Tag: USB

Inside a low budget consumer hardware espionage implant

~ hucktech ~ Leave a comment

Wow, amazing!

Inside a low budget consumer hardware espionage implant
Analysis of the S8 data line locator
mich @0x6d696368

The following analysis was performed on a S8 data line locator […]A while back Joe Fitz tweeted about the S8 data line locator1. He referred to it as “Trickle down espionage” due to its reminiscence of NSA spying equipment. The S8 data line locator is a GSM listening and location device hidden inside the plug of a standard USB data/charging cable. It supports the 850, 900, 1800 and 1900 MHz GSM frequencies. Its core idea is very similar to the COTTONMOUTH product line by the NSA/CSS [1] in which an RF device is hidden inside a USB plug. Those hidden devices are referred to as implants. The device itself is marketed as a location tracker usable in cars, where a thief would not be able to identify the USB cable as a location tracking device. Its malicious use-cases can, however, not be denied. Especially since it features no GPS making its location reporting very coarse (1.57 km deviation in my tests). It can, e.g., be called to listen to a live audio feed from a small microphone within the device, as well as programmed to call back if the sound level surpasses a 45 dB threshold. The fact that the device can be repackaged in its sliding case, after configuring it, i.e. inserting a SIM, without any noticeable marks to the packaging suggests its use-case: covert espionage.[…]
I was not able yet to write new firmware via flashrom because I was not able to disable block protection on the flash, yet. Maybe a different avenue for flashing new firmware could be the SPFlash tool4 and/or the Flash tool. However, that would not be open source. If know something about the weird FAT12 file system used in the device or are able to flash your S8 data line locator please contact me with details![…]
No writeup would be complete without at least one fuck up. So here it is: While using the S8 data line locator with OpenBTS I provisioned imaginary numbers. When switching SIM cards I forgot to turn of the voice activated callback. So long story short, some guy with the number 3333333 listend in on me for 2 minutes:

Provider call log fail.Provider call log fail. I did not notice this until I reviewed the logs! So my resume on these little hardware espionage implants: They are stealthy and dangerous as fuck![…]

https://ha.cking.ch/s8_data_line_locator/

Many vulnerabilities found in Linux kernel USB subsystem by syzkaller

~ hucktech ~ Leave a comment

https://twitter.com/kayseesee/status/927923337543655424

Andrey Konovalov posted a bunch of Linux USB vulnerabilities to the OSS-Security list, found using the syzkaller Linux system call fuzzer.

Hi! Below are the details for 14 vulnerabilities found with syzkaller in the Linux kernel USB subsystem. All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine. There’s quite a lot more similar bugs reported [1] but not yet fixed.[…]

The first message had 14 vulns:
http://www.openwall.com/lists/oss-security/2017/11/06/8
This second message has 8 more:
http://www.openwall.com/lists/oss-security/2017/11/08/2

https://github.com/google/syzkaller/blob/master/docs/linux/found_bugs_usb.md
https://github.com/google/syzkaller

Google syzkaller – Linux syscall fuzzer

 

 

 

Positive Technologies: JTAG in each house: full access via USB

~ hucktech ~ Leave a comment

It is amazing to see the Intel ME research coming out of Positive Technologies!

From Google Translate:

JTAG in each house: full access via USB

Researchers at Positive Technologies have activated hardware debugging (JTAG) for Intel Management Engine, which allows full access to all PCH devices (Platform Controller Hub) using Intel DCI technology (via USB interface). We plan to share the details at one of the nearest conferences. And how to activate this interface, but for the main processor, we will tell below.[…]

https://habrahabr.ru/company/pt/blog/341946/

https://translate.google.com/translate?hl=en&sl=ru&u=https://habrahabr.ru/company/pt/blog/341946/

Intel ME is the new “Pandora’s Box”, defenders are going to need bigger (better) tools… 😦

ChipEasy

~ hucktech ~ Leave a comment

Apparently there’s a Windows binary called ChipEasy that helps diagnose USB devices. I can’t find the source code, and am not sure of the official home page. 😦 It appears to be closed source, so take extra care if you dare to risk running freeware these days. Please leave a Comment on this blog post if you can point out a better tool, hopefully something open source.

http://www.upan.cc/tools/test/ChipEasy_EN.html

 

FirmUSB: Vetting USB Device Firmware using Domain Informed Symbolic Execution

~ hucktech ~ Leave a comment

FirmUSB: Vetting USB Device Firmware using Domain Informed Symbolic Execution
Grant Hernandez, Farhaan Fowze, Dave (Jing) Tian, Tuba Yavuz, Kevin R. B. Butler
(Submitted on 30 Aug 2017)

The USB protocol has become ubiquitous, supporting devices from high-powered computing devices to small embedded devices and control systems. USB’s greatest feature, its openness and expandability, is also its weakness, and attacks such as BadUSB exploit the unconstrained functionality afforded to these devices as a vector for compromise. Fundamentally, it is virtually impossible to know whether a USB device is benign or malicious. This work introduces FirmUSB, a USB-specific firmware analysis framework that uses domain knowledge of the USB protocol to examine firmware images and determine the activity that they can produce. Embedded USB devices use microcontrollers that have not been well studied by the binary analysis community, and our work demonstrates how lifters into popular intermediate representations for analysis can be built, as well as the challenges of doing so. We develop targeting algorithms and use domain knowledge to speed up these processes by a factor of 7 compared to unconstrained fully symbolic execution. We also successfully find malicious activity in embedded 8051 firmwares without the use of source code. Finally, we provide insights into the challenges of symbolic analysis on embedded architectures and provide guidance on improving tools to better handle this important class of devices.

https://arxiv.org/abs/1708.09114

 

Red Hat released RHEL 7.4

~ hucktech ~ Leave a comment

One new feature that is news to me:

USB Guard, a feature that allows for greater control over how plug-and-play devices can be used by specific users to help limit both data leaks and data injection.

https://www.redhat.com/en/about/press-releases/red-hat-bridges-hybrid-multi-cloud-deployments-latest-version-red-hat-enterprise-linux-7

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html

 

USB Crosstalk Leakage Attacks on USB Hubs

~ hucktech ~ Leave a comment

USB Snooping Made Easy: Crosstalk Leakage Attacks on USB Hubs
Yang Su, Damith Ranasinghe, Daniel Genkin, Yuval Yarom

The Universal Serial Bus (USB) is the most prominent interface for connecting peripheral devices to computers. USB-connected input devices, such as keyboards, card-swipers and fingerprint readers, often send sensitive information to the computer. As such information is only sent along the communication path from the device to the computer, it was hitherto thought to be protected from potentially compromised devices outside this path. We have tested over 50 different computers and external hubs and found that over 90% of them suffer from a crosstalk leakage effect that allows malicious peripheral devices located off the communication path to capture and observe sensitive USB traffic. We also show that in many cases this crosstalk leakage can be observed on the USB power lines, thus defeating a common USB isolation countermeasure of using a charge-only USB cable which physically disconnects the USB data lines. Demonstrating the attack’s low costs and ease of concealment, we modify a novelty USB lamp to implement an off-path attack which captures and exfiltrates USB traffic when connected to a vulnerable internal or a external USB hub.

Click to access camera.pdf

Umap2: USB host security assessment tool

~ hucktech ~ Leave a comment

Umap2 is the second revision of NCC Group’s python based USB host security assessment tool. This revision will have all the features that were supported in the first revision:

* umap2emulate – USB device emulation
* umap2scan – USB host scanning for device support
* umap2detect – USB host OS detection (no implemented yet)
* umap2fuzz – USB host fuzzing

In this revision there will be some additional features:

* USB host fuzzing uses kitty as fuzzing engine
* Umap2 not only contains executable scripts, but is also installed as a package and may be used as a library

Umap2 is developed by NCC Group and Cisco SAS team.[…]

 

https://github.com/nccgroup/umap2
http://goodfet.sourceforge.net/hardware/facedancer21/

See-also:

https://blog.flameeyes.eu/2017/06/free-idea-a-qemu-facedancer-fuzzer/

 

Building a USB analyzer with USB armory

~ hucktech ~ Leave a comment

https://twitter.com/osxreverser/status/875036408133627904

 

Armory Sandbox – Building a USB analyzer with USB armory
June 14, 2017
By Pedro Vilaca
Some time ago a friend received a mysterious USB pen with a note talking about some kind of heavily persistent malware. He had that USB pen stored untouched and of course my curiosity took over. Since one should never plug in unknown USB devices into a computer (well, any USB device we purchase is unknown but that is another story) and I didn’t want to “burn” a computer just to take a look at the contents I decided to use my USB armory to build an air gap sandbox that would be harder to infect and for malware to escape from it.[…]

https://sentinelone.com/blogs/armory-sandbox-building-usb-analyzer-usb-armory/

USB attack to Mazda cars: Bad Valet attack

~ hucktech ~ Leave a comment

“Bad Valet is the new Evil Maid” –Joanna Rutkowska

 

“A PoC that the USB port is an attack surface for a Mazda car’s infotainment system and how Mazda hacks are made.”

https://github.com/shipcod3/mazda_getInfo

 

Vape Pens: source of USB attacks

~ hucktech ~ Leave a comment

https://twitter.com/FourOctets/status/867764655954866176

If you have a vaping device, make sure it supports Verified/Secure/Trusted/etc Boot. 🙂

[…]Take this as the weirdest example yet that you should never plug random devices into your USB ports. […] While FourOctets has no ill-intent, it is easy to imagine someone less scrupulous loading a computer with something not quite as funny. Like, say, a keylogger. Or ransomware.[…]

http://mashable.com/2017/05/26/vaping-digital-security-virus-usb/#iAjGmK3E0mqd

A related presentation, as suggested from a poster in the above twitter thread:

Holy smokes, how to vape yourself to root
Ross Bevington
Abstract: We all know that smoking is bad for your health, but what about you or your organisations security? I’ll show you that an eCig isn’t just a glorified smoke machine but a low power, battery operated, exploitation platform. I’ll show you how easy it is to decrypt the firmware, write your own functionality and use this to pwn some systems. Turning your eCig into everything from a keyboard to a USB stick. On the way we’ll do a bit of reverse engineering, write a bit of code and show how you can do most of this on a shoe string budget. Looking for ways to defend against attacks like this? I have some options. Consider this talk if you want another reason to ban smoking at your organisation.

https://www.securitybsides.org.uk/talksubmissions.html

Hidviz: GUI USB HID class device analyzer

~ hucktech ~ Leave a comment

 

Hidviz is a GUI application for in-depth analysis of USB HID class devices. The 2 main usecases of this aplication are reverse-engineering existing devices and developing new USB HID devices. USB HID class consists of many possible devices, e.g. mice, keyboards, joysticks and gamepads. But that’s not all! There are more exotic HID devices, e.g. weather stations, medical equipment (thermometers, blood pressure monitors) or even simulation devices […]

Hidviz screenshot

AMI adds RNDIS Network Driver Support in Aptio V

~ hucktech ~ Leave a comment

American Megatrends Inc. (AMI), a global leader in BIOS and UEFI firmware, server and remote management tools, data storage products and unique solutions based on the Linux® and Android™ operating systems is proud to announce Remote NDIS (RNDIS) network driver support for Aptio V UEFI Firmware. The Remote Network Driver Interface Specification (RNDIS) is a Microsoft® specification that allows for remote communication between a host server and RNDIS network device connected using a USB cable. RNDIS messages are sent via the host server to the RNDIS device and the host server can provide support for multiple networking devices connected to a USB bus. The support for RNDIS devices in Aptio V is convenient for hardware vendors because with the standardized interface of RNDIS, the need to develop drivers to support USB LAN adapters conforming to RNDIS specification is eliminated. OEMs including the RNDIS network driver in the BIOS allow end users to plug and play with RNDIS supported USB LAN adapters. Aptio V RNDIS network driver also allows the BIOS to communicate with the Baseboard Management Controller (BMC) that supports the RNDIS specification, commonly referred to as LAN over USB.[…]

https://ami.com/en/news/press-releases/?PressReleaseID=389

 

 

Lenovo USB malware

~ hucktech ~ Leave a comment

IBM Storwize for Lenovo initialization USB drives contain malware
Lenovo Security Advisory: LEN-14957
Potential Impact: Malware infection on system used to launch initialization tool
Severity: Medium

Some USB flash drives containing the initialization tool shipped with the IBM Storwize for Lenovo V3500, V3700 and V5000 Gen 1 storage systems manufactured by IBM contain a file that has been infected with malicious code. The malicious file does not in any way affect the integrity or performance of the storage systems. When the initialization tool is launched from the USB flash drive onto a computer used for initial configuration, the tool copies itself to a temporary folder on the hard drive of the desktop or laptop during normal operation. With that step, the malicious file is copied with the initialization tool to the following temporary folder:

On Windows systems: %TMP%\initTool
On Linux and Mac systems: /tmp/initTool

Important:  While the malicious file is copied onto the computer, the file is not executed during initialization and is not run unless a user manually executes it. The infected file does not affect the IBM Storwize for Lenovo system. The initialization tool is only used to write a text file on the USB key, which is then read by Storwize, which will then write a separate text file onto the key. At no point during the time that the USB thumb drive is inserted in the Storwize system is any information copied from the thumb drive directly to the Storwize system, nor is any code executed on the Storwize system.  

The affected Initialization USB flash drive looks like the images below, and contains a folder called InitTool.[…]

 

https://support.lenovo.com/us/en/product_security/len-14957