Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Three weeks ago my company ordered a lot of hardware (real hardware, not IT-related) from China.

Today, the warehouse girl comes to my office and says that, mixed in the stuff, she found a white USB drive saying "Lihuiyu Studio Labs 2012.10.25"

usb drive

Curious, I had a reaction like "YAY! A free USB drive! Let's see what's inside!" and stupidly plugged in my main machine, and I was shocked to discover that it's detected as an USB HID and keyboard.

Paralyzed from the shock, I waited 20-30 seconds before removing it.

Nothing happened on screen, an USB Rubber Ducky-like device should show something on screen, right? There is no way that it has compromised our company system with some lightspeed commands impossible to see at naked eye, right?

Primary question:

There is nothing that could be done to protect Windows systems from USB devices like this?

We need to plug hundreds of different USB drives every week, so removing/disabling USB support is not an option

Secondary question:

How I could see what this USB device is really doing?

share|improve this question
3  
In theory, if auto-run is disabled (I think it should be by default) then I guess it should be difficult for it do anything that nefarious. Therefore, if it is some sort of key logger then presumably it would not be able to 'phone home' and would require someone to recover it. If it is detected as a HID/Keyboard then in theory it may just be a wireless keyboard/mouse receiver, although it does look more like a flash drive. If you were to open it up and send the pictures to an electronics expert then they might be able to hazard a guess about what it actually is. –  James Dec 12 '12 at 11:55
4  
If it's a programmed keyboard, no matter if autorun is diasbled, it can run any command AND bypass UAC –  Magnetic_dud Dec 12 '12 at 12:32
1  
But the effects of those commands would surely be visible, would they not? The OP said that he didn't see anything appear on the screen. –  James Dec 12 '12 at 12:46
1  
@James, why in the world would they be visible? A command can delete files, create them, send emails, open a backdoor to your system. None of this would cause a window to pop up on your screen. –  terdon Dec 12 '12 at 13:43
7  
A USB Rubber Ducky is a USB HID device with which "anyone is able to craft payloads capable of changing system settings, opening back doors, retrieving data, initiating reverse shells, or basically anything that can be achieved with physical access -- all automated and executed in a matter of seconds." –  RedGrittyBrick Dec 12 '12 at 15:18

3 Answers 3

up vote 3 down vote accepted

There's no danger with inserting this device in your computer. It's just a dongle for a laser engraver software suite named WingraverXP supplied with some budget laser machines. I have one of the machines and it's supplied with an identical USB stick.

share|improve this answer
    
Cool, I got a free dongle for a software for controlling a machine that I don't own :) –  Magnetic_dud Jan 2 '13 at 15:07
4  
Thank goodness no one's invented a way to put more than one type of device into the same type of casing, or to program devices to do more than one thing. –  RobM Mar 1 '13 at 8:36

In a similar vein to what your mother may have told you as a young child about accepting packages from strangers, when you find a strange USB drive in a warehouse filled with Chinese screwdrivers, or whatever it happens to be, do not plug it in to a computer that is part of your company's network. Ever.

That is really the best way of "protecting Windows systems from USB devices like this". Having said that, as James said in the comments, the first and obvious methods of attack would be blocked by turning off the removable drive auto-run feature, but if someone really want to harm a computer, I am sure a talented hacker could do so without the auto-run enabled.

Next time you have a weird USB stick fall from the sky like that and you want to see what it is, you connect it to a computer that is not part of any network, has no internet connection and no critical data.

Now, chances are there is an irate docker somewhere on the shores of China lamenting the loss of his wireless keyboard, nothing nefarious was in the drive and absolutely nothing is wrong with your computer. As a general rule though, you don't connect strange devices to networks.

UPDATE

I don't think there is a way of actually detecting a rubber ducky. The good news is that the best known one does not look like the picture you posted. On the other hand, what the hypothetical USB fowl does depends entirely on its payload and cannot be predicted. There will, therefore, not be a rock solid way of checking since you cannot know beforehand what it attempted to do.

share|improve this answer
    
+1 for wireless keyboard transceiver. –  RedGrittyBrick Dec 12 '12 at 15:15

If your drive really identifies as a keyboard, the safest way to determine which keystrokes it sends, is probably a hardware USB keyboard logger. You can get those all over the internet, just google "usb keyboard logger".

Of course, this does not prevent the unidentified device from actually sending keystrokes to the system you are plugging it into, so you should not do this on a production system.

Since you probably don't want to disable support for USB HID and keyboard devices, I don't think there is anything you can do to prevent such attacks, other than not plugging untrusted devices into your machine.

EDIT: Since I am unable to comment on the other answers: Disabling auto run only prevents the automatic execution of files on the connected USB drive. However, if this device identifies as a keyboard, it will likely send keystrokes and not offer you files. Disabling auto run does not protect you against keystrokes.

share|improve this answer

protected by Community Aug 20 '13 at 10:26

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.