Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Debunking fake USB flash drives

Debunking fake USB flash drives

Renaud Lifchitz

May 01, 2020
Tweet

More Decks by Renaud Lifchitz

Other Decks in Research

Transcript

  1. Debunking fake USB flash drives
    By Renaud Lifchitz (@nono2357)
    PlopSec – May 2020

    View full-size slide

  2. Renaud Lifchitz - Debunking fake USB flash drives 2
    What is advertised
    Nice and slim USB flash drive, very large capacity,
    very cheap price, latest USB 3 technology...

    View full-size slide

  3. Renaud Lifchitz - Debunking fake USB flash drives 3
    Inserting the flash drive… (1/2)
    $ dmesg
    [616145.561710] usb 3-9: new high-speed USB device number 32 using xhci_hcd
    [616145.587871] usb 3-9: New USB device found, idVendor=048d, idProduct=1234,
    bcdDevice= 2.00
    [616145.587875] usb 3-9: New USB device strings: Mfr=1, Product=2, SerialNumber=3
    [616145.587878] usb 3-9: Product: Disk 3.0
    [616145.587880] usb 3-9: Manufacturer: USB
    [616145.587881] usb 3-9: SerialNumber: 7431301101907252614
    [616145.588512] usb-storage 3-9:1.0: USB Mass Storage device detected
    [616145.588706] scsi host10: usb-storage 3-9:1.0
    [616146.606295] scsi 10:0:0:0: Direct-Access VendorCo ProductCode 2.00
    PQ: 0 ANSI: 4
    [616146.606779] sd 10:0:0:0: Attached scsi generic sg2 type 0
    [616146.606958] sd 10:0:0:0: [sdc] 4095997952 512-byte logical blocks: (2.10
    TB/1.91 TiB)
    [616146.607080] sd 10:0:0:0: [sdc] Write Protect is off
    [616146.607083] sd 10:0:0:0: [sdc] Mode Sense: 03 00 00 00
    [616146.607213] sd 10:0:0:0: [sdc] No Caching mode page found
    [616146.607218] sd 10:0:0:0: [sdc] Assuming drive cache: write through
    [616146.609090] sdc: sdc1
    [616146.610656] sd 10:0:0:0: [sdc] Attached SCSI removable disk
    Ok, large capacity advertised to the OS

    View full-size slide

  4. Renaud Lifchitz - Debunking fake USB flash drives 4
    Inserting the flash drive… (2/2)
    $ dmesg
    [616145.561710] usb 3-9: new high-speed USB device number 32 using xhci_hcd
    [616145.587871] usb 3-9: New USB device found, idVendor=048d, idProduct=1234,
    bcdDevice= 2.00
    [616145.587875] usb 3-9: New USB device strings: Mfr=1, Product=2, SerialNumber=3
    [616145.587878] usb 3-9: Product: Disk 3.0
    [616145.587880] usb 3-9: Manufacturer: USB
    [616145.587881] usb 3-9: SerialNumber: 7431301101907252614
    [616145.588512] usb-storage 3-9:1.0: USB Mass Storage device detected
    [616145.588706] scsi host10: usb-storage 3-9:1.0
    [616146.606295] scsi 10:0:0:0: Direct-Access VendorCo ProductCode 2.00
    PQ: 0 ANSI: 4
    [616146.606779] sd 10:0:0:0: Attached scsi generic sg2 type 0
    [616146.606958] sd 10:0:0:0: [sdc] 4095997952 512-byte logical blocks: (2.10
    TB/1.91 TiB)
    [616146.607080] sd 10:0:0:0: [sdc] Write Protect is off
    [616146.607083] sd 10:0:0:0: [sdc] Mode Sense: 03 00 00 00
    [616146.607213] sd 10:0:0:0: [sdc] No Caching mode page found
    [616146.607218] sd 10:0:0:0: [sdc] Assuming drive cache: write through
    [616146.609090] sdc: sdc1
    [616146.610656] sd 10:0:0:0: [sdc] Attached SCSI removable disk
    … but strange USB Product ID (another model has idVendor=0000, idProduct=7777)

    View full-size slide

  5. Renaud Lifchitz - Debunking fake USB flash drives 5
    Testing USB 3 claims
    Flash drive is already formatted in exFAT, let’s
    test its speed by writing « zeroed » files:
    $ for i in `seq 1 40`; do echo $i; dd if=/dev/zero of=f$i bs=1M count=1024; done
    1
    1024+0 records in
    1024+0 records out
    1073741824 bytes (1.1 GB, 1.0 GiB) copied, 1.34213 s, 800 MB/s
    2
    1024+0 records in
    1024+0 records out
    1073741824 bytes (1.1 GB, 1.0 GiB) copied, 3.06786 s, 350 MB/s
    3
    1024+0 records in
    1024+0 records out
    1073741824 bytes (1.1 GB, 1.0 GiB) copied, 98.9574 s, 10.9 MB/s
    4
    1024+0 records in
    1024+0 records out
    1073741824 bytes (1.1 GB, 1.0 GiB) copied, 119.99 s, 8.9 MB/s
    Write speed quickly drops to ~9 MB/s, USB 3 really?

    View full-size slide

  6. Renaud Lifchitz - Debunking fake USB flash drives 6
    Testing storage capacity claim (1/2)
    A bit more difficult, have a look at our files
    headers:
    $ for i in `seq 1 2048`; do file f$i; done
    f1: data
    f2: data
    f3: data
    f4: data
    (...)
    f29: data
    f30: data
    f31: ISO-8859 text, with very long lines, with no line terminators
    f32: ISO-8859 text, with very long lines, with no line terminators
    f33: ISO-8859 text, with very long lines, with no line terminators
    f34: ISO-8859 text, with very long lines, with no line terminators
    f35: ISO-8859 text, with very long lines, with no line terminators
    (...)
    Curiously, something happens between f30 and f31...

    View full-size slide

  7. Renaud Lifchitz - Debunking fake USB flash drives 7
    Testing storage capacity claim (2/2)
    $ xxd f30 | head
    00000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    00000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
    $ xxd f31 | head
    00000000: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000010: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000020: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000030: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000040: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000050: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000060: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000070: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000080: ffff ffff ffff ffff ffff ffff ffff ffff ................
    00000090: ffff ffff ffff ffff ffff ffff ffff ffff ................
    f30 is filled with zeros as expected, but not the following files, do you
    start to understand?

    View full-size slide

  8. Renaud Lifchitz - Debunking fake USB flash drives 8
    Fake USB flash drives storage layout
    Real capacity
    (30 GB here)
    Emulated storage layout
    that supports writing but
    always returns « FF» bytes
    (nearly 2 TB)
    0

    View full-size slide

  9. Renaud Lifchitz - Debunking fake USB flash drives 9
    Experimenting with EXT4
    Results with EXT2 & EXT3 are similar
    Positions are big, these filesystems will likely fail
    $ dd if=/dev/zero of=zero.bin bs=4096 count=100k 2>/dev/null &&
    sudo mkfs.ext4 /dev/loop59 && ./findlastbyte.py
    mke2fs 1.44.1 (24-Mar-2018)
    Discarding device blocks: done
    Creating filesystem with 409100 1k blocks and 102400 inodes
    Filesystem UUID: 4c0959db-c3a8-4f8e-9617-ddf30b97b236
    Superblock backups stored on blocks:
    8193, 24577, 40961, 57345, 73729, 204801, 221185, 401409
    Allocating group tables: done
    Writing inode tables: done
    Creating journal (8192 blocks): done
    Writing superblocks and filesystem accounting information: done
    Last non-null byte position: 411047033 0x18801479

    View full-size slide

  10. Renaud Lifchitz - Debunking fake USB flash drives 10
    Experimenting with FAT & exFAT
    Positions are small, these filesystems will likely work!
    $ dd if=/dev/zero of=zero.bin bs=4096 count=100k 2>/dev/null &&
    sudo mkfs.vfat /dev/loop59 &
    & ./findlastbyte.py
    mkfs.fat 4.1 (2017-01-24)
    Last non-null byte position: 114691 0x1c003
    dd if=/dev/zero of=zero.bin bs=4096 count=100k 2>/dev/null &&
    sudo mkfs.exfat /dev/loop59
    && ./findlastbyte.py
    mkexfatfs 1.2.8
    Creating... done.
    Flushing... done.
    File system created successfully.
    Last non-null byte position: 196697 0x30059

    View full-size slide

  11. Renaud Lifchitz - Debunking fake USB flash drives 11
    Consequences on filesystems

    On fake USB flash drives:
    – FAT and exFAT are well supported
    – EXT2/EXT3/EXT4: default formatting use
    superblock backups across all storage layout, these
    filesystems will be detected as corrupted

    View full-size slide

  12. Renaud Lifchitz - Debunking fake USB flash drives 12
    What finally happened with my last purchase...

    I made a complaint through Paypal

    Vendor denied and asked for proofs, that’s why
    I writed this presentation 

    Was refunded because of no answer from the
    seller after my full report to Paypal

    View full-size slide

  13. Renaud Lifchitz - Debunking fake USB flash drives 13
    How to avoid buying a fake one

    Avoid chinese websites

    Look for real/fake reviews

    Used USB cases are always the same four or five
    ones! Train yourself to recognize them...

    Prefer buying with Paypal who offers to reimburse
    you if the product doesn’t comply with its description

    In case of doubt, test your key using my procedure!

    View full-size slide

  14. Renaud Lifchitz - Debunking fake USB flash drives 14
    Questions?
    Follow me on Twitter: @nono2357

    View full-size slide