Can I "reprogram" an American Express USB drive?

Question

I recently received a USB drive that looks like a credit card as a promotion. The drive portion flips out to plug it in. When you plug it in, it opens the run dialog, and opens a URL to an American Express web page.

I was able to find it in the Device Manager:

But I don't know what else to do? Is there a way I can convert this into a plain old USB drive? Or better yet, can I modify the command that it runs when inserted into a computer?

Pretty cool huh!? Kudos to American Express for creating a cool marketing device! (That I can hopefully hack!)

Answer 1

Pop open the device properties, and post the device VID and PID (vendorID and partID)

Device Manager -> Properties -> "Details Tab" -> "Device Instance ID" in the dropdown box.

It should be something like:
HID\VID_1532&PID_000D\6&28F03F61&0&0000 (In this case, it's a Razer Mouse)

The VID and PID are (Ideally) unique, so it should let you find who made the usb interface hardware, unless it's a really cheap Chinese product. I'd assume for something like this, the USB interface is going to be integrated into whatever microprocessor they have in there (it's cheaper), so knowing the device make will be a start.

http://www.linux-usb.org/usb.ids Has a pretty extensive list of IDs. If not, google for VID_<number> and see what you get.

(Post it and let us know, too! I'm curious.)

Answer 2

You might be able to reprogram it, if a) it had memory that could be reprogrammed, and b) you knew the protocol to access it. But the truth is probably that it just emulates a keyboard and "pushes" the buttons needed to drive Windows around, without actually having any brains whatsoever.

Answer 3

It consists of a Cypress PSoC controller, combined with a 24c02 serial eeprom.

The eeprom contains the data regarding the featured website, whilst the uController takes care of all USB protocols and other communications with the PC. It retrieves the data from the eeprom and sends it to the keyboard buffer of your PC.

With a simple program called PonyProg you can read and modify the contents of the eeprom.

Answer 4

It could be a USB drive. There are some credit card size drives available like this. The pricing suggests they wouldn't be giving them away though. This one looks just like the one you have with the printing done the opposite way up. Googling MMI 1028FMS will turn up a bunch of sites with exactly the same image and text. None of them have pricing though. I think this might made by Hongkong Dazhihui Electronics.

I think Ignacio is right. This isn't a USB drive, but a cheaper product in the same package.

Answer 5

This article looks promising:

Hacking USB Webkeys

The brains of the Webkey is all stuffed into a tiny chip that fits into your USB port. If you pop that chip out of its casing and peel off the glue, you'll get something like this. The part number of this particular Webkey is "WEB-130C".

JJShortcut wrote up a great article describing how to reprogram the EEPROM of a specific Webkey he encountered. My Webkey is a little bit different, so first I’ll go over this same method with a little more detail and specifics with the Webkey I have.

The very first thing you’ll notice on the board is the EEPROM. If you have good eyes (or a magnifying glass) you’ll see that it’s marked “J24C02C” on one line, and “DP1D07” on the next. That’s our target.

Answer 6

Short answer: No Long answer: Yes

Short answer: No

What is this thing?

As others have already noted, it doesn't show up as a drive anywhere. But yet it's clearly doing something. Just what is this thing?

This device is what's called a USB Webkey. They are cheaply made devices that are used for marketing by some companies. They consist of a very small amount of storage with data that is loaded at manufacture, a small amount of logic and a USB connector.

Is it not a USB storage device.

How does it work?

When plugged into a computer, the device appears as though it is a keyboard. Once connected, it starts to blindly issue the keyboard strokes that are stored in the device's small amount of storage. You can cause USB Webkeys to screw up by changing the assumptions it relies on. For example, uninstalling or moving the web browser it expected to be available in a certain location or changing your keyboard layout so that the OS interprets the keystrokes differently.

So why can't I program it?

As the device appears to the computer as a simple keyboard, there is no way to override the contents of the storage by simply plugging it into a computer.

Security concerns

By plugging in a USB Webkey, you are effectively allowing the creator to do anything it wants on your computer short of anything that requires a password. A malicious creator could program it to take advantage of security holes to install malware. If a malicious creator is able to figure out the target's computer password beforehand, they could program that into the webkey and gain even more control.

But since we can't reprogram it, if we only plug in webkeys from companies we recognize we're alright, right?

Well....

Long answer: Yes

Even though you can't reprogram the device through the USB interface, the device can be reprogrammed with a little bit of sobering and low-level know-how. By disassembling the device you can gain physical access to the EEPROM chip. From there you can solder wires in to connect it to some probe hardware and start reprogramming it. Just reverse the disassembly and now you have a hacked USB Key ready to do your bidding.

Bottom Line

These things are a neat hack of the USB system. But the access they are granted to systems is potentially dangerous for users and valuable for malicious hackers who have some basic wiring skills.

Don't plug these things into your computer. Ask yourself this: Do you trust American Express or any other company with control over your computer? Even if the original creator is legit, you have no way of knowing if the device hasn't been tampered with. If you must, use a computer that you are able to wipe afterwords.

Answer 7

I did a little bit of research on that and found out that there are different types out there. Sophisticated ones which can be hacked in the sense that you can e.g. change the URL but also cheap ones that are hard coded.

In the case of the latter one not all is lost: You can make use of a redirection tool (like this one: http://requestly.in/) and very easily redirect the page to any page of your choosing.

There are dongles out there that use the same kind of mechanism. I now use mine as a foot pedal to start a tea timer (https://www.google.com/search?q=timer+3+minutes).

So I now literally trample on the logo of a company that ruins the environment with this kind of electronic waste ;-)