Thumb drives, keyboards, and mice, oh my! That's right, these USB devices now may be the latest "lions, tigers, and bears" to fear in our high-tech world.
According to a recent Reuters article, such USB devices possibly can be compromised to hack into personal computers in a previously unknown form of attack that supposedly can side-step current security precautions.
As reported by Reuters, Karsten Nohl, a chief scientist at SR Labs in Berlin, has stated that hackers potentially can load software onto very small and inexpensive chips that control the functions of USB devices, but which presently do not have "built-in shields" that would prevent tampering with the devices' operative code.
Nohl states that one "cannot tell where the virus came from." He adds that it is "almost like a magic trick."
Nohl's firm has tested this out by writing malicious code onto USB control chips used in thumb drives and smartphones to perform attacks. Apparently, when a compromised USB device then is attached to a computer, the malicious software can cause all kinds of mischief, like monitoring communications, deleting data, and logging keystrokes.
Once a computer has become "infected," Nohl believes that it could be programmed to infect other USB devices that later are attached to the computer, which devices then would infect subsequent computers into which they attach.
And quite problematic is Nohl's claim that computers do not detect the "infections" when the compromised devices are inserted because current anti-virus programs do not scan "firmware" that controls the functioning of the devices -- instead they only scan for software written onto memory.
Nohl has speculated (and this appears to be pure speculation) that intelligence agencies like the NSA may be launching these types of attacks already.
Is this a real and present USB danger, or are Nohl and SR Labs together a lone voice in the wilderness?
Hopefully, this problem will not materialize, and if it does or if it is about to launch, efforts will be made to erect adequate security protections.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.
