Does a USB mouse have memory that could be used to store malware?

Question

I worry that this might get flagged as too broad, but here it goes:

Lately I've been thinking about the possibility of loading data on peripheral devices. One of the most used peripherals is the mouse. I realize that there are 101 ways to build a mouse. To refine my question into several, I ask these questions:

1. Is it possible to build a mouse without memory? If so, is it typically seen not have memory on a mouse?
2. Suppose the mouse did have memory (if this is not an realistic assumption, please point that out), is it typical to see ROM types of memory only? Can the memory be flashed like CMOS memory?
3. Has any one seen an computer attack/malware attack from the memory of a mouse?

I ask number three because what I've been thinking of lately is the generalization of the attacks performed by various advanced persistent threats.

Answer 1

Many USB peripherals include flash-based microcontrollers. Although mask-ROM-based microcontrollers are cheaper, use of a flash-based microcontroller may enable a manufacturer to have one board which can go in a variety of OEM products, each of which reports the name under which it is sold. Some peripherals include firmware that allows them to be reprogrammed from the USB port; having them configured that way would allow a manufacturer to pre-program parts in a way suitable for its highest-volume customer and re-program them on demand for other customrs.

If a mouse happens to include a flash microcontroller, it may be possible for a malicious person to reprogram it to behave as a malware-infection device. Because most mice aren't likely to use particularly big microcontrollers, there may not be any room for malware if the mouse is required to be usable as a mouse. On the other hand, it might be possible for some malware to identify a vulnerable mouse and reprogram it in such a way that it would no longer work as a mouse, but would act as an agent of evil when plugged into a non-infected machine [on the theory that someone whose mouse stops working might test it on another computer].

It would in general not be difficult to design a USB peripheral in such a way that once final firmware was loaded it could not be reloaded from the USB port, but there is no general way to distinguish devices which are immune from reprogramming from devices which aren't. It would also be possible to design a "smart USB hub" with a display and some buttons which would, when a device was plugged in, indicate what the device is claiming to be, asking for confirmation before the computer could see the device, and restricting the device's communications to those that were approved for its type, but I don't know if any such smart-hub devices are available.

Answer 2

USB keyboards can be used to do interesting things on a PC/Mac. And you could combine an USB keyboard with a mouse into one HID, using a microcontroller for example.

Cheap USB mice should still use ASICs that are not reprogrammable IMHO, because masked ROM costs less than flash.

Answer 3

Yes, it is definitely possible to use mice (and USB devices in general) in cyber attacks.

Whatever type of memory cheap mice have, it's usually impossible to modify it via the USB interface, so the attacker will need to physically access the mouse which will be used for the attack. As a result, it is usually easier to make a custom device which mimics a mouse and has lots of memory (and perhaps some wireless transcievers) rather than reuse a real mouse which will have little memory, small processing power and no wireless interfaces.

There are devices which are much more suitable for such purposes. For example, most SD cards have quite powerful controllers and the firmware is usually upgradable, protected by a passcode of some sort. Such passcodes are widely known by the dev&testing teams and are not meant to be cryptographically secure. Often leetspeak phrases like DEADBEEF or 600DCOFFEE are used. And once you have control over an SD card, there is no extra effort to get sensitive data, all you have to do is filter it. Similarly, USB keyboards are natural candidates for password stealing. Convincing the computer to send a file or a password to the mouse is much more difficult.

Answer 4

It's definitely possible with mice that store configuration data on their own hardware. Consider somewhat expensive gamer mice − they often come with a piece of software that lets you edit on-board configurations so you could switch them with a special button somewhere on the mouse. Some mice conveniently have auto-installing capability, like you see on mobile internet USB sticks. From then on it depends on security parameters of the target computer. If it has autorun enabled, a compromised mouse could install malicious software silently, and so on.