Researchers demonstrate how to crack the USB driver and conquer the PC operating system

Angelos Stavrou, assistant professor at George Mason University, and his student Wang chaohui presented their new achievements in the security field at the Black Hat DC Hacker Conference by cracking the USB driver, only one common USB cable can be used to conquer the PC operating system.

Simply put, their method of cracking is to add the virtual keyboard and mouse function to the USB driver, and directly use the Virtual Peripherals to issue operation instructions, attackers can obtain system control, download malware, and steal files.

The initial cracking program may be sent to the user's computer by visiting a malicious website or downloading a disguised malicious program. Once the user uses a USB cable to connect to the computer for charging or synchronizing the program, the program can start to spread, and through the computer to mobile phones, mobile phones to computers and even mobile phones to mobile phones quickly spread. Currently, mobile phone cracking only supports Android, but developers say that the iPhone and any other USB interface computing devices can be implemented in a similar way.

The attacker can automatically identify the operating system. In Windows, a hardware discovery window pops up in the lower-left corner of the screen for one to two seconds. In Mac systems, new device information can be disabled by the program sent by the smartphone. In Linux, there will be no prompts. Therefore, such attacks are unlikely to be discovered by users. Because it simulates the operations performed by users through the keyboard and mouse, the existing anti-virus and security software is powerless.

Stavrou said it had developed this attack method to demonstrate the potential risks of the USB driver, because the operating system can connect to any device using the USB protocol without authentication. "The operating system should bring up a warning asking the user to confirm whether the device is actually connected," he said ".