00:00:00.000-->00:00:05.005 >>Hi everybody, I'm uh, Mark and this is.. oh you self introduce >> And I'm Rob. >> And this is 00:00:07.107-->00:00:11.345 if you give a mouse a microchip, it will execute a payload and cheat at your high stakes 00:00:11.345-->00:00:15.716 videogame tournament, and this is gonna to be a talk about video games, little bit of 00:00:15.716-->00:00:19.553 hardware hacking little bit of vulnerability research, and a lot of trying it out at home. 00:00:19.553-->00:00:24.558 Ah, can't do that either. Alright so brief history of competitive gaming, 19 uh 58, 00:00:32.065-->00:00:38.972 kinda the first video game, uh, you know you're kinda precursor at a pong or a break out. 1972 00:00:38.972-->00:00:44.778 is the first recorded sponsored video game tournament. It was a game called SpaceWar built in 00:00:44.778-->00:00:49.783 the uh 1960's and that was a like five or six player game uh competitive, had to run on 00:00:51.818-->00:00:58.492 gigantic lab computers and Rolling Stones sponsored a Space War Olympics in '72. Uh, the 00:00:58.492-->00:01:03.196 prize for which was a subscription to Rolling Stone. Which I assume was worth more 00:01:03.196-->00:01:08.201 back then than it is now. [laughter] This is a picture from last year at uh The 00:01:11.171-->00:01:16.176 International, which is a uh Dota 2 tournament, and The International 2016 had teams 00:01:19.012-->00:01:24.952 from all over the entire world. It had a twenty million dollar prize pool. Nineteen million of 00:01:24.952-->00:01:31.391 which was crowdfunded by fans of the game, buying in game cosmetics and game items. 00:01:31.391-->00:01:37.364 Seventeen thousand people were watching that game at the venue live and over five million 00:01:37.364-->00:01:42.102 people were concurrently watching the finals online for the for the grand finals, so 00:01:42.102-->00:01:48.875 over forty years eSports has gotten a little bit bigger and you can kinda see, you know, 00:01:48.875-->00:01:54.948 that there's some money riding on it now. So, eSports events have some kind of unique 00:01:54.948-->00:02:00.020 security challenges, you've got these massive temporary networks that have been setup in a matter 00:02:00.020-->00:02:04.558 of days maybe weeks if you are lucky and they might only be used for three or four days. And 00:02:04.558-->00:02:10.097 you know you're setting them up at convention centers or in sports arenas. You've got up to 00:02:10.097-->00:02:13.934 a hundred or two hundred computers or you know other gaming systems being plugged 00:02:13.934-->00:02:19.406 into them potentially. Uh, and you've got hot seat computers, so you know you'll have stage 00:02:19.406-->00:02:23.644 computers that are set up and some teams will play on them and then they will get off stage the 00:02:23.644-->00:02:27.981 next set of teams will play on them and you're going to have all these different people using 00:02:27.981-->00:02:32.552 these machines over the course of the day or the weekend. These computers generally require 00:02:32.552-->00:02:37.457 internet connectivity because pretty much every popular game nowadays has to phone home so 00:02:37.457-->00:02:41.561 that you know they are making sure you're not playing on your own private servers or uh you 00:02:41.561-->00:02:47.801 know doing anything illegal and most of these tournaments require you to support player 00:02:47.801-->00:02:51.071 own peripherals. You know everyone bring their own mouse, everyone brings their keyboard. 00:02:51.071-->00:02:55.742 They are familiar with their devices. You know, they like how they work, or often times they 00:02:55.742-->00:03:00.680 have an obligation to use their sponsored brand of devices as well. Computers at these events 00:03:05.986-->00:03:11.525 typically close a lot of kinda obvious attack vectors, uh, you have internet access restricted 00:03:11.525-->00:03:16.596 so you can't go to csgocheats dot com and download some EXE's right uh player accounts don't 00:03:16.596-->00:03:21.735 have admin that's kind of a gimme. Drivers and configs are often pre-installed uh a lotta 00:03:21.735-->00:03:27.641 times you'll have hot swappable SSD's and every player has a storage device associated with 00:03:27.641-->00:03:32.879 them so that when they plug it into a computer all of their drivers and setup and you know 00:03:32.879-->00:03:37.684 everything is all good to go. USB mass storage is disabled so you can't run your executables 00:03:37.684-->00:03:43.190 off of a thumb drive you sneak in there. And extra USB ports are disabled often in the bios 00:03:43.190-->00:03:48.662 and sometimes even by dumping some epoxy in there. But again, these players are able to plug 00:03:48.662-->00:03:54.367 their own mouse and keyboard into the computer. So, I decided, to heck with the mouse 00:03:54.367-->00:03:59.973 Uh, Why? I found a mouse with what I consider to be an overpowered microcontroller. Uh, 00:03:59.973-->00:04:06.012 and then I found out more recently that a whole bunch of different mice from our wide 00:04:06.012-->00:04:10.617 variety of manufacturers are using the same family of microcontrollers that has a 00:04:10.617-->00:04:16.456 whole, you know, bunch of extra capabilities that they're not really needing. And I, you know, 00:04:16.456-->00:04:21.995 Anecdotally I think there's not really enough scrutiny over devices at these eSports 00:04:21.995-->00:04:27.000 tournaments, just from what I've observed. Oh, we're missing an image. Alright, so I have a 00:04:30.170-->00:04:36.910 gaming mouse with a STMicro STMF, uh, 32F103 CB microcontroller. Uh, It's an arm 00:04:36.910-->00:04:42.682 cortex M3 processor, um, it supports their uh ST-Link programming interface, just to 00:04:42.682-->00:04:48.855 build a reprogram aid easily. And 128KF Flash Memory, that's, that's a lot of space. And I'm 00:04:48.855-->00:04:54.528 hoping that there is some space in there for me to add some additional code. Uh, it's got 00:04:54.528-->00:05:01.401 lots of buttons it's got RGB LEDs, you know, make the kids buy it. So the goal here is to 00:05:01.401-->00:05:06.273 connect to the microcontroller that's built into this mouse, insert some code that acts as a 00:05:06.273-->00:05:11.878 USB keyboard and when you plug the mouse in, sends a whole bunch of keystrokes to you know 00:05:11.878-->00:05:17.184 create and then execute the payload on the targeted computer, unplug itself and run 00:05:17.184-->00:05:21.988 the original mouse code and like the key point here is I show up to this eSports tournament I've 00:05:21.988-->00:05:26.860 got my mouse and my keyboard if I plug the mouse in and it does, you know, whatever and then it 00:05:26.860-->00:05:31.131 doesn't work after that, well now I don't have a mouse. And if I show up there, I plug a mouse 00:05:31.131-->00:05:35.702 in, I look around real sneakily, and then I unplug that mouse and I throw it away and I plug 00:05:35.702-->00:05:42.442 another mouse in. Also kind of obvious. So, we want to be able to like hide our you know code 00:05:42.442-->00:05:47.447 injection in the mouse and still be able to use the mouse afterwards you know less 00:05:50.550-->00:05:57.324 obvious. So, record scratch. Isn't that just a rubber ducky in a mouse? Yes, it is. 00:05:57.324-->00:06:03.630 [laughter] Uh, the one of the take aways of this presentation is that all USB devices have 00:06:03.630-->00:06:07.667 microcontrollers in them and whether it's like an eight kilobyte pick microcontroller or 00:06:07.667-->00:06:14.374 a one megabyte you know arm super overpower microcontroller any USB device can you know 00:06:14.374-->00:06:18.745 someone can open it up attach to that microcontroller and really replace the code that's on it 00:06:18.745-->00:06:23.750 with anything they want. So, these are the hardware tools we used if you wanna try this at 00:06:25.886-->00:06:30.891 home uh there's the STMicro discovery development board. Which is uh it has both an on 00:06:33.426-->00:06:38.898 board arm processor that you can use to like initially test and develop your your code whatever 00:06:38.898-->00:06:44.537 you want to do with it and it also has uh some jumpers that you can disconnect that let you 00:06:44.537-->00:06:49.042 program any external arm devices so it can be used both for development and for attaching to 00:06:49.042-->00:06:54.014 your target device. And one of the most convenient things about these boards is that they cost 00:06:54.014-->00:06:58.418 like ten or fifteen bucks so there is a very low barrier to entry to doing this kind of 00:06:58.418-->00:07:04.057 thing. Um, and then you need a mouse with an arm cortex processor or whatever else 00:07:04.057-->00:07:09.529 you're targeting. Uh you need a soldering iron, you need some wires. Software tools, these are 00:07:09.529-->00:07:14.801 all free. Uh, STMicro made the processor we were looking at. So we just basically used their 00:07:14.801-->00:07:19.039 whole suite of free utilities and then you know we got into objdump at the end because we 00:07:19.039-->00:07:24.077 needed to be able to look inside the binaries and we didn't have the money for AIDA. [off mic] 00:07:24.077-->00:07:29.082 >>sponsor us. [laughter] Alright so, we open this mouse up, and we see a microcontroller, it's 00:07:33.386-->00:07:37.457 pretty small you got a mouse wheel there for size. We need to talk to this microcontroller 00:07:37.457-->00:07:42.262 somehow. So we're gonna go to the documentation, We're going to find this iChart that you see 00:07:42.262-->00:07:47.267 on the right, and it's got you know a whole bunch of teeny tiny text on it and you look through 00:07:49.302-->00:07:54.407 it with a magnifying glass and you find out that for the ST-Link programming interface 00:07:54.407-->00:07:59.412 you need pin 14 for clock pin 13 for uh digital like data in out and uh the ground pin. And then 00:08:01.581-->00:08:07.687 you get really excited, and you pound a couple beers. And you're like I'm a really good solderer 00:08:07.687-->00:08:12.392 [laughter] and you know I used to do this in college and I had a microscope back then and 00:08:12.392-->00:08:17.263 really good equipment and now I have like this little thing that doesn't even melt the solder, 00:08:17.263-->00:08:23.470 but you're like I'll do it anyways and you get this, uh, those pins are real screwed up. 00:08:23.470-->00:08:28.475 [laughter] And this was the first mouse we lost. So, then I flipped the board over and I 00:08:33.146-->00:08:38.151 found solder pads for ground clock and data [laughter] [clapping] Which are the exact 00:08:45.291-->00:08:50.897 pins I needed right, so the take away here is that if you spend thirty seconds to look at both 00:08:50.897-->00:08:55.902 sides, right? [laughter] You can avoid nuking a sixty eighty dollar mouse. So we're onto the 00:08:59.706-->00:09:03.743 second piece of hardware and we've got our you know wires connected and we're doing a lot 00:09:03.743-->00:09:09.883 better. Uh, this slide is more to help you along if following at home this just describes the 00:09:09.883-->00:09:15.455 pins on the uh development board that you need to connect to the pins we just soldered from the 00:09:15.455-->00:09:20.193 mouse, so you can look at that if you want to re create it. This is that discovery board 00:09:20.193-->00:09:26.232 we've got this ST-Link connection jumper. You pop those two jumpers off, plug your wires 00:09:26.232-->00:09:32.806 into the mouse. This is our required uh hacking picture where we have wires you know 00:09:32.806-->00:09:36.843 exploding all over the place and some uh you know some exposed circuit boards every 00:09:36.843-->00:09:43.249 presentation has to have one of these. Oh, and my uh highly technical insulating scotch 00:09:43.249-->00:09:47.353 tape. Because I didn't have electrical tape on hand. [laughter] So we're attached to 00:09:47.353-->00:09:54.127 the mouse it's plugged into our you know programming interface. We plug it in and it's still 00:09:54.127-->00:09:59.332 doing mouse things because the manufacturer, very smartly, disabled things like debug and 00:09:59.332-->00:10:03.203 reprogramming when it's plugged in and you know out in production, so good job, that 00:10:03.203-->00:10:08.208 was awesome. Uh but we have physical access to this thing we've opened it up we've read 00:10:08.208-->00:10:14.514 the manual so we know how to get it into a you know appropriate programmable mode so. This was a 00:10:14.514-->00:10:19.252 little bit trickier because there weren't any convenient pads for this so using one 00:10:19.252-->00:10:26.159 strand of stranded core wire applied three volts to the boot zero pin. Which there's an arrow 00:10:26.159-->00:10:31.231 pointing towards it. And ended up actually smoking another mouse doing this because we 00:10:31.231-->00:10:36.569 shorted it out to another voltage line on the processor. It's uh it's a little tricky. 00:10:36.569-->00:10:43.142 But on the third mouse we finally connected to the micro controller and this is the 00:10:43.142-->00:10:47.847 ST-Link utility you can see we're getting uh you know a bunch of hex information and the 00:10:47.847-->00:10:54.354 memory there and you know we're in. If we want to keep the mouse working and we want to add code 00:10:54.354-->00:10:59.626 to it we probably want to save this original set of firmware that's running on it. If we just 00:10:59.626-->00:11:05.798 pull this off and modify it and screw it up, we're gonna have to go buy a fifth mouse and I'm 00:11:05.798-->00:11:11.905 running out of uh, my mouse budget is drying up. So, we're gonna extract this original 00:11:11.905-->00:11:16.643 mouse bearing we're going to build an application that registers as a keyboard, uh 00:11:16.643-->00:11:22.115 dumps a whole bunch of text on the computer, saves it and then, you know, executes that program. 00:11:22.115-->00:11:27.453 And we are gonna find empty space in the mouse's binary and insert our application. And 00:11:27.453-->00:11:33.459 we're kinda just hand waving through that uh code dumping uh software because it would be 00:11:33.459-->00:11:38.464 really boring to explain to you how to just write arm code so we're just gonna go through the 00:11:41.501-->00:11:47.206 interesting parts of the hack instead. >>Alright so once we're connected, we're gonna open up 00:11:47.206-->00:11:51.844 Notepad, we're gonna type out and encoded powershell script which is gonna decompress 00:11:51.844-->00:11:57.050 itself, fork and execute into the background and then it's just gonna delete itself after 00:11:57.050-->00:12:02.855 forking cause, you know, we don't want to leave any traces, right? So, what the mouse itself 00:12:02.855-->00:12:07.493 is gonna do is it's gonna is save that to temphack dot bat and that's because generally 00:12:07.493-->00:12:11.598 speaking as a user we can usually write to temp or somewhere along those lines. 00:12:11.598-->00:12:16.603 We're going to close Notepad and then we're gonna run that temphack dot bat. Um, I think it 00:12:19.005-->00:12:25.411 really speaks to Mark and I's friendship that when I was writing this hack, um, overall, 00:12:25.411-->00:12:30.249 so first off there's this bay sixty-four encoded like powershell script and then even 00:12:30.249-->00:12:36.723 beyond that I actually wrote a little hex or python script that would convert it to hex that he 00:12:36.723-->00:12:41.728 just dumped into a care buffer in the code itself and then just you know trusted to run that so, 00:12:46.399-->00:12:52.005 kudos for trust. [laughter] And so this is um basically a slide if you're following along at 00:12:52.005-->00:12:57.010 home on basically the syntax to use for objdump to essentially adjust things and get it to 00:12:59.445-->00:13:06.185 basically output in the right form and so what we're, what what're really looking for here 00:13:06.185-->00:13:11.190 is a nice big spot of like just tons of zeros to put our code in and it looks like we found that. 00:13:15.995-->00:13:20.500 >>Alright so this is gonna get a little dry for a couple seconds here but this is kinda the 00:13:20.500-->00:13:27.206 important information you need to know if you want to uh build and arm application at an offset 00:13:27.206-->00:13:30.977 in that arm processor cause they expect to start at that beginning and uh that's not 00:13:30.977-->00:13:35.682 gonna work for us so there's this uh since we've, since we've found a whole bunch of zeros at 00:13:35.682-->00:13:41.154 address you know ten A zero zero in that binary we think hey that's probably a good place to 00:13:41.154-->00:13:46.926 put our code so we need to edit some file to link and so that you know the software knows and 00:13:46.926-->00:13:52.732 compiles for that location. In this flash dot ld file there's actually two important things 00:13:52.732-->00:13:58.971 that we've found, uh, it defines the size of the stack here an arm stack is subtractive so 00:13:58.971-->00:14:04.043 that's both like that starting point and the size. When we were looking at the binary from the 00:14:04.043-->00:14:10.183 mouse we noticed that it had a very small stack, uh A seventy and all the software we were 00:14:10.183-->00:14:16.089 building had a stack size of like five thousand. Much larger. And when we tried to run our 00:14:16.089-->00:14:21.194 code with that a default stack size from the mouse it just completely didn't work we needed 00:14:21.194-->00:14:26.933 way more space so that's one of the values that we had to modify. Uh, the other thing is 00:14:26.933-->00:14:31.904 that, you know just specifying the flash memory area instead of just starting at address eight 00:14:31.904-->00:14:37.543 million it starts at address eight million ten A zero zero. And then over in the system dot 00:14:37.543-->00:14:41.948 c file we're defining the vector table offset for that same starting point because there's a 00:14:41.948-->00:14:46.953 vector table at the beginning your arm program and that's uh important. So the arm boot 00:14:49.122-->00:14:54.026 process uh by default address eight million contains this vector table that I just 00:14:54.026-->00:14:58.531 mentioned. The very first piece of information stored there is the location of the stack 00:14:58.531-->00:15:02.668 pointer and ram again it's subtractive so it's basically like the size and the location 00:15:02.668-->00:15:09.242 all in one. And then at address four is the location of the entry point of your program. So 00:15:09.242-->00:15:14.781 that processor gets power, it sets the stack pointer and then it immediately bre-branches to 00:15:14.781-->00:15:21.087 the address at that offset zero four. And then on the right there's this little gotcha for 00:15:21.087-->00:15:27.760 arm programming uh if you're doing any branch operation you have to have bid zero be a one 00:15:27.760-->00:15:33.699 or else they'll hard fault on you and it's just telling the processor some internal uh 00:15:33.699-->00:15:39.872 execution mode. So, how do we execute our code? We'll patch the vector table. To get the 00:15:39.872-->00:15:44.510 mouse to run the application we need to find the entry point of the code that we built and 00:15:44.510-->00:15:49.949 fortunately we uh set or so we have to do this objdump again. Do it at the memory offset of 00:15:49.949-->00:15:54.720 you know what we're running our code out of and then we just look at the beginning of that 00:15:54.720-->00:15:59.725 file and we can see that you know our codes entry point is 8013625. So we're gonna patch 00:16:02.361-->00:16:06.833 the values at zero zero and zero four and that binary we extracted from the mouse with 00:16:06.833-->00:16:12.872 these new values. So on the left in this ST-Link utility we've got that, you know two million 00:16:12.872-->00:16:18.211 A7 seventy and then eight million one four one and then we just updated those two memory 00:16:18.211-->00:16:25.084 locations for our new code. And now we need to add it to the binary so using your hex editor 00:16:25.084-->00:16:29.255 of choice, navigate to that offset in the code where hopefully all those zeros are 00:16:29.255-->00:16:34.260 and use the elite hacker tool copy paste to add all of your code into that into that binary. 00:16:37.430-->00:16:43.870 So, the mouse should now run our application and it did, but it didn't do anything else. So I 00:16:43.870-->00:16:48.941 plugged it in I got this whole keyboard dumping thing it you know I typed up my program. 00:16:48.941-->00:16:54.080 Saved it and executed. I gave myself a whole bunch of highfives uh but then it just 00:16:54.080-->00:16:59.185 sits there and it's a dumb brick afterwards, so, we need to make it return to the original 00:16:59.185-->00:17:02.822 functionality. And this is where I called my buddy Rob, and he gave me a whole bunch of help 00:17:02.822-->00:17:07.827 here. >>So, overall um the really cool thing is you can actually turn basically any 00:17:12.465-->00:17:18.237 device into a rubber duck using the process that we just described using nothing but C 00:17:18.237-->00:17:23.743 code. So , now the cool thing is to be able to do this kinda stuff and retain the original 00:17:23.743-->00:17:29.315 functionality of whatever device you're using. And so in comes some sneaky assembly usage where 00:17:29.315-->00:17:36.188 we essentially need to save the state of the mouse kinda as it was before. So this is uh a 00:17:36.188-->00:17:42.361 picture of how the entire memory of the mouse essentially looks like. And so like from the 00:17:42.361-->00:17:48.134 vector table down to the mouse entry and the mouse and that hack main and the hack end and 00:17:48.134-->00:17:53.372 the hack entry. And then below that's a little bit of our, our own little data that we inserted 00:17:53.372-->00:17:57.310 there so all of this is basically just going um everything in red is essentially 00:17:57.310-->00:18:03.349 in main at that point and so the control flow as the vector table's going to kick us off and 00:18:03.349-->00:18:09.288 it's gonna hit the hack entry. Which is then going to call into hack main and then once we're 00:18:09.288-->00:18:15.461 done executing our payload we're actually just gonna fall through to the end of the you know just 00:18:15.461-->00:18:21.167 in to the like last assembly that's there which then calls into the mouse entry point which 00:18:21.167-->00:18:26.672 then runs the mouse. Or in your case if you are doing any other like device that you want to use 00:18:26.672-->00:18:33.212 it would be that instead. So, this is just um some of the assembly for what's going on in 00:18:33.212-->00:18:38.451 each of these pieces. So this first part is now our new entry point. So when we patch the 00:18:38.451-->00:18:43.990 vector table this is the first thing we do. So one of the things we needed to save is the 00:18:43.990-->00:18:49.161 address of the stack pointer, um, that the boot loader gave to us to start with, and we also 00:18:49.161-->00:18:53.532 need to push any of the registers that the boot loader might have set up for us that 00:18:53.532-->00:18:58.204 the mouse is going to need. So for any of you that have ever like written a pac or done any 00:18:58.204-->00:19:05.144 hot patching this is kind of how you make sure you don't mess up the state of the thing itself. 00:19:05.144-->00:19:11.751 Finally we're gonna load our hack entry into arm zero and go ahead and branch. So now after 00:19:11.751-->00:19:16.389 our application's run and we've done everything bad that we wanna do we're gonna fall 00:19:16.389-->00:19:21.293 through here to this jump to mouse code and essentially this is just gonna restore everything 00:19:21.293-->00:19:25.698 back the way it was, so essentially putting the stack pointer back um restoring the 00:19:25.698-->00:19:31.303 registers, loading the desired stack size that the mouse originally wanted, 'cause we had 00:19:31.303-->00:19:36.742 different stack sizes and then setting the stack pointer going ahead and loading back to you 00:19:36.742-->00:19:41.547 know back into arm zero the entry point of the mouse itself, and then branching to the 00:19:41.547-->00:19:46.585 original mouse code. And then this is a slide that just basically describes the data 00:19:46.585-->00:19:52.858 that kinda follows after that. These are all of our offsets and other things that we put in 00:19:52.858-->00:19:58.064 there. Uh, the really cool thing about when you do in-line assembly in C's you can actually 00:19:58.064-->00:20:03.002 use labels. They're really helpful and they save you a lot of time. And then, oh sorry, and 00:20:03.002-->00:20:07.740 at the very end we put Feed Beef Which is just some bread crumbs cause it get really annoying to 00:20:07.740-->00:20:12.678 find your code over and over again so this was just to find it very quickly and it'll save 00:20:12.678-->00:20:17.683 you some time. >>So now we thought that we had you know everything good and ready to go. 00:20:20.753-->00:20:27.059 We had, you know, this whole control flow where we power on we execute our code, we restore 00:20:27.059-->00:20:32.798 the processor state to it's original you know initialized area. We branched back to the 00:20:32.798-->00:20:39.305 mouse code, and we have a mouse. Unfortunately what actually happened was we plug it in, it 00:20:39.305-->00:20:46.278 runs our code. It, you know, our USB hardware input device stops it goes to the mouse's we like 00:20:46.278-->00:20:51.383 see the mouse initialization happen and then it faults somewhere in my code uh tries to 00:20:51.383-->00:20:56.055 initialize again and we were just getting in this like infinite reset loop on this 00:20:56.055-->00:20:59.692 mouse where it was initializing and initializing and initializing and initializing. 00:20:59.692-->00:21:05.564 And one of the more difficult things about this like I mentioned was that when the 00:21:05.564-->00:21:11.604 mouse code initialized all of the debugging was disabled so I didn't have any insight as to 00:21:11.604-->00:21:16.709 what was happening and I you know it was basically a black box that kept turning on and 00:21:16.709-->00:21:20.980 turning off and turning on and turning off. So I'm thinking like, how can I fix this? you 00:21:20.980-->00:21:24.817 know I don't have any information and I'm looking up how debugging works on Arm and 00:21:24.817-->00:21:31.056 I'm like well debugging requires interrupts and I can debug my code maybe I can make some 00:21:31.056-->00:21:34.560 changes to this binary or you know maybe I've screwed something up in these interrupt 00:21:34.560-->00:21:40.332 tables by having my code run before the mouse's code is running. So I you know did a 00:21:40.332-->00:21:46.572 little bit of research and found out the arm interrupts use this change processor state command 00:21:46.572-->00:21:52.811 and there's a CPSIE to enable interrupt CPS I need to disable interrupts and there's some 00:21:52.811-->00:21:58.450 flags for configurable handlers and all fault handlers and at this point I'm thinking you know 00:21:58.450-->00:22:02.121 I'm using interrupts but I'm probably using, you know different interrupts that the 00:22:02.121-->00:22:06.225 mouse is using cause it need to be able to register all these button clicks and scroll wheels 00:22:06.225-->00:22:12.598 and you know the optical sensor you know at some crazy high rate so they're probably using a lot 00:22:12.598-->00:22:19.138 more interrupts than I am. And I'm thinking uh you know maybe maybe it's using somebody's 00:22:19.138-->00:22:25.511 enable or disable commands and uh since I've overridden these uh handler flags it's actually 00:22:25.511-->00:22:31.750 turning off stuff that it needs. So I'm looking through, and I'm looking for these instructions 00:22:31.750-->00:22:37.623 in the objdump output and I find two instances where uh this interrupt disable instruction 00:22:37.623-->00:22:42.628 was being called and I replaced both of those instructions with a no-op just skipped right over 00:22:45.231-->00:22:50.869 it, and I crossed my fingers, and it worked. So that was really cool uh so now we're you 00:22:50.869-->00:22:57.209 know fully up we got a working mouse we're good to go uh so I am thinking that I was just 00:22:57.209-->00:23:02.147 disabling some interrupt that it needed and uh you know now we're good and happy. And now we're 00:23:04.183-->00:23:10.055 gonna try to do a demonstration. So I have this mouse right here it's got some wires comin off of 00:23:10.055-->00:23:15.060 it because uh you know makes it look cooler and I didn't bother stuffing em all back in but 00:23:28.941-->00:23:33.946 we're gonna go ahead and try this. So plug it in or..You wanna talk about this? >>Sure. 00:23:39.551-->00:23:46.125 So overall we're you know this is obviously very obvious if we were doing it for real we would 00:23:46.125-->00:23:51.697 do some of the rubber duck tricks to hide this but this is for you so you can see the the 00:23:51.697-->00:23:58.570 fact that it's working and um it's basically writing it out um some other things you know this 00:23:58.570-->00:24:02.641 is a powershell script and you might be thinking well you just block powershell and boom you're 00:24:02.641-->00:24:09.548 done. And I think that lacks imagination so you know th-there are other vectors that you might 00:24:09.548-->00:24:14.887 be able to leverage by writing out like for instance maybe the games console itself allows you 00:24:14.887-->00:24:19.892 to type into it in the command itself you know has some kind of vulnerability that gets you code 00:24:19.892-->00:24:26.465 execution or you write out like some kind of HTML or and then just you know exploite the 00:24:26.465-->00:24:31.470 browser instead. There's a bunch of different vectors that this technique opens up. And as you 00:24:33.605-->00:24:38.610 can see he's using the mouse. It worked! [clapping] >>So our little uh cheat demo here uh if 00:24:47.119-->00:24:53.325 you're uh if you're like Rob and you're not really that good at Doom [laughter] you can go ahead 00:24:53.325-->00:24:58.330 and give yourself a whole bunch of armor. [laughter] And you know maybe you want a slightly 00:25:03.602-->00:25:08.607 better weapon. [laughter] Maybe you want unlimited ammo. And maybe you just want the 00:25:25.290-->00:25:30.295 Kill-em-all button. >>So for a real hack generally speaking at an eSports tournament you 00:25:39.004-->00:25:43.942 wouldn't go with stuff quite as obvious as this you would um professional gamers really only 00:25:43.942-->00:25:48.547 need a little bit more of an edge than Mark and I need. So generally speaking at some kind 00:25:48.547-->00:25:53.652 of aim helper that takes like a three pixel off headshot and gives it to them as a headshot 00:25:53.652-->00:25:59.758 instead. Very subtle things that are hard to find. And um just a-a little kind of FYI in terms 00:25:59.758-->00:26:05.864 of like detecting the fact that you're cheating like this um using an external cheat the anti 00:26:05.864-->00:26:11.036 cheat technology is very much still in the same spot the antivirus is in and it's mostly 00:26:11.036-->00:26:16.041 just you know partial file hashing and maybe a little bit more magic but as long as your 00:26:16.041-->00:26:20.679 cheat isn't a known cheat and you wrote it brand new for that one you're probably gonna be 00:26:20.679-->00:26:25.684 able to get away with it. >>So to kinda close this out we have more like thought challenges 00:26:29.288-->00:26:35.527 than really a conclusion uh you know can we defend against extra code in this device? Um you 00:26:35.527-->00:26:39.965 could have you know can we defend against exactly what we did? So you could have your 00:26:39.965-->00:26:44.603 application like look at the reset vector when it boots but you could also have your added 00:26:44.603-->00:26:50.175 code uh rewrite the reset vector after booting. You could hash your entire flash space but that 00:26:50.175-->00:26:56.748 would make it so you can't store user modifications like you know mouse DPI settings or you know 00:26:56.748-->00:27:00.986 uh configs that you want people to be able to save uh and you could also have that you know 00:27:00.986-->00:27:05.958 added code change that hash value or even clear the flash that it executes out of because 00:27:05.958-->00:27:11.930 uh you have capability to clear flash memory inside arm. You could get into some more 00:27:11.930-->00:27:18.170 hardware based tamper detection uh these arm chips have some uh like basic tamper stuff and then 00:27:18.170-->00:27:22.608 you can buy more expensive like secure core arm chips that have more advanced hardening features 00:27:22.608-->00:27:29.314 but then you get into this cost trade off you know no one want to buy a four hundred dollar 00:27:29.314-->00:27:34.086 super secure mouse that's just too much money. So if we're not really gonna change the mice 00:27:34.086-->00:27:38.690 around or the keyboards or whatever can we defend against this kind of payload style? Um, 00:27:38.690-->00:27:44.096 you can only allo-you know we coul-we could get some software to only allow normal behavior 00:27:44.096-->00:27:50.102 from peripherals right if I plug in a mouse and it dumps out two thousand characters per minute 00:27:50.102-->00:27:56.041 that's you know probably not what it's supposed to be doing. Um you could try to get everyone 00:27:56.041-->00:28:01.246 to sign and verify their drivers and flash from all of their devices that's never gonna 00:28:01.246-->00:28:05.484 happen. Uh whitelisting executables could get you pretty far right you know if you only 00:28:05.484-->00:28:10.889 allow the game executable uh to run on these tournament computers or if you whitelist 00:28:10.889-->00:28:16.895 executables in your you know office environment then people can't come in you know hide 00:28:16.895-->00:28:21.533 whatever software they want inside the powershell. Um you could force everyone to use USB 00:28:21.533-->00:28:27.306 to PS2 adapters. That's probably not gonna work too well. People like their uh sub one 00:28:27.306-->00:28:33.979 millisecond response rates for their mice and keyboards. And you can provide trusted hardware 00:28:33.979-->00:28:39.918 right. I mean, if you let people walk in with whatever USB device they have you really have no 00:28:39.918-->00:28:46.825 guarantee what's running on that so you might just have to keep a whole stockpile of you know mice 00:28:46.825-->00:28:51.930 and keyboards for every sponsor and brand and manufacturer and whatever and just run from 00:28:51.930-->00:28:58.704 there. Uh so have source code up on the bit bucket and then these are all the references we used 00:28:58.704-->00:29:03.809 to get through this whole you know process from start to finish arm application notes uh 00:29:03.809-->00:29:08.814 all the ST-Link utilities and if there's any questions I guess we'll be up here. [clapping] 00:29:11.450-->00:29:16.922 [off mic] >>Go back a slide. People were taking pictures >>Huh? >>People were taking 00:29:16.922-->00:29:18.423 pictures of it.