13
\$\begingroup\$

I worry that this might get flagged as too broad, but here it goes:

Lately I've been thinking about the possibility of loading data on peripheral devices. One of the most used peripherals is the mouse. I realize that there are 101 ways to build a mouse. To refine my question into several, I ask these questions:

  1. Is it possible to build a mouse without memory? If so, is it typically seen not have memory on a mouse?
  2. Suppose the mouse did have memory (if this is not an realistic assumption, please point that out), is it typical to see ROM types of memory only? Can the memory be flashed like CMOS memory?
  3. Has any one seen an computer attack/malware attack from the memory of a mouse?

I ask number three because what I've been thinking of lately is the generalization of the attacks performed by various advanced persistent threats.

\$\endgroup\$
  • \$\begingroup\$ As for 3, I can think of just hooking a USB flash memory with a virus inside the mouse, wiring it to the connector, and voila! \$\endgroup\$ – Eugene Sh. May 15 '15 at 17:38
  • 1
    \$\begingroup\$ @EugeneSh. yeesh, just simply embed flash memory onto the board of a mouse. That is for the most part a non-obvious thing to do because it is out of sight and out of mind. Thanks for sharing. \$\endgroup\$ – StackExchangeUser0xff00 May 15 '15 at 17:41
  • 2
    \$\begingroup\$ Perhaps a better title for your question would be: "Does a USB mouse have memory that could be used to store malware?". I can edit it for you if you'd like. \$\endgroup\$ – Adam Haun May 15 '15 at 17:42
  • 3
    \$\begingroup\$ There's actually a proof of concept code to infect USB devices from your PC published on github: github.com/adamcaudill/Psychson \$\endgroup\$ – slebetman May 15 '15 at 21:05
  • 2
    \$\begingroup\$ No matter what normal mice contain, an attacker (with sufficient resources) can always just make a mouse that does contain what they need. \$\endgroup\$ – Cascabel May 16 '15 at 16:03
12
\$\begingroup\$

Many USB peripherals include flash-based microcontrollers. Although mask-ROM-based microcontrollers are cheaper, use of a flash-based microcontroller may enable a manufacturer to have one board which can go in a variety of OEM products, each of which reports the name under which it is sold. Some peripherals include firmware that allows them to be reprogrammed from the USB port; having them configured that way would allow a manufacturer to pre-program parts in a way suitable for its highest-volume customer and re-program them on demand for other customrs.

If a mouse happens to include a flash microcontroller, it may be possible for a malicious person to reprogram it to behave as a malware-infection device. Because most mice aren't likely to use particularly big microcontrollers, there may not be any room for malware if the mouse is required to be usable as a mouse. On the other hand, it might be possible for some malware to identify a vulnerable mouse and reprogram it in such a way that it would no longer work as a mouse, but would act as an agent of evil when plugged into a non-infected machine [on the theory that someone whose mouse stops working might test it on another computer].

It would in general not be difficult to design a USB peripheral in such a way that once final firmware was loaded it could not be reloaded from the USB port, but there is no general way to distinguish devices which are immune from reprogramming from devices which aren't. It would also be possible to design a "smart USB hub" with a display and some buttons which would, when a device was plugged in, indicate what the device is claiming to be, asking for confirmation before the computer could see the device, and restricting the device's communications to those that were approved for its type, but I don't know if any such smart-hub devices are available.

\$\endgroup\$
  • \$\begingroup\$ There are no such smart hubs, because you can block USB devices at OS level. No additional hardware needed. The problems begin when you want to replace your broken mouse or keyboard... \$\endgroup\$ – Turbo J May 15 '15 at 20:39
  • \$\begingroup\$ @TurboJ: The point is that by then it's probably too late. Imagine a specially designed USB mouse that's actually a micro USB hub connected to the mouse hardware and a hidden thumbdrive inside the mouse (actually you don't have to imagine as proof-of-concept demos has already been shown to the public). The hidden thumb drive mounts and includes AUTOEXEC.BAT file which installs some software. Then you open the control panel and block it but the malware has already been installed. \$\endgroup\$ – slebetman May 15 '15 at 20:57
  • 2
    \$\begingroup\$ A more sophisticated hack is the recent discovery that some USB controllers are hackable - their firmware are stored in flash rather than ROM. This form of attack completely bypasses the OS and installs malware on the USB chip soldered on your motherboard. \$\endgroup\$ – slebetman May 15 '15 at 20:59
  • 2
    \$\begingroup\$ USB devices cannot bypass the OS, they always need a driver first and that step can be blocked (in Linux with udev script, win may need 3rd party software). PCIE devices can bypass the OS via DMA. \$\endgroup\$ – Turbo J May 16 '15 at 2:03
9
\$\begingroup\$

USB keyboards can be used to do interesting things on a PC/Mac. And you could combine an USB keyboard with a mouse into one HID, using a microcontroller for example.

Cheap USB mice should still use ASICs that are not reprogrammable IMHO, because masked ROM costs less than flash.

\$\endgroup\$
4
\$\begingroup\$

Yes, it is definitely possible to use mice (and USB devices in general) in cyber attacks.

Whatever type of memory cheap mice have, it's usually impossible to modify it via the USB interface, so the attacker will need to physically access the mouse which will be used for the attack. As a result, it is usually easier to make a custom device which mimics a mouse and has lots of memory (and perhaps some wireless transcievers) rather than reuse a real mouse which will have little memory, small processing power and no wireless interfaces.

There are devices which are much more suitable for such purposes. For example, most SD cards have quite powerful controllers and the firmware is usually upgradable, protected by a passcode of some sort. Such passcodes are widely known by the dev&testing teams and are not meant to be cryptographically secure. Often leetspeak phrases like DEADBEEF or 600DCOFFEE are used. And once you have control over an SD card, there is no extra effort to get sensitive data, all you have to do is filter it. Similarly, USB keyboards are natural candidates for password stealing. Convincing the computer to send a file or a password to the mouse is much more difficult.

\$\endgroup\$
2
\$\begingroup\$

It's definitely possible with mice that store configuration data on their own hardware. Consider somewhat expensive gamer mice − they often come with a piece of software that lets you edit on-board configurations so you could switch them with a special button somewhere on the mouse. Some mice conveniently have auto-installing capability, like you see on mobile internet USB sticks. From then on it depends on security parameters of the target computer. If it has autorun enabled, a compromised mouse could install malicious software silently, and so on.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.