Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 510 views

    SRLabs BadUSB BlackHat v1

    Uploaded by

    Saksbjørn Ihle
    1. USB devices like thumb drives can be reprogrammed to infect computers in various ways, such as changing DNS settings or intercepting internet traffic. The document outlines several proof-of-concept attack scenarios. 2. Reversing and patching USB firmware took less than 2 months. The process involved finding leaked firmware, reverse engineering it, and adding hooks to change functionality. 3. No truly effective defenses against USB attacks exist. Blocking device classes or firmware updates has limitations. Whitelisting is also challenging due to spoofed identifiers and firmware that cannot be read without cooperating malware.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    SRLabs BadUSB BlackHat v1

    Uploaded by

    Saksbjørn Ihle
    510 views22 pages
    1. USB devices like thumb drives can be reprogrammed to infect computers in various ways, such as changing DNS settings or intercepting internet traffic. The document outlines several proof-of-concept attack scenarios. 2. Reversing and patching USB firmware took less than 2 months. The process involved finding leaked firmware, reverse engineering it, and adding hooks to change functionality. 3. No truly effective defenses against USB attacks exist. Blocking device classes or firmware updates has limitations. Whitelisting is also challenging due to spoofed identifiers and firmware that cannot be read without cooperating malware.

    Original Description:

    SRLabs BadUSB BlackHat v1

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    1. USB devices like thumb drives can be reprogrammed to infect computers in various ways, such as changing DNS settings or intercepting internet traffic. The document outlines several proof-of-concept attack scenarios. 2. Reversing and patching USB firmware took less than 2 months. The process involved finding leaked firmware, reverse engineering it, and adding hooks to change functionality. 3. No truly effective defenses against USB attacks exist. Blocking device classes or firmware updates has limitations. Whitelisting is also challenging due to spoofed identifiers and firmware that cannot be read without cooperating malware.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    510 views22 pages

    SRLabs BadUSB BlackHat v1

    Uploaded by

    Saksbjørn Ihle
    1. USB devices like thumb drives can be reprogrammed to infect computers in various ways, such as changing DNS settings or intercepting internet traffic. The document outlines several proof-of-concept attack scenarios. 2. Reversing and patching USB firmware took less than 2 months. The process involved finding leaked firmware, reverse engineering it, and adding hooks to change functionality. 3. No truly effective defenses against USB attacks exist. Blocking device classes or firmware updates has limitations. Whitelisting is also challenging due to spoofed identifiers and firmware that cannot be read without cooperating malware.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 22
    At a glance
    Powered by AI
    USB peripherals provide a versatile infection path. Once infected, malware can use peripherals as a hiding place hindering system clean-up.

    Demo 1 showed a USB stick taking over a Windows machine. Demo 2 showed a Windows infected USB stick infecting a Linux machine after stealing the sudo password.

    The firmware was reversed engineered by loading it into a disassembler, applying heuristics to find functions and descriptors, then adding/changing functionality through hooks injected into unused areas.

    S8Labs 1emplaLe v12

    8aduS8 - Cn accessorles LhaL Lurn evll


    karsLen nohl <nohl[srlabs.de>
    Sascha krller <sascha[srlabs.de>
    !akob Lell <[akob[srlabs.de>
    2
    uemo 1 - US8 snck takes over
    W|ndows mach|ne
    Agenda
    3
    ! US8 background
    ! 8eprogrammlng perlpherals
    ! uS8 auack scenarlos
    ! uefenses and nexL sLeps
    uS8 devlces lnclude a mlcro-conLroller, hldden from Lhe user
    4
    8031 Cu
    8ooLloader
    US8 contro||er
    ConLroller
    rmware
    Mass sLorage
    I|ash
    1he only parL
    vlslble Lo Lhe user
    uS8 devlces are ldenued
    3
    US8 dev|ces Connectors + hubs nost
    8ooL
    hub
    Lxamp|es
    uS8 Lhumb drlve
    8 - Mass SLorage
    AA627090820000000702
    0 - ConLrol
    1 - uaLa Lransfers
    lnLerface class
    Lnd polnLs
    Idennher
    a. 1 - Audlo
    b. 14 - vldeo
    Webcam
    Serlal number 0238A330
    0 - ConLrol
    1 - vldeo Lransfers
    6 - Audlo Lransfers
    7 - vldeo lnLerrupLs
    uS8 devlces are lnluallzed ln several sLeps
    6
    Dev|ces can have
    severa| |dennnes
    ! A devlce lndlcaLes
    lLs capablllues
    Lhrough a
    descrlpLor
    ! A devlce can have
    several
    descrlpLors lf lL
    supporLs muluple
    devlce classes, llke
    webcam +
    mlcrophone
    ! uevlce can
    dereglsLer and
    reglsLer agaln as a
    dlerenL devlce
    ower-on +
    I|rmware |n|t
    Load dr|ver
    8eglsLer
    SeL address
    Send descrlpLor
    SeL congurauon
    normal operauon
    keg|ster aga|n .
    Cpuonal: dereglsLer
    Load another
    dr|ver
    US8 dev|ce
    US8 p|ug-and-p|ay
    Agenda
    7
    ! uS8 background
    ! keprogramm|ng per|phera|s
    ! uS8 auack scenarlos
    ! uefenses and nexL sLeps
    8everslng and paLchlng uS8 rmware Look less Lhan 2 monLhs
    8
    1. llnd leaked rmware and
    ash Lool on Lhe neL
    2. Snl updaLe
    communlcauon uslng
    Wlreshark
    3. 8eplay cusLom SCSl
    commands used for
    updaLes
    4. (8eseL brlcked devlces
    Lhrough shorL-clrculung
    llash plns)
    Document hrmware
    update process
    atch hrmware keverse-eng|neer hrmware
    1. Load lnLo dlsassembler
    (compllcauon: MMu-llke
    memory banklng)
    2. Apply heurlsucs
    - CounL maLches beLween
    funcuon sLarL and call
    lnsLrucuons for dlerenL
    memory locauons
    - llnd known uS8 blL
    elds such as descrlpLors
    3. Apply sLandard soware
    reverslng Lo nd hooklng
    polnLs
    1. Add hooks Lo rmware Lo
    add/change funcuonallLy
    2. CusLom llnker scrlpL complles
    C and assembly code and
    ln[ecLs lL lnLo unused areas of
    orlglnal rmware
    Cther poss|b|e targets
    We focused on uS8 sucks,
    buL Lhe same approach
    should work for:
    ! LxLernal Puus
    ! Webcams, keyboards
    ! robably many more .
    A 8 C
    Agenda
    9
    ! uS8 background
    ! 8eprogrammlng perlpherals
    ! US8 auack scenar|os
    ! uefenses and nexL sLeps
    10
    uemo 2 - W|ndows |nfects US8
    snck wh|ch then takes over
    L|nux mach|ne
    keyboard emulauon ls enough for lnfecuon and prlvllege escalauon
    (w/o need for soware vulnerablllLy)
    11
    Cha||enge - Llnux malware runs wlLh llmlLed user prlvlleges, buL needs
    !""# prlvlleges Lo lnfecL furLher sucks
    Approach - SLeal $%&" password ln screensaver
    8esLarL screensaver
    (or '"()*+,)#) wlLh
    password sLealer
    added vla an
    Lu_8LLCAu llbrary
    ! user enLers password Lo
    unlock screen
    ! Malware lnLercepLs
    password and galns rooL
    prlvlleges uslng $%&"
    rlvllege escalauon
    module wlll be
    submlued Lo MeLasplolL
    12
    uemo 3 - US8 thumb dr|ve
    changes DNS semngs |n W|ndows
    neLwork Lramc can be dlverLed by uPC on uS8"
    13
    Auack steps
    1. uS8 suck spoofs
    LLherneL adapLer
    2. 8eplles Lo uPC query
    wlLh unS server on Lhe
    lnLerneL, buL wlLhouL
    defaulL gaLeway
    kesu|t
    3. lnLerneL Lramc ls sull rouLed
    Lhrough Lhe normal Wl-ll
    connecuon
    4. Powever, unS querles are senL Lo
    Lhe uS8-supplled server, enabllng
    redlrecuon auacks
    DNS ass|gnment ln
    uPC over spoofed
    US8-Lthernet
    adapLer
    All unS
    querles go Lo
    auacker's unS
    server
    8onus: vlrLual Machlne break-ouL
    14
    vM
    PosL
    1. vM LenanL reprograms
    uS8 devlce (e.g., uslng
    SCSl commands)
    3. uS8 devlce spoofs key
    sLrokes, changes unS, .
    2. uS8 perlpherals
    spawns a second
    devlce LhaL geLs
    connecLed Lo Lhe
    vM hosL
    13
    uemo 4 - Andro|d d|verts data
    tramc from W|ndows mach|ne
    Can l charge my phone on your lapLop?" -
    Androld phones are Lhe slmplesL uS8 auack plauorm
    16
    reparanon - Androld comes wlLh an LLherneL-
    over-uS8 emulauon needlng llule congurauon
    Auack - hone supplles defaulL rouLe over uS8,
    eecuvely lnLercepung all lnLerneL Lramc
    uPC overrldes
    defau|t gateway
    over US8-Lthernet
    CompuLer sends all
    lnLerneL Lramc
    Lhrough phone
    nacked by the second factor?
    uslng keyboard emulauon, a
    vlrus-lnfecLed smarLphone
    could hack lnLo Lhe uS8-
    connecLed compuLer.
    1hls compromlses Lhe
    second facLor" securlLy
    model of onllne banklng.
    roof-of-concepL
    released aL:
    sr|abs.de]badusb
    8ooL-secLor vlrus, uS8 sLyle
    17
    n|de rootk|t from CS]AV.
    When an CS accesses Lhe
    suck, only Lhe uS8
    conLenL ls shown
    Infect mach|ne when
    boonng.
    When Lhe 8lCS accesses
    Lhe suck, a secreL Llnux ls
    shown, booung a rooL klL,
    lnfecung Lhe machlne,
    and Lhen booung from
    Lhe uS8 conLenL
    I|ngerpr|nt
    CS]8ICS.
    aLched/ uS8
    suck rmware
    can dlsungulsh
    Wln, Mac,
    Llnux, and Lhe
    8lCS based on
    Lhelr uS8
    behavlor
    uS8 conLenL,
    for example
    Llnux lnsLall
    lmage
    SecreL Llnux
    lmage
    lamlly of posslble uS8 auacks ls large
    18
    More auack |deas Lect
    ! LxLernal sLorage can choose Lo hlde les
    lnsLead of deleung Lhem
    ! vlruses can be added Lo les added Lo sLorage
    ! llrsL access by vlrus scanner sees orlglnal le,
    laLer access sees vlrus
    ! LmulaLe a keyboard durlng booL and lnsLall a
    new 8lCS from a le ln a secreL sLorage area
    on a uS8 suck
    ! LmulaLe a uS8 dlsplay Lo access securlLy
    lnformauon such as CapLchas and randomly
    arranged ln pads
    Auacks shown
    Lmu|ate
    keyboard
    n|de data on
    snck or nDD
    kewr|te data
    |n-|ght
    Update C
    8ICS
    Spoof d|sp|ay
    Spoof
    network
    card
    "US8 boot-
    sector" v|rus
    Agenda
    19
    ! uS8 background
    ! 8eprogrammlng perlpherals
    ! uS8 auack scenarlos
    ! Defenses and next steps
    no eecuve defenses from uS8 auacks exlsL
    20
    rotecnon |dea
    ! uS8 devlces do noL always have a unlque serlal number
    ! CS's don'L (yeL) have whlLellsL mechanlsms
    L|m|tanon
    ! 1he rmware of a uS8 devlce can Lyplcally only be read back
    wlLh Lhe help of LhaL rmware (lf aL all): A mallclous rmware
    can spoof a leglumaLe one
    8|ock cr|nca| dev|ce
    c|asses, b|ock US8
    comp|ete|y
    ! Cbvlous usablllLy lmpacL
    ! very baslc devlce classes can be used for abuse, noL much ls
    le of uS8 when Lhese are blocked
    ! lmplemenLauon errors may sull allow lnsLalllng unauLhorlzed
    rmware upgrades
    ! Secure crypLography ls hard Lo lmplemenL on small
    mlcroconLrollers
    ! 8llllons of exlsung devlces sLay vulnerable
    Wh|te||st US8 dev|ces
    Scan per|phera|
    hrmware for ma|ware
    Use code s|gn|ng for
    hrmware updates
    D|sab|e hrmware
    updates |n hardware
    ! S|mp|e and eecnve
    ! use Lhe
    reprogrammable
    chlps for oLher
    appllcauons Lhan uS8
    sLorage
    ! 1he owswlLch /
    phlson pro[ecL, for
    example, alms for a
    low-cosL uS8 3
    lnLerface for lCAs
    uS8 perlpherals can also be re-programmed for consLrucuve
    purposes
    21
    ldea 2 - kepurpose
    cheap contro||er ch|ps
    ldea 1 - Speed up database quer|es
    ! uaLa can be parsed on Lhe suck before (or lnsLead of)
    sendlng lL back Lo Lhe hosL
    ! Cur orlglnal mouvauon was Lo speed up of A3/1 ralnbow
    Lable lookups
    1ake aways
    22
    Cuesuons?
    usbQsr|abs.de
    ! US8 perlpherals provlde for a versaule
    |nfecnon path
    ! As long as uS8 conLrollers are re-
    programmable, uS8 perlpherals should
    not be shared wlLh oLhers
    ! Cnce lnfecLed - Lhrough uS8 or oLherwlse
    - malware can use perlpherals as a h|d|ng
    p|ace, hlnderlng sysLem clean-up

    You might also like