Jump to content

Testing Mysterious USB


glasscannon
 Share

Recommended Posts

Hi guys,

My coworker's daughter received a USB credit card in the mail with no name or any indication of where it came from on the box. It basically looks like an American Express Platinum but with a USB that flips out. She was going to toss it out but gave it to me knowing I'm into these kinds of things.

I want to plug the card into an old beater machine and see what's up with it, but I'm not sure where to begin or what to look for. My current plan is to look at instructions for setting up badUSB and see if there's any correlation to this USB device.

Any ideas of what else I can look for?

Pictures are always nice so I attached a picture of it.

post-27922-0-97117700-1417563248_thumb.j

Link to comment
Share on other sites

My checklist would be:

  • get obsolete PC without network connection
  • Create Log with Autoruns (for comparison)
  • Start Process Monitor
  • check for malware, rootkits
  • check file system / boot record
  • unplug it if finished
  • start Autoruns again
  • have a look at Process Monitor capture
Link to comment
Share on other sites

Before you plug it in, I would do a couple of things. Call American Express and ask if they can tell you anything about this, if they even know its legit. "you can't con an honest man". This smells of a con. Next I would break the plastic case open and look at the hareware inside (if at all possible without damaging it). look for s/n numbers on any of the parts. google the part numbers, you might get lucky as to the pcb. its a start anyway.

Link to comment
Share on other sites

Im interested to see what you found on this device. Was the number printed on the card associated with an of your friends personal accounts.

I have heard of people leaving malicious usb devices in public places but this is taking it to a new level, more likely to be used in targeted attacks i would have though.

Once you have done your investigation would be cool to see what is inside the card.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...