Source
r/AskElectronics•
a455

Help identifying unknown USB gadget that arrived in the mail

Off topic

[removed]

Posted May 8, 2018, 12:02 AM UTC

1425
piezeppelin•

For future reference, you should never plug in strange USB devices, specially if you've come upon them in sketchy ways (and an unexpected delivery is very sketchy).

It could be a USB killer as someone mentioned below, or it could be some type of malware.

38
unclejed613•

sure... unknown USB stick, arrived unexpectedly, let's plug it in, what could possibly go wrong???? /s

depending on your OS, there are ways to figure out what it is. if you are running linux: lsusb -v

will give you a lot of information about USB devices on your system

like this:

lsusb --verbose

Bus 001 Device 011: ID 1df7:3010  
Device Descriptor:
bLength                18
bDescriptorType         1
bcdUSB               2.00
bDeviceClass          255 Vendor Specific Class
bDeviceSubClass       255 Vendor Specific Subclass
bDeviceProtocol       255 Vendor Specific Protocol
bMaxPacketSize0        64
idVendor           0x1df7 
idProduct          0x3010 
bcdDevice            2.07
iManufacturer           0 
iProduct                0 
iSerial                 1 1701021E00
bNumConfigurations      1
Configuration Descriptor:
bLength                 9
bDescriptorType         2
wTotalLength           66
bNumInterfaces          1
bConfigurationValue     1
iConfiguration          0 
bmAttributes         0x80
  (Bus Powered)
MaxPower              400mA
Interface Descriptor:
  bLength                 9
  bDescriptorType         4
  bInterfaceNumber        0
  bAlternateSetting       0
  bNumEndpoints           0
  bInterfaceClass       255 Vendor Specific Class
  bInterfaceSubClass    255 Vendor Specific Subclass
  bInterfaceProtocol    255 Vendor Specific Protocol
  iInterface              0 
Interface Descriptor:
  bLength                 9
  bDescriptorType         4
  bInterfaceNumber        0
  bAlternateSetting       1
  bNumEndpoints           1
  bInterfaceClass       255 Vendor Specific Class
  bInterfaceSubClass    255 Vendor Specific Subclass
  bInterfaceProtocol    255 Vendor Specific Protocol
  iInterface              0 
  Endpoint Descriptor:
    bLength                 7
    bDescriptorType         5
    bEndpointAddress     0x81  EP 1 IN
    bmAttributes            1
      Transfer Type            Isochronous
      Synch Type               None
      Usage Type               Data
    wMaxPacketSize     0x1400  3x 1024 bytes
    bInterval               1
Interface Descriptor:
  bLength                 9
  bDescriptorType         4
  bInterfaceNumber        0
  bAlternateSetting       2
  bNumEndpoints           1
  bInterfaceClass       255 Vendor Specific Class
  bInterfaceSubClass    255 Vendor Specific Subclass
  bInterfaceProtocol    255 Vendor Specific Protocol
  iInterface              0 
  Endpoint Descriptor:
    bLength                 7
    bDescriptorType         5
    bEndpointAddress     0x81  EP 1 IN
    bmAttributes            1
      Transfer Type            Isochronous
      Synch Type               None
      Usage Type               Data
    wMaxPacketSize     0x0400  1x 1024 bytes
    bInterval               1
Interface Descriptor:
  bLength                 9
  bDescriptorType         4
  bInterfaceNumber        0
  bAlternateSetting       3
  bNumEndpoints           1
  bInterfaceClass       255 Vendor Specific Class
  bInterfaceSubClass    255 Vendor Specific Subclass
  bInterfaceProtocol    255 Vendor Specific Protocol
  iInterface              0 
  Endpoint Descriptor:
    bLength                 7
    bDescriptorType         5
    bEndpointAddress     0x81  EP 1 IN
    bmAttributes            2
      Transfer Type            Bulk
      Synch Type               None
      Usage Type               Data
    wMaxPacketSize     0x0200  1x 512 bytes
    bInterval               0
Device Qualifier (for other device speed):
bLength                10
bDescriptorType         6
bcdUSB               2.00
bDeviceClass          255 Vendor Specific Class
bDeviceSubClass       255 Vendor Specific Subclass
bDeviceProtocol       255 Vendor Specific Protocol
bMaxPacketSize0        64
bNumConfigurations      1
Device Status:     0x0000
(Bus Powered)Bus 001 Device 011: ID 1df7:3010

you can use IdProduct and IdVendor to find out what the device is. so if i do a search for: idvendor=0x1df7 idproduct=0x3010, i get search results that the device is a SDRPlay SRP2 radio.

4
created4this•

The VID/PID only tells you what the device claims to be, IFF you have a suitable device driver then the VID/PID will cause that driver to load. Otherwise the Device Class will load a generic driver. This could be exploited in two ways: Using a esoteric VID/PID but being a HID device class might make you think it's a (e.g.) tv tuner whilst injecting commands. If a specific driver has a known bug, this device could cause it to load and then exploit the bug.

1
ElectroSpiderBeginner•

I would say you have one of these: tindie - dstike deauth detector

Since that uses a CP2102, has the same case and is shipped via SF Express.
But that's just my best guess and I might be totally wrong. :)

12
a455OP•

Bingo. Thanks!

Note to self: don't order stuff on the internet while drunk.

11
rockstar504•

Rofl... great thread.. MYSTERY IS SOLVED OP WAS DRUNK!

10
[deleted]•

[removed]

1
coherentpa•

This answer has my vote. OP, pop it open and we'll know for sure.

2
h0m3us3r•

The case looks very similar to a tp-link usb wifi adapter, but it would not identify itself as a com port.

10
Elat99EE student•

Open it up and let us see the insides :3

9
krum•

Well, it's probably a cp2102 USB to UART bridge. Allows you to connect serial devices up to a USB port, although I don't think you can hook any serial device up - it's got to be something that works at 3.3v - so, it's not RS-232. Probably used for programming Arduinos and ESP8266s and the like.

7
pants6000•

Correct on all points.

2
MeltedSpadeshobbyist | Fixer•

most arduinos use 5v for serial coms IIRC

1
krum•

Yea you are right. I think you can do RS-232 at 3.3v, but I remember there's something funky about these that makes them not-quite a classic serial port. I have one I use to connect to a cheap Chinese EPROM programmer and a MAX232 IC but if I recall I only need the MAX232 if I try to connect actual RS232 hardware.

what a mess!

2
MeltedSpadeshobbyist | Fixer•

rs232 is uses -15v to -3v (1) and 3v to 15v (0), modern serial doesn't go negative AFAIK

1
entotheenth•

So .. where are the output connectors ? It does not appear to be a programmer, so it could just be a serial controlled 'something', I would try opening the port in a terminal and seeing if you can get a response, though I would not plug an unsolicited USB into my computer, since he already has though..

1
krum•

Well, that's what I can't figure out.

1
krum•

I’ll bet it’s some kind of microcontoller dongle that uses that chip as a usb interface.

1
entotheenth•

Yep, I figured an RF device, nrf24l01, serial-bluetooth etc.

1
h0m3us3r•

As youve already plugged it in (which I would strongly recommend against: USB Killer) try using putty to talk to its com port. Maybe it will spit out some identifiers. My guess would be that its a hardware key for some software that was sent to you by mistake.

3
RTLShadow•

Holy shit you're incredibly ballsy for plugging in a random USB like that.

3
jet_heller•

As a USB to UART bridge, there should be a port where you can plug that into other things. If that's not there, then this is some kind of self contained thing where you access whatever's in there via USB serial. It might need to be opened up to see what's in there.

2
[deleted]•

[removed]

1
supersillier•

Huh maybe remove the case to see if it’s a USB killer(tons of capacitors). If not maybe use a raspberry pi to see what’s on it if not. $35 loss if it’s malware

1
p0tat07hobbyist•

Jesus. Don’t plug it in to your computer. Do it at the library lol

1