search

cecio / USBvalve

Expose USB activity on the fly
MIT License
1.23k stars 44 forks source link
badusb forensics malware usb usb-hid

readme

logo, landscape, dark text, transparent background

Expose USB activity on the fly

The two models The Watch 1.2

I'm sure that, like me, you were asked to put your USB drive in an unknown device...and then the doubt:

what happened to my poor dongle, behind the scene? Stealing my files? Encrypting them? Or just installing a malware? With USBvalve you can spot this out in seconds: built on super cheap off-the-shelf hardware you can quickly test any USB file system activity and understand what is going on before it's too late!

With USBvalve you can have an immediate feedback about what happen to the drive; the screen will show you if the fake filesystem built on the device is accessed, read or written:

Selftest Readme

and from version 0.8.0 you can also use it as USB Host to detect BADUSB devices:

HID

This is an example of the BADUSB debugger available on serial port:

If you prefer videos, you can also have a look to my Insomni'hack Presentation

USBvalve Watch

Starting from version 0.15.0 a new Pi Pico Watch version is supported. To compile the new version you have to uncomment the #define PIWATCH line at the beginning of the code. The hardware is a RP2040-based 1.28-inch TFT display and watch board. You can find some more info here. This is also fully compatible with the Waveshare RP2040-LCD-1.28.

Repository Structure

docs: documentation about the project, with a presentation where you can have a look to all the features

firmware: pre-built firmware for the Raspberry Pi Pico. You can just use these and flash them on the board. I prepared the two versions for 32 and 64 OLED versions

PCB: Gerber file if you want to print the custom PCB . It's not mandatory, you can use your own or build it on a breadboard

USBvalve: sources, if you want to modify and build the firmware by yourself

utils: some utilities you may use to build a custom FS

pictures: images and resources used in this doc

STL: STL files for enclosure. In 1.1 and 1.2 folders there are full enclosures (thanks to WhistleMaster). In folders 1.2_64 and 1.2_64_simple there are enclosures for the 128x64 screen (thanks to rtmq0227). If you want something lighter to protect the LCD you can go with USBvalve_sliding_cover.stl.

Build USBvalve

Part list

If you want to build your own, you need:

Building instructions

Thanks to Tz1rf we have a great Video explaining the building process step-by-step.

Almost all the job is done directly on the board by the software, so you just need to arrange the connection with the OLED for output.

Starting from version 0.8.0 of the firmware, USBvalve can detect HID devices (used to detect BADUSB). This require an additional USB port behaving as Host. If you are not interested in this, you can use the old instructions in docs folder and use PCB version 1.1. Otherwise go ahead with PCB version 1.2 (we have version for USB-A or USB-B, see folder).

With USBvalve PCB

Some of the OLEDs have the GND and VCC PINs swapped, so I built the PCB to be compatible with both versions:

For example if your OLED has GND on PIN1 and VCC on PIN2 like this:

You have to place a blob of solder on these two pads on the back of the PCB:

Otherwise you should the opposite and place the solder on the other PADs:

Without USBvalve PCB

Pico Pi

If you are using a breadboard or just wiring, all you have to do is to ensure to connect the proper PINs at the OLED screen and to the Host USB port.

The mapping is the following:

If you want to use the DEBUG functions, you can also place a header on the 3 SWD PINs at the bottom of the board.

With USBpipe PCB

[!CAUTION] This PCB is for experienced electronic makers DON'T USE IT IF YOU AREN'T SURE YOU CAN HANDLE IT!

[!NOTE] R7 and R8 aren't actually connected to anything. They are added for circuit debugging purposes. So they don't show up in the BOM

USBpipe PCB USBpipe

USBpipe is a dedicated PCB for this project.

You can find everything you need in ./PCB/USBpipe/ folder.

Front Back

Flash Firmware

To flash the firmware, follow these steps:

It's done!

Anti-Detection

I don't know if it will ever be the case, but you may want to customize the firmware in order to avoid detection done by USBvalve-aware malware :-)

I grouped most of the variables you may want to modify in this section (see Dockerfile below for rebuilding)

// Anti-Detection settings.
//
// Set USB IDs strings and numbers, to avoid possible detections.
// Remember that you can cusotmize FAKE_DISK_BLOCK_NUM as well
// for the same reason. Also DISK_LABEL in ramdisk.h can be changed.
//
// You can see here for inspiration: https://the-sz.com/products/usbid/
//
// Example:
//             0x0951 0x16D5    VENDORID_STR: Kingston   PRODUCTID_STR: DataTraveler
//
#define USB_VENDORID 0x0951               // This override the Pi Pico default 0x2E8A
#define USB_PRODUCTID 0x16D5              // This override the Pi Pico default 0x000A
#define USB_DESCRIPTOR "DataTraveler"     // This override the Pi Pico default "Pico"
#define USB_MANUF "Kingston"              // This override the Pi Pico default "Raspberry Pi"
#define USB_SERIAL "123456789A"           // This override the Pi Pico default. Disabled by default. \
                                          // See "setSerialDescriptor" in setup() if needed
#define USB_VENDORID_STR "Kingston"       // Up to 8 chars
#define USB_PRODUCTID_STR "DataTraveler"  // Up to 16 chars
#define USB_VERSION_STR "1.0"             // Up to 4 chars

Building your firmware

Obviously you can also build your own firmware. To build the standard one I used:

Remember to add https://github.com/earlephilhower/arduino-pico/releases/download/global/package_rp2040_index.json in the Additional Board Manager URLs to install the proper board.

If you want to re-create a new fake filesystem, you may want to have a look to the utils folder, where I placed some utilities to build a new one.

Dockerfile

If you want to build your own firmware, after you customized it, I provide a Dockerfile which builds a complete Arduino environment and compile the firmware. Enter the following commands in the main USBvalve folder:

docker build -t usbvalve/arduino-cli .
docker run --rm --name usbvalve -v $PWD:/mnt usbvalve/arduino-cli /mnt/USBvalve

The firmware will be placed with extension uf2 in folder USBvalve_out.

Contribute

If you have ideas or improvements in your mind, I encourage you to open an issue so that we can improve the project together! Thanks!

Support

If you have question or need support you can open an Issue here or reach me out on Twitter/X @red5heep

Community versions

The Community created some forks implementing support for other boards, or other modifications. Thank you to everyone who contributed to the development of USBvalve. Here below an unofficial/incomplete/unsupported list:

SAFETY WARNING

[!WARNING] I've received a lot of questions about USBvalve and USB killer devices. USBvalve is not built to test these devices, it has not any kind of insulation or protection, so if you have the suspect you are dealing with one of these devices, test it with something else, NOT with USBvalve or you may damage the device, yourself or objects near to you.