I recently received a USB drive that looks like a credit card as a promotion. The drive portion flips out to plug it in. When you plug it in, it opens the run dialog, and opens a URL to an American Express web page.

I was able to find it in the Device Manager:

American Express Drive in Device Manager

But I don't know what else to do? Is there a way I can convert this into a plain old USB drive? Or better yet, can I modify the command that it runs when inserted into a computer?

American Express USB Drive Open

American Express USB Drive Closed

Pretty cool huh!? Kudos to American Express for creating a cool marketing device! (That I can hopefully hack!)

  • 2
    Very cool - I'll bet the answer is yes. Do you have a picture of the card? – Jared Harley Apr 17 '10 at 0:50
  • I'll try and add one soon, I thought about it, but was too lazy when I asked the question. Just ate >.< – John Bubriski Apr 17 '10 at 1:04
  • 2
    haha, favoriteing for picture! – marcusw Apr 17 '10 at 1:05
  • Added pictures! – John Bubriski Apr 17 '10 at 1:25
  • 1
    A USB connector does not necessarily indicate presence of a drive. Are you sure it's a drive? – Ignacio Vazquez-Abrams Apr 17 '10 at 1:42

Pop open the device properties, and post the device VID and PID (vendorID and partID)

Device Manager -> Properties -> "Details Tab" -> "Device Instance ID" in the dropdown box.

It should be something like:
HID\VID_1532&PID_000D\6&28F03F61&0&0000 (In this case, it's a Razer Mouse)

The VID and PID are (Ideally) unique, so it should let you find who made the usb interface hardware, unless it's a really cheap Chinese product. I'd assume for something like this, the USB interface is going to be integrated into whatever microprocessor they have in there (it's cheaper), so knowing the device make will be a start.

http://www.linux-usb.org/usb.ids Has a pretty extensive list of IDs. If not, google for VID_<number> and see what you get.

(Post it and let us know, too! I'm curious.)

  • This is the Device Instance Path is: USB\VID_05AC&PID_020B\5&24741791&0&1 – John Bubriski Apr 17 '10 at 15:50
  • 1
    Hmmm, 05AC is Apple's VID! Specifically, it's for Pro Keyboard [Mitsumi, A1048/US layout]. Looks like they're spoofing someone else's VID and PID. Short of actually taking the thing apart to get a look at the chip inside, I think you're out of luck. – Fake Name Apr 17 '10 at 22:57
  • I got one of these too, but mine was VID_05ac and PID_6662. PID 6662 doesn't seem to be mapped anywhere. – Ryan McGeary May 25 '15 at 2:43

You might be able to reprogram it, if a) it had memory that could be reprogrammed, and b) you knew the protocol to access it. But the truth is probably that it just emulates a keyboard and "pushes" the buttons needed to drive Windows around, without actually having any brains whatsoever.

  • 6
    That would explain why it's a Human Interface Device instead of a mass storage (i.e. flash drive) device. – Wayne Johnston Apr 17 '10 at 2:35
  • So do you think it would be possible to reprogram it without physically cracking it open? – John Bubriski Apr 17 '10 at 15:52
  • ... Maybe? It depends on so many things that you don't know. – Ignacio Vazquez-Abrams Apr 17 '10 at 16:21

It consists of a Cypress PSoC controller, combined with a 24c02 serial eeprom.

The eeprom contains the data regarding the featured website, whilst the uController takes care of all USB protocols and other communications with the PC. It retrieves the data from the eeprom and sends it to the keyboard buffer of your PC.

With a simple program called PonyProg you can read and modify the contents of the eeprom.

  • 1
    Interesting... but would I be able to modify it directly over USB, or would I need to connect to it via other means in order to access the EEPROM? – John Bubriski Jan 6 '11 at 17:13
  • 'simple' ?!!!! ! – Simon May 20 '14 at 22:45
  • "It consists of a Cypress PSoC controller, combined with a 24c02 serial eeprom." How do we confirm this? – Ryan McGeary May 25 '15 at 2:41

It could be a USB drive. There are some credit card size drives available like this. The pricing suggests they wouldn't be giving them away though. This one looks just like the one you have with the printing done the opposite way up. Googling MMI 1028FMS will turn up a bunch of sites with exactly the same image and text. None of them have pricing though. I think this might made by Hongkong Dazhihui Electronics.

I think Ignacio is right. This isn't a USB drive, but a cheaper product in the same package.

This article looks promising:

Hacking USB Webkeys

The brains of the Webkey is all stuffed into a tiny chip that fits into your USB port. If you pop that chip out of its casing and peel off the glue, you'll get something like this. The part number of this particular Webkey is "WEB-130C".

JJShortcut wrote up a great article describing how to reprogram the EEPROM of a specific Webkey he encountered. My Webkey is a little bit different, so first I’ll go over this same method with a little more detail and specifics with the Webkey I have.

The very first thing you’ll notice on the board is the EEPROM. If you have good eyes (or a magnifying glass) you’ll see that it’s marked “J24C02C” on one line, and “DP1D07” on the next. That’s our target.

  • Could you edit your answer to include at least a brief summary of the link? Link only answers don't tell the user very much, and are also no use if the linked page disappears in the future. – nhinkle May 25 '15 at 4:56
  • This is interesting in itself, but doesn't really answer the question ("can it be repurposed as a USB drive"). I note with interest how dangerous these devices are since people think they are a USB drive when they can actually run code at at least the privilege-level of the logged-in user, and can answer prompts. Turns a convention full of freebies into a potential security issue. – Yorik May 26 '15 at 17:53

Short answer: No Long answer: Yes

Short answer: No

What is this thing?

As others have already noted, it doesn't show up as a drive anywhere. But yet it's clearly doing something. Just what is this thing?

This device is what's called a USB Webkey. They are cheaply made devices that are used for marketing by some companies. They consist of a very small amount of storage with data that is loaded at manufacture, a small amount of logic and a USB connector.

Is it not a USB storage device.

How does it work?

When plugged into a computer, the device appears as though it is a keyboard. Once connected, it starts to blindly issue the keyboard strokes that are stored in the device's small amount of storage. You can cause USB Webkeys to screw up by changing the assumptions it relies on. For example, uninstalling or moving the web browser it expected to be available in a certain location or changing your keyboard layout so that the OS interprets the keystrokes differently.

So why can't I program it?

As the device appears to the computer as a simple keyboard, there is no way to override the contents of the storage by simply plugging it into a computer.

Security concerns

By plugging in a USB Webkey, you are effectively allowing the creator to do anything it wants on your computer short of anything that requires a password. A malicious creator could program it to take advantage of security holes to install malware. If a malicious creator is able to figure out the target's computer password beforehand, they could program that into the webkey and gain even more control.

But since we can't reprogram it, if we only plug in webkeys from companies we recognize we're alright, right?

Well....

Long answer: Yes

Even though you can't reprogram the device through the USB interface, the device can be reprogrammed with a little bit of sobering and low-level know-how. By disassembling the device you can gain physical access to the EEPROM chip. From there you can solder wires in to connect it to some probe hardware and start reprogramming it. Just reverse the disassembly and now you have a hacked USB Key ready to do your bidding.

Bottom Line

These things are a neat hack of the USB system. But the access they are granted to systems is potentially dangerous for users and valuable for malicious hackers who have some basic wiring skills.

Don't plug these things into your computer. Ask yourself this: Do you trust American Express or any other company with control over your computer? Even if the original creator is legit, you have no way of knowing if the device hasn't been tampered with. If you must, use a computer that you are able to wipe afterwords.

I did a little bit of research on that and found out that there are different types out there. Sophisticated ones which can be hacked in the sense that you can e.g. change the URL but also cheap ones that are hard coded.

In the case of the latter one not all is lost: You can make use of a redirection tool (like this one: http://requestly.in/) and very easily redirect the page to any page of your choosing.

There are dongles out there that use the same kind of mechanism. I now use mine as a foot pedal to start a tea timer (https://www.google.com/search?q=timer+3+minutes).

So I now literally trample on the logo of a company that ruins the environment with this kind of electronic waste ;-)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.