Adversaries may move onto devices by exploiting or copying malware to devices connected via USB. In the case of Lateral Movement, adversaries may utilize the physical connection of a device to a compromised or malicious charging station or PC to bypass application store requirements and install malicious applications directly.[1] In the case of Initial Access, adversaries may attempt to exploit the device via the connection to gain access to data stored on the device.[2] Examples of this include:
| ID | Name | Description |
|---|---|---|
| S0315 | DualToy |
DualToy side loads malicious or risky apps to both Android and iOS devices via a USB connection.[6] |
| S0312 | WireLurker |
WireLurker monitors for iOS devices connected via USB to an infected OSX computer and installs downloaded third-party applications or automatically generated malicious applications onto the device.[7] |
| ID | Mitigation | Description |
|---|---|---|
| M1012 | Enterprise Policy |
Enterprise policies should prevent enabling USB debugging on Android devices unless specifically needed (e.g., if the device is used for application development). |
| M1003 | Lock Bootloader |
Users should ensure bootloaders are locked to prevent arbitrary operating system code from being flashed onto the device. |
| M1001 | Security Updates |
Security updates often contain patches for vulnerabilities. |
| M1006 | Use Recent OS Version |
iOS 11.4.1 and higher introduce USB Restricted Mode, which disables data access through the device's charging port under certain conditions (making the port only usable for power), likely preventing this technique from working.[8] |
| M1011 | User Guidance |
Users should be advised not to use public charging stations or computers to charge their devices. Instead, users should be issued a charger acquired from a trustworthy source. Users should be advised not to click on device prompts to trust attached computers unless absolutely necessary. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0691 | Detection of Replication Through Removable Media | AN1802 |
For Android, detect Replication Through Removable Media by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: File with binary signature (.apk, .dex, .so, .sh) written to app storage or /data/local/tmp/ from USB-mounted path or external storage within $USBInstallWindow$]; Process Creation via Application Vetting / Managed Device Telemetry [Application installed with install_source=adb or install_source=sideload from USB-connected host within $USBInstallWindow$ of USB mode change]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1803 |
For iOS, detect Replication Through Removable Media from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; System Settings via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |