It turns out; hackers are using USB devices like keyboards, and thumb-drives as a new means of evading security protections.
Hackers can load destructive software onto small, low-cost computer chips that control the functions of USB devices and exploit their lack of built-in shields to tamper with their code.
"You cannot tell where the virus came from. It is almost like a magic trick," said Karsten Nohl, chief scientist with Berlin's SR Labs. Her research firm is known for uncovering major problems in mobile phone technology.
The findings prove the bugs in software that are virtually invisible to the average computer can be extremely dangerous when hackers learn how to exploit them.
The mischievous software can record keystrokes, spy on communications and destroy data that it comes across. Computers cannot detect the infections written into the devices because anti-virus programs are designed to scan software written onto memory.
Nohl said he would not be surprised if intelligence agencies like the National Security Agency are already exploiting this technique. An NSA spokeswoman declined to comment on the matter.
SR Labs tested the technique by infecting chips made by Phison Electronics, placing them in USB memory drives.
"Mr. Nohl did not offer detailed analysis together with work product to prove his finding," Chiu said. "Phison does not have ground to comment (on) his allegation."
This technique gives hackers the edge when looking to corrupt chips made by Phison, as its software are not built secure.
Once the device infects a computer, it can program every other USB-dependent device, effectively infecting the entire machine.
"Now all of your USB devices are infected. It becomes self-propagating and extremely persistent," Nohl said. "You can never remove it."
"The manufacturer should make it much harder to change the software that runs on a USB stick," said Christof Paar, a professor of electrical engineering at Germany's University of Bochum. He believes his new research will prompt others to take action against the issue.
