Solved

AV Detect BadUSB?

Posted on 2014-10-03
1
489 Views
Last Modified: 2014-10-08
So I reading various tech articles about the USB flaw known as BadUSB (malware embedded in firmware) and that the code was recently posted on GitHub.  As a result, there's hysteria and suggestions not to use USB connected devices.  That's not very practical and I wanted to know if AV apps would detect such malware?
0
Comment
Question by:markbyrn
1 Comment
 
LVL 54

Accepted Solution

by:
McKnife earned 500 total points
ID: 40359665
If a device tells windows "I am a keyboard", then windows installs it and that device is ready for action. So if that fake keyboard starts typing in a command shell, windows cannot distinguish if this is the user or not, nor can the AV software. So the code typed there will be executed.

There are 2 measures to be taken:
-lock your screen when absent
-use software that only lets whitelisted USB devices work on your machine.

The latter can be done by GPOs. It can also be done with external softwares, amongst them AV software.
But it will be a real pain to administer, so the best solution stays "lock your screen!".
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
Knowing where your website is hosted is as important as the features you receive, the monthly fee, and the support you receive. Due diligence should be done when choosing your next hosting provider.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question