Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was just handed a flash drive by a co-worker. When plugged into a windows machine, some logic on the device opens a run dialog, types in a URL letter by letter, and then presses enter in some way to open the website. I can't find a single file on this flash drive. I've put it in a Mac, Ubuntu Linux, and Windows machine - they all say zero files.

Behavior

Mac - Opened up the App store

Linux - Did nothing

Windows 7 - See above

Question

I'd love to be able to see the file(s) that cause this behavior. Basically, I'd like to do it myself. Any ideas?

share|improve this question

migrated from programmers.stackexchange.com Oct 25 '11 at 20:37

This question came from our site for professional programmers interested in conceptual questions about software development.

    
If you try it on another Windows machine, does it still do the same? –  Oded Oct 25 '11 at 19:37
    
Yes, I've tried it on three windows machines - all windows 7. –  James Hill Oct 25 '11 at 19:38
1  
Have you tried Windows SysInternals' RootkitRevealer ? It may be a very well hidden file ? Also, have you checked with Windows Disk Management tool to see how many drives the USB key has ? –  Jalayn Oct 25 '11 at 19:48
1  
You'll need a young priest and an old priest... –  Mark Allen Oct 25 '11 at 21:34
1  
Rootkits must be actually running to work. And I don't know of a cross-platform rootkit. If he cannot see files on Linux, Mac, or Windows, it's cross platform. –  music2myear Oct 25 '11 at 21:45
show 5 more comments

6 Answers

It seems this drive also implements USB keyboard which first emit Super+R and then the URL.

On Linux, you can check it in lsusb output or by going to console (not terminal emulator), starting showkey and then plugging in this device.

share|improve this answer
    
This seems feasible. Wouldn't it show up as a keyboard then in the device manager? –  James Hill Oct 25 '11 at 19:50
    
Indeed it would. –  Adam Maras Oct 25 '11 at 19:57
    
It would probably show as a USB hub with pendrive and keyboard, unless there is some stealth technique used to prevent it (I don't know Windows to well at this level). But try to look if there is any extra HID device. –  mbq Oct 25 '11 at 19:58
    
Similar device on ThinkGeek. –  mbq Oct 25 '11 at 20:01
add comment

USB devices can also be configured to act as a HID (Human Interface Device) such as a keyboard. For more info, check out the USB Rubber Ducky. Many of these types of devices are made from Teensy which can be made to fit inside of a standard thumbdrive case.

Previous to this, there was the USB Switchblade but it requires Autorun in order to work (that's my understanding anyway).

share|improve this answer
add comment

Sounds like a U3 partition is active on the drive. Look for an additional CDRom drive in your drive list (My Computer, for the neophytes). It certainly could autorun something like you're describing. Although the minute it started TYPING something automatically, I would have likely handed it right back to the "friend" who gave it to me. Autorun stuff is evil.

share|improve this answer
    
Came here to write this same thing - sounds like U3. +1 to you instead. Though I don't have any direct experience with U3 to know whether or not it types things - I wasn't under that impression. The typing does sound lots more like Teensy as linked above. en.wikipedia.org/wiki/U3 –  Mark Allen Oct 25 '11 at 21:31
    
Awful lot of work involved to make a teensy device, and it wouldn't LOOK like a regular flash drive, which would've (hopefully) engaged this guy's curiosity. A standard virtual U3 cdrom with autorun.inf set to run a windowless program to insert characters into keyboard queue is far more plausible. sounds like a marketing gimmick, since it types a URL of some sort. Also, virtual cdrom wouldn't be obvious to most window's users since they're looking for 'removable drive', again not obvious on Mac OSX, additional icon on desktop, and linux would likely just automount it silently. –  lornix Oct 25 '11 at 21:37
    
This does not explain why AppStore and Run dialog are launched. –  mbq Oct 26 '11 at 18:49
add comment

Are you sure it is a usb drive? What you actually are is a gentlemen agreement. The usb device tells you and you can only hope it doesn't lie to you. Then I think you can switch modes and pretend to be something else. It is useful for "self installing devices". You plug it in, then the software auto installs relevant drivers and you are then good to go.

This requires hardware level access to the usb device, so it is rather difficult to propagate as a virus.

share|improve this answer
    
Can you clarify, "Are you sure it is a usb drive?". It's a 2gb usb drive. I can store files on it and eject it as with any normal usb drive. –  James Hill Oct 25 '11 at 19:53
    
A USB drive can identify itself as a HID (human interface device) at which point the computer accepts keyboard codes from it as if you were typing. –  Martin Beckett Oct 25 '11 at 20:41
add comment

How did you mount the disk when mounting it under Linux?

Assuming that you're dealing with actual files (as opposed to something more interesting, like an infection that sits in the control portion of the circuit), they may be hidden. You could try any of the different ways to enable display of hidden files (configure your machine to show hidden files, extensions, and show system files, or running something like the following on the contents of the disk:

attrib -s -r -h *.*
share|improve this answer
add comment

To reveal hidden files in linux, hit Control+H in most file browsers, or navigate to the folder in the command line and execute ls -a. Or in windows, look for files or folders that start with .

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.