Okay, welcome to our talk on Keypress Hack by Farid Perez, Mauro Eldridge and Luis Ramirez from DC5411.
Before we start, I would like to make a brief introduction to both our talk and the speakers.
My name is Mauro Eldridge, I'm an Argentine hacker and I work as a cybersecurity architect.
I'm the founder of DC5411 Argentina and I was a speaker for DEFCON, DEFCON Siberia, RoadSec Brazil, Dragonjar Colombia, POSCON Iran, Texas Cyber Summit among other conferences.
Now my co-speakers are going to introduce themselves.
Thank you, Mauro.
Hello everyone, my name is Farid Perez, I am a Colombia hacker, system engineer and master in telecommunication.
I work as a professor at the University of La Guajira and I am a member of DC5411 group.
Also, I've been a speaker at Dragonjar Colombia and now at DEFCON in this village.
Thank you, Farid.
Hello everyone, my name is Luis Ramirez Mendoza from Colombia.
I am an electronic engineer and hacker and a computer security and artificial intelligence teacher at the University of La Guajira.
A speaker in Dragonjar Colombia, DEFCON region village number 5411.
Well, the objective of this talk is to show the assembly of a bad USB device discreetly mounted inside a keyboard.
With the ability to send the victim's keystrokes over the internet, like a remote keylogger.
This talk focuses exclusively on the construction of this type of artifact and includes a video demo at the end.
This is the tampered keyboard we are using. As you may see, it seems at first glance like a pretty normal classical keyboard.
But, well, it isn't.
Now, my co-speakers and friends Farid and Luis are going to explain the magic behind this electronic tampering.
Thank you.
In the first place, we have the keyboard. You can choose any type of keyboard that has a USB connector.
In order to not see much of the alteration that we are going to make.
The ESP8266 WiFi module will allow us to connect the Arduino to an internet connection.
In order to send the keyboard data to a database in MySQL in order to have stored everything captured on the keyboard.
To optimize the size, it was decided to use the Arduino Nano so that it can be easily hidden on the keyboard and also in the translation of the keystrokes to be stored in the MySQL database.
A standard USB cable with USB mini-vehicle, it replaces the keyboard cable since it must be connected to the Arduino through which all the information must pass in order to apply the key lawyer.
To receive this information, we will host a Q-server with phpMySQL and phpMyAdmin in order to receive all the values entered by the keyboard.
We will also have the Arduino programming interface where we will enter the code that is necessary to interpret if of the keystroke emitted by a keyboard and it must be sent to store it in the database.
In this image, interface Arduino IDE in the PC.
And sometimes very important and very fundamental to have a lot of patience.
To achieve good results, this never comes out the first time and on many occasions it dashes the opposite of what you expect.
And even more so when you organize the circuit and the solder becomes damaged or some sign very unexpected happens.
Taking in account the hardware hacking 101, we have the plans that are completing the component used in this project, where if we want to do it ourselves, we must use a normal keyboard or the model most used in your country.
The wireless network component for Arduino ESP8266 and Arduino Nano, a standard USB cable, a C2 server, the Arduino programming interface on the PC, and above all and most important, have a lot of patience.
In this diagram, it is possible to observe the scheme that our keyboard has because it represents half the represent attach.
It is shaped and each of the components detailed previously in order to the respective operations to obtain the information of each key entered by the B team.
We have the connection diagram of each of the pins being which the Arduino Nano, the wireless interface for the Arduino, ESP8266, and the keyboard where they indicate exactly where the connection must be made
for its proper operation. On the connection card for the B board, there were many drawbacks at the time of welding and first contact in each of the terminal of side connection.
In the same way, when it is not holding the membrane and not making contact, it will work regularly because it will not make enough contact for the team to verify each of the pulsations made.
You have in the image the representation of each of the components mentioned above for this respective assembly and operation.
A image of the aforementioned cards fully operational.
Here we are verifying if the keyboard recognizes the computer.
In the graphic, we can observe that all modifications did not alter the computer's recognition of the keyboard.
Here we are already assembling the keyboard for the pendulum testing.
When a key is pressed, it joins the connected thread, rows and the column, which feed the data to the column, this in addition to going to the computer.
It also reads the Arduino, it takes read of the continuing, which waits for the signal to send to the Wi-Fi the module.
This is how our keyboard would look like on the inside.
As we can appreciate, all us and the piece are cheap and easy to gain into device.
It doesn't weigh much, and three are no sign that the width can suspend anything.
Here is the schematic, the Arduino NTSB connected serial, which means that one transmits and the other receives, when a pulsation is received with the keyboard board.
The first thing don't waste determining, which are the rows and the column of the keyboard PCB.
When a key is pressed, its word and the clause, that is the row and the column are in contact.
The Arduino also waits for click.
The coding is with main, the translation to node, which keep transmitting.
The ESP also has received pulsation, due to the Arduino not having a node on the connecting and the PCB of keyboard.
To simplify the coding with you, the keypad library sits in making the same principle.
In GINET to be to which pin are rows and which are column.
Here we can see a part of the ESP configuration, ready and waiting for pulsation to send them to be the database.
Here is demonstrated, how the Arduino interprets every pulsation and turns in its respective character to be stored in the variable, which will end in the database.
Post request to C2U server.
In the graphic, we observe the code that sends the information to the database.
Now that you know how to build this bad USB keyboard, let's take a look into how to use it to exfiltrate data, how does it works behind the scenes.
So far we know that the keyboard is tampered with an Arduino hack, which acts as a buffer for the user's input data.
This Arduino hack is connected to an ESP8266, which provides it with network functions.
Basically, it connects to any open Wi-Fi connection to relay the data.
So, whenever the buffer is full or a certain time has passed, the buffer closes itself and uploads its data by issuing an HTTP post request to our server, to the command and control server.
Then, on the server, a PHP script is listening and parsing the data and sending it to our MySQL database.
So, you might ask yourself, what are all these 28 rows? These are sessions.
And how do this keyboard manage sessions?
Well, whenever the buffer reaches a certain amount of data or a certain time of inactivity passes,
the buffer will close itself and will create what we call a session and upload it with a number.
Whenever it is uploaded, the buffer will be cleared and then a new session is created.
So, for example, here, let's take a deep look.
Here we have session 11, where the user attempts to open gmail.com.
Then, a certain time passes and the user jumped into another task, as you may see on session 12.
He started writing anything else, a document or whatever, an email.
Then, on session 13, the user came back to Gmail, he jumped back to Gmail sites and entered his or her credentials, his or her email and password.
So, how much will it cost to build this kind of device? Not so much, actually.
We have taken into account the most expensive prices available and, even though that, it is not expensive at all.
You can have a classic keyboard for 9 or 12 dollars, an Arduino Nano for 7 to 13 dollars
and the ESP8266, which is a very popular product, for 10 or 12 dollars.
And let's suppose you want to have a cloud instance for your command and control server, it will cost something around 5 dollars a month.
So, for 30 or 35 dollars you can have your hardware hacking cluster.
Now it's time for a demo to see how the keyboard might work on our controlled environment.
Time to jump into conclusions and questions and answers.
You have to always be wary of any new device, whether USB or not. Anyone, and I say anyone, could be a victim.
Let's be honest here. Would you have been able to detect this tampered keyboard in your environment, for example, if it was lying around the desks of your office?
What makes this situation worse overall is that, with a few dollars, anyone could build or even buy a product of this type.
Watch out for counterfeit hardware. Just some days ago, fake Cisco switches were found deployed in production environments.
And nothing less than core switches.
And think about it. If we were able to produce these apparatus with so few resources, it is safe to assume that an entity with greater resources could produce them on a large scale.
So, if you want to get in touch with us at GitHub, feel free to add us at Mauro Eldridge and DC5411. Or on Twitter, you have our handlers here.
We are always happy to talk about hardware hacking and hacking in general, so don't be shy to join.
And we are here to answer any of your questions, so we hope you liked this talk, and we are looking forward to seeing you again next year. Thank you.