You can be on Entrepreneur’s cover!

Why a Dangerous Security Flaw in USB Devices Is Putting Computers Everywhere at Risk Thumb drives and other USB devices are vulnerable to malware that could let an attacker take over a user's computer.

By Benjamin Kabin

entrepreneur daily

Opinions expressed by Entrepreneur contributors are their own.

USB devices and the computers their users connect them to are vulnerable to malicious code that can totally take over a user's computer, manipulate files stored on the drive and redirect Internet traffic.

Security researchers Karsten Nohl and Jakob Lell first demonstrated the attack this summer at the Black Hat security conference in Las Vegas where they showed a large crowd how their malware embeds itself in the firmware that allows USB devices to communicate with computers, Wired reports.

Nohl and Lell did not publish their code, called BadUSB, for fear that it would be used for nefarious purposes; but now two other researchers have opened Pandora's Box.

Related: FBI to Apple, Google: Your New Privacy Policies Are Making People Less Safe

At last week's Derbycon hacker conference two other researchers, Adam Caudill and Brandon Wilson demonstrated that they'd reverse engineered the BadUSB malware and then published it on Github for anyone to see.

"The belief we have is that all of this should be public. It shouldn't be held back. So we're releasing everything we've got," Caudill said at Derbycon. "If you're going to prove that there's a flaw, you need to release the material so people can defend against it."

Caudill's statement highlights a philosophical split among security researchers: those who elect to keep the flaws they find under wraps in order to protect the public directly, and others, who believe publishing their software exploits is the best way to put pressure on the industry to fix security flaws quickly.

In an interview with Wired, Caudill said even if this particular flaw isn't being used by garden variety hackers already, he believes well-funded organizations, like the NSA, may already have the capability and are using it.

Related: "Bash' Bug Could Be Bigger Than Heartbleed

"You have to prove to the world that it's practical, that anyone can do it … That puts pressure on the manufactures to fix the real issue," Caudill said. "If this is going to get fixed, it needs to be more than just a talk at Black Hat."

Because the malware is stored on the device's firmware, which controls the basic functionality of the device, it's very difficult to detect and can't even be deleted by clearing the storage contents. Caudill also demonstrated how the malware can be used to hide files and secretly disable password-protected security features.

Before last week's demonstration Nohl told Wired that he considered this exploit to be basically unpatchable. In order to mitigate against these types of attacks, he said, the entire security architecture would have to be rebuilt from the ground up with code that cannot be changed without the manufacturer's signature. Even then, he said, it could take more than a decade to get rid of vulnerable devices and smooth out all the new bugs.

Both research teams reverse engineered the firmware from USB devices made by Phison, a Taiwanese company and one of the largest USB device makers. Even if you don't use Phison devices yourself, your computer is still vulnerable, especially if you swap files with other users or happen to pick up a new free thumb drive at a business conference.

Related: JPMorgan Hack Exposed Data of 83 Million Homes and Small Businesses

Benjamin Kabin

Journalist

Benjamin Kabin is a Brooklyn-based technology journalist who specializes in security, startups, venture capital and social media.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Side Hustle

This Dad Started a Side Hustle to Save for His Daughter's College Fund — Then It Earned $1 Million and Caught Apple's Attention

In 2015, Greg Kerr, now owner of Alchemy Merch, was working as musician when he noticed a lucrative opportunity.

Business News

Yes, You Can Buy a Foldable Tiny Home on Amazon — And Now It's Selling for Less Than $12,000

The waterproof and flameproof house was listed around $35,000 a few months ago.

Money & Finance

4 Things to Know About Credit Financing Your Business Following the 'Fed Pivot'

With cheap money behind us, you'll want to rethink how you finance your business

Business News

This Futuristic Wearable Smartphone Alternative Projects a Screen on Your Palm — And It's Now Widely Available

Humane's Ai Pin fastens magnetically to clothing and becomes a voice-activated AI assistant that can make calls, send texts, take notes, and find answers to complex questions.

Side Hustle

This Insurance Agent Started a Side Hustle Inspired By Nostalgia for His Home State — Now It Earns Nearly $40,000 a Month

After moving to New York City, Danny Trejo started a business to stay in touch with his roots — literally.