Forensics Impossible: Self-Destructing Thumb Drives – Brandon Wilson
iSpeech
Many people do not understand that a USB thumb drive is a mini computer, capable of making decisions and reading and writing memory all on its own. Each drive has firmware responsible for implementing the responses to any read or write requests sent to it by a host computer. Forensic tools such as write blockers can prevent certain commands from being sent to the drive, but they have no impact at all on what the drive's firmware chooses to do. What if it chooses to erase everything if it isn't continuously sent a special sequence of commands that only the user knows?
In this talk, I will demonstrate (through code only, no hardware tinkering) how to modify the firmware on a standard USB thumb drive to erase everything (including itself) if custom software isn't running on the PC that the drive is plugged into.
https://bsidesknoxville2016.sched.org/event/6tCa/forensics-impossible-self-destructing-thumb-drives
2016-06-04 02:40:07
source
Gloss