4

I was just handed a flash drive by a co-worker. When plugged into a windows machine, some logic on the device opens a run dialog, types in a URL letter by letter, and then presses enter in some way to open the website. I can't find a single file on this flash drive. I've put it in a Mac, Ubuntu Linux, and Windows machine - they all say zero files.

Behavior

Mac - Opened up the App store

Linux - Did nothing

Windows 7 - See above

Question

I'd love to be able to see the file(s) that cause this behavior. Basically, I'd like to do it myself. Any ideas?

Improve this question
10
  • If you try it on another Windows machine, does it still do the same?
    – Oded
    Oct 25, 2011 at 19:37
  • Yes, I've tried it on three windows machines - all windows 7.
    – James Hill
    Oct 25, 2011 at 19:38
  • 1
    Have you tried Windows SysInternals' RootkitRevealer ? It may be a very well hidden file ? Also, have you checked with Windows Disk Management tool to see how many drives the USB key has ?
    – Jalayn
    Oct 25, 2011 at 19:48
  • 1
    You'll need a young priest and an old priest...
    – Mark Allen
    Oct 25, 2011 at 21:34
  • 1
    Rootkits must be actually running to work. And I don't know of a cross-platform rootkit. If he cannot see files on Linux, Mac, or Windows, it's cross platform.
    – music2myear
    Oct 25, 2011 at 21:45

6 Answers 6

Reset to default
2

It seems this drive also implements USB keyboard which first emit Super+R and then the URL.

On Linux, you can check it in lsusb output or by going to console (not terminal emulator), starting showkey and then plugging in this device.

Improve this answer
4
  • This seems feasible. Wouldn't it show up as a keyboard then in the device manager?
    – James Hill
    Oct 25, 2011 at 19:50
  • Indeed it would.
    – Adam Maras
    Oct 25, 2011 at 19:57
  • It would probably show as a USB hub with pendrive and keyboard, unless there is some stealth technique used to prevent it (I don't know Windows to well at this level). But try to look if there is any extra HID device.
    – mbq
    Oct 25, 2011 at 19:58
  • Similar device on ThinkGeek.
    – mbq
    Oct 25, 2011 at 20:01
2

USB devices can also be configured to act as a HID (Human Interface Device) such as a keyboard. For more info, check out the USB Rubber Ducky. Many of these types of devices are made from Teensy which can be made to fit inside of a standard thumbdrive case.

Previous to this, there was the USB Switchblade but it requires Autorun in order to work (that's my understanding anyway).

Improve this answer
2

Sounds like a U3 partition is active on the drive. Look for an additional CDRom drive in your drive list (My Computer, for the neophytes). It certainly could autorun something like you're describing. Although the minute it started TYPING something automatically, I would have likely handed it right back to the "friend" who gave it to me. Autorun stuff is evil.

Improve this answer
3
  • Came here to write this same thing - sounds like U3. +1 to you instead. Though I don't have any direct experience with U3 to know whether or not it types things - I wasn't under that impression. The typing does sound lots more like Teensy as linked above. en.wikipedia.org/wiki/U3
    – Mark Allen
    Oct 25, 2011 at 21:31
  • Awful lot of work involved to make a teensy device, and it wouldn't LOOK like a regular flash drive, which would've (hopefully) engaged this guy's curiosity. A standard virtual U3 cdrom with autorun.inf set to run a windowless program to insert characters into keyboard queue is far more plausible. sounds like a marketing gimmick, since it types a URL of some sort. Also, virtual cdrom wouldn't be obvious to most window's users since they're looking for 'removable drive', again not obvious on Mac OSX, additional icon on desktop, and linux would likely just automount it silently.
    – lornix
    Oct 25, 2011 at 21:37
  • This does not explain why AppStore and Run dialog are launched.
    – mbq
    Oct 26, 2011 at 18:49
1

Are you sure it is a usb drive? What you actually are is a gentlemen agreement. The usb device tells you and you can only hope it doesn't lie to you. Then I think you can switch modes and pretend to be something else. It is useful for "self installing devices". You plug it in, then the software auto installs relevant drivers and you are then good to go.

This requires hardware level access to the usb device, so it is rather difficult to propagate as a virus.

Improve this answer
2
  • Can you clarify, "Are you sure it is a usb drive?". It's a 2gb usb drive. I can store files on it and eject it as with any normal usb drive.
    – James Hill
    Oct 25, 2011 at 19:53
  • A USB drive can identify itself as a HID (human interface device) at which point the computer accepts keyboard codes from it as if you were typing.
    – Martin Beckett
    Oct 25, 2011 at 20:41
0

How did you mount the disk when mounting it under Linux?

Assuming that you're dealing with actual files (as opposed to something more interesting, like an infection that sits in the control portion of the circuit), they may be hidden. You could try any of the different ways to enable display of hidden files (configure your machine to show hidden files, extensions, and show system files, or running something like the following on the contents of the disk:

attrib -s -r -h *.*
Improve this answer
0

To reveal hidden files in linux, hit Control+H in most file browsers, or navigate to the folder in the command line and execute ls -a. Or in windows, look for files or folders that start with .

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.