The Anti-virus Times

Monday, August 14, 2017

Normally when we see (or use) a removable media device, we think only about the files contained on it. But what is a file? It is a certain area on the media. Meanwhile, storage media can vary. If we’re dealing with a hard drive, we computer novices can't tell how many disks are used on the device or how data is written onto it, without reading labels.

So if we try to simply connect the media to a computer, the latter wouldn't be able to use it. A translator would be needed that allows the computer to understand what is written on the media. The “translator” lets you plug new devices into the appropriate ports without thinking about different media formats.

Let's use flash drives as an example. They work as follows:

When you plug a new flash drive into your computer, it gets a device ID, reads the USB controller's firmware, and uses its driver to write and record data onto the flash drive.

So, by connecting a flash drive to your machine, you are essentially making it download a driver from the media.

And it can be from any media.

And the system has no idea what the driver will do.

A fortune teller can only dream of gaining so much trust.

And here are a few examples of attacks.

Because the “translator” facilitates interaction between a flash drive and a computer, the media can assume any identity. It can pretend to be a keyboard, for example.

Or a new Ethernet adapter.

In other words, thanks to OS features, a malicious flash drive makes the computer channel all inbound and outbound traffic through it. A dream come true for fraudsters and spies!