15 years ago

Darkness is good... If someone was ransacking your apartment/work they'd need light. In places you wouldn't, like the server closets.

A timeout would be good - like the backup drive won't appear until the lights have been off for six hours. Name the server 'mouse' or something appropriately timid.

bajsejohannes• 15 years ago

I really like this idea, as well as the others in this thread. One minor problem with them is that you would always see the usb hub, which is pretty weird for a mouse. It makes it go from completely invisible, to suspicious - granted that someone is looking very carefully.

Of course, most monitors and keyboards these days are USB hubs, so sticking the secret drive in there wouldn't raise suspicion. Come to think of it, a keyboard is a great place to put it; you could enter a passphrase on the keyboard to unlock the hidden drive.

shabble3• 15 years ago

By strange coincidence, this (http://i.imgur.com/N9yRX.jpg) just turned up on reddit.[1] Someone hacked some flash memory and a USB hub inside a game controller, to carry the games and emulators.

[1] http://www.reddit.com/r/gaming/comments/l58zi/the_games_are_...

Ives• 15 years ago

Not a coincidence, the TS of that topic states

[–]drwicked[S] 219 punten 18 uur geleden* Inspired by this Hiding your data in plain sight – USB hardware hiding [cut]

shabble3• 15 years ago

There's a guy building a USB thumb-drive type device called the ISOStick (http://blog.elegantinvention.com/?cat=5) which appears to be both a normal storage drive, but also emulates an optical drive containing a virtual disk specified by iso/file images on the usb-storage device.

http://blog.elegantinvention.com/?p=117 has a few more details, but the plan is to have a whole bunch of isos stored on there, and a bootloader/config setup to allow you to choose which appears mounted as the virtual CD.

rlpb2• 15 years ago

I use one of these, which is eseentially a hard drive version of what you describe: http://www.reghardware.com/2011/09/05/geek_treat_of_the_week...

It works fine, though I've found the menu selection UI a bit dodgy, it requires NTFS (a FAT32 firmware is available but that can't do DVD-size ISOs), and there seems to be an unknown limit to the number of ISOs at which point it breaks and needs eSATA to recover (disk mode USB doesn't work either). But it's the only similar thing i know of that's available now, and it gets the job done.

SurfScore• 15 years ago

I'm reminded of the battery hacking issue with the macbooks, even though it wasn't USB. I fear that there are a lot more security concerns with this than anything else. Devices are getting more compact, more all-in-one (the iPad doesn't need a mouse), so I'm not sure how long there will even be much practical use for this...except to hide your porn in your mouse I guess...

dewiz• 15 years ago

just plug in your ipod with the excuse of power charging it. no one is going to complain, the ipod is considered just a player by common people, e.g. your managers. the truth is that you are plugging in 8Gb or more of free disk space.

and while you steal data, you can also listen to your favourite music!

p.s. this comment text box is unusable with an ipad!

ksolanki2• 15 years ago

The best way, if you really want to hide data, is steganography. Embed the information into innocent looking pictures and video. The trick, of course, would be to either download decoding software or upload somewhere when you want access the hidden data.

Mvandenbergh• 15 years ago

Steganography is only useful when no-one knows to look for it, if they do it is trivial to detect.

ksolanki2• 15 years ago

Not really trivial to detect steganography. There is whole body of work that focus on statistically undetectable data hiding [1]. Much of it is in confines of research labs, but it is still feasible.

[1] http://scholar.google.com/scholar?hl=en&q=secure+stegano...

Hiding your data in plain sight: USB hardware hiding

Related Stories