American Express Zync USB key????

[dbarton]

So American Express sent an ad for the new Zync card on a USB key. When I put the key in the drive it opens the run command, and types a web url.

Why can't I see the key in Windows in any way?
Do they use some special format?

 

[Blain]

Try viewing the drive in a Linux machine.
Windows isn't known for playing well with others.

 

[dbarton]

What do you mean play well with others?

It autoruns when you put in in a Windows machine, so it must run Windows...

 

[alyarb]

blah i completely misread your post. are you trying to reformat the usb key? how much space could it possibly have?

 

[dbarton]

I wonder if it has any real space at all , but I want to know how a key can autorun a windows command, yet be invisible as far as I can tell.

 

[ArcSyn]

It isn't totally invisible, but it registers itself as a USB input device. So it's basically pretending to be a keyboard, which then enters the run command and types in the address.

I'm also curious what we can do with it. I could see someone getting a bit disgruntled and sending out thousands of these things where instead of taking you to a web site it starts a virus instead.. Kinda dangerous to send people autorunning USB devices..

Kinda ridiculous though in terms of money spent on marketing just to get you to sign up for a credit card.

EDIT: It's a "webkey" and apparently they make them in all sorts of shapes and styles. Check out the designs for credit card sized versions. I gotta give them credit for using Initech. 😀

 

[Yellowbeard]

There are some USB flash drive tools out there if you can find them that allow you to change the bit that is part of how the device identifies itself to Windows. You may be able to change that and use the drive. Lexar had one called BootIt.

 

[dbarton]

Lexar Bootit only seems to work if the system can see it as a drive.

These webkeys seem to act more like a keyboard that sends keystrokes, than a drive, so can't be seen by Bootit.

 

[dbarton]

EDIT: It's a "webkey" and apparently they make them in all sorts of shapes and styles.

Do you have a link? I can't find the company.

 

[Yellowbeard]

Lexar Bootit only seems to work if the system can see it as a drive.

These webkeys seem to act more like a keyboard that sends keystrokes, than a drive, so can't be seen by Bootit.

Makes sense, but I have not personally tried it of course.

 

[Sudosftw]

Hey people, Linux guy here.
Recieved one of these things from a friend that wanted to know if it was possible to make into a flashdrive.

Here's a pic of the inside:

it's not the best of pictures but it's what I grabbed from when I did my own search on the thing.

When plugged into a linux box (in this case, my spare Acer Aspire One 150) it displays the device as (well, on my system)
"Bus 001 Device 002: ID 05ac:020b Apple, Inc. Pro Keyboard [Mitsumi, A1048/US layout]"

and that's when I do an lsusb. SO, it's using some sort of controller also used in the Apple Pro keyboard, identifying as one or Debian lenny can't make any idea of what type of keyboard it is.

Please note that this is an EEPROM device, and from what I see there is no usable memory. HOWEVER, You might be able to build a flashing device and do it that way OR find some way to get it to do some other interesting things.

this would be a great project for someone with some knowledge about chips, so I'm also going to report my finds at another forum and see what I can get done.

 

[dbarton]

My impression is that it is seen by the system as if it was a keyboard, not a USB key. It's a "human interface device" in Windows. It can pretend to be any model keyboard, and that's probably why it says Apple Pro kb to you.

No memory - just enough to send the keystrokes to type a url to get you to the AMEX site. Pretty clever.

There is NO security against this, as the system sees them exactly as a keyboard, so no way to stop whatever it wants to type. These AMEX ones are benign of course, but I can see people eventually using these type of device for bad things too.