USBdriveby: Compromising computers with a $20 microcontroller

Security researcher Samy Kamkar has devised a fast and easy way to compromise an unlocked computer and open a backdoor on it: a simple and cheap ($20) pre-programmed Teensy microcontroller.

Dubbed USBdriveby, the microcontroller emulates a keyboard and mouse when plugged into a machine, and misuses the trust machines usually give USB devices to launch apps, evade the local firewall, install a reverse shell in crontab, and modify DNS settings without any additional permissions and without the machine detecting and blocking its actions.

Kamkar made the attack work on OS X, but says that it can easily be modified to work on Windows and *nix machines, as well. Some Arduino microcontrollers can be also be used instead of a Teensy.

He demonstrated the attack in a video:

For more technical details about creation of the tool, and links to the used code, check out the project’s page.