start	end	text
990	9730	Okay, welcome to our talk on Keypress Hack by Farid Perez, Mauro Eldridge and Luis Ramirez from DC5411.
11150	16610	Before we start, I would like to make a brief introduction to both our talk and the speakers.
17930	24030	My name is Mauro Eldridge, I'm an Argentine hacker and I work as a cybersecurity architect.
24030	38350	I'm the founder of DC5411 Argentina and I was a speaker for DEFCON, DEFCON Siberia, RoadSec Brazil, Dragonjar Colombia, POSCON Iran, Texas Cyber Summit among other conferences.
39170	42930	Now my co-speakers are going to introduce themselves.
45690	47950	Thank you, Mauro.
47950	56770	Hello everyone, my name is Farid Perez, I am a Colombia hacker, system engineer and master in telecommunication.
56770	66450	I work as a professor at the University of La Guajira and I am a member of DC5411 group.
66450	73170	Also, I've been a speaker at Dragonjar Colombia and now at DEFCON in this village.
74030	75450	Thank you, Farid.
75450	79390	Hello everyone, my name is Luis Ramirez Mendoza from Colombia.
79390	87550	I am an electronic engineer and hacker and a computer security and artificial intelligence teacher at the University of La Guajira.
87550	93770	A speaker in Dragonjar Colombia, DEFCON region village number 5411.
96660	104920	Well, the objective of this talk is to show the assembly of a bad USB device discreetly mounted inside a keyboard.
104920	112080	With the ability to send the victim's keystrokes over the internet, like a remote keylogger.
112280	119420	This talk focuses exclusively on the construction of this type of artifact and includes a video demo at the end.
120380	128180	This is the tampered keyboard we are using. As you may see, it seems at first glance like a pretty normal classical keyboard.
128800	130940	But, well, it isn't.
132400	140860	Now, my co-speakers and friends Farid and Luis are going to explain the magic behind this electronic tampering.
140980	142180	Thank you.
142180	153480	In the first place, we have the keyboard. You can choose any type of keyboard that has a USB connector.
153480	161760	In order to not see much of the alteration that we are going to make.
164000	178580	The ESP8266 WiFi module will allow us to connect the Arduino to an internet connection.
178580	193980	In order to send the keyboard data to a database in MySQL in order to have stored everything captured on the keyboard.
196230	222750	To optimize the size, it was decided to use the Arduino Nano so that it can be easily hidden on the keyboard and also in the translation of the keystrokes to be stored in the MySQL database.
223750	248230	A standard USB cable with USB mini-vehicle, it replaces the keyboard cable since it must be connected to the Arduino through which all the information must pass in order to apply the key lawyer.
252280	272900	To receive this information, we will host a Q-server with phpMySQL and phpMyAdmin in order to receive all the values entered by the keyboard.
272900	298260	We will also have the Arduino programming interface where we will enter the code that is necessary to interpret if of the keystroke emitted by a keyboard and it must be sent to store it in the database.
299820	311460	In this image, interface Arduino IDE in the PC.
312240	322980	And sometimes very important and very fundamental to have a lot of patience.
322980	339880	To achieve good results, this never comes out the first time and on many occasions it dashes the opposite of what you expect.
339880	353900	And even more so when you organize the circuit and the solder becomes damaged or some sign very unexpected happens.
358570	382210	Taking in account the hardware hacking 101, we have the plans that are completing the component used in this project, where if we want to do it ourselves, we must use a normal keyboard or the model most used in your country.
382210	407490	The wireless network component for Arduino ESP8266 and Arduino Nano, a standard USB cable, a C2 server, the Arduino programming interface on the PC, and above all and most important, have a lot of patience.
409340	423900	In this diagram, it is possible to observe the scheme that our keyboard has because it represents half the represent attach.
423900	444400	It is shaped and each of the components detailed previously in order to the respective operations to obtain the information of each key entered by the B team.
444400	472660	We have the connection diagram of each of the pins being which the Arduino Nano, the wireless interface for the Arduino, ESP8266, and the keyboard where they indicate exactly where the connection must be made
472660	491740	for its proper operation. On the connection card for the B board, there were many drawbacks at the time of welding and first contact in each of the terminal of side connection.
491740	513640	In the same way, when it is not holding the membrane and not making contact, it will work regularly because it will not make enough contact for the team to verify each of the pulsations made.
517500	531830	You have in the image the representation of each of the components mentioned above for this respective assembly and operation.
533100	539920	A image of the aforementioned cards fully operational.
539920	546460	Here we are verifying if the keyboard recognizes the computer.
550860	558780	In the graphic, we can observe that all modifications did not alter the computer's recognition of the keyboard.
563560	569360	Here we are already assembling the keyboard for the pendulum testing.
574800	586800	When a key is pressed, it joins the connected thread, rows and the column, which feed the data to the column, this in addition to going to the computer.
586980	597020	It also reads the Arduino, it takes read of the continuing, which waits for the signal to send to the Wi-Fi the module.
601980	608440	This is how our keyboard would look like on the inside.
614260	620940	As we can appreciate, all us and the piece are cheap and easy to gain into device.
620940	627900	It doesn't weigh much, and three are no sign that the width can suspend anything.
631860	646780	Here is the schematic, the Arduino NTSB connected serial, which means that one transmits and the other receives, when a pulsation is received with the keyboard board.
647960	655220	The first thing don't waste determining, which are the rows and the column of the keyboard PCB.
656280	663300	When a key is pressed, its word and the clause, that is the row and the column are in contact.
663520	665520	The Arduino also waits for click.
666840	673480	The coding is with main, the translation to node, which keep transmitting.
673480	686600	The ESP also has received pulsation, due to the Arduino not having a node on the connecting and the PCB of keyboard.
687600	697260	To simplify the coding with you, the keypad library sits in making the same principle.
697260	703920	In GINET to be to which pin are rows and which are column.
707730	717750	Here we can see a part of the ESP configuration, ready and waiting for pulsation to send them to be the database.
720970	734790	Here is demonstrated, how the Arduino interprets every pulsation and turns in its respective character to be stored in the variable, which will end in the database.
737830	741530	Post request to C2U server.
745730	752890	In the graphic, we observe the code that sends the information to the database.
754550	764950	Now that you know how to build this bad USB keyboard, let's take a look into how to use it to exfiltrate data, how does it works behind the scenes.
766930	776430	So far we know that the keyboard is tampered with an Arduino hack, which acts as a buffer for the user's input data.
776430	785930	This Arduino hack is connected to an ESP8266, which provides it with network functions.
785930	791650	Basically, it connects to any open Wi-Fi connection to relay the data.
791650	808810	So, whenever the buffer is full or a certain time has passed, the buffer closes itself and uploads its data by issuing an HTTP post request to our server, to the command and control server.
809630	818030	Then, on the server, a PHP script is listening and parsing the data and sending it to our MySQL database.
819650	828750	So, you might ask yourself, what are all these 28 rows? These are sessions.
828910	832590	And how do this keyboard manage sessions?
832590	842610	Well, whenever the buffer reaches a certain amount of data or a certain time of inactivity passes,
842610	850890	the buffer will close itself and will create what we call a session and upload it with a number.
851830	857910	Whenever it is uploaded, the buffer will be cleared and then a new session is created.
858510	862890	So, for example, here, let's take a deep look.
863150	868950	Here we have session 11, where the user attempts to open gmail.com.
868950	878610	Then, a certain time passes and the user jumped into another task, as you may see on session 12.
879050	884170	He started writing anything else, a document or whatever, an email.
884510	898290	Then, on session 13, the user came back to Gmail, he jumped back to Gmail sites and entered his or her credentials, his or her email and password.
899910	906270	So, how much will it cost to build this kind of device? Not so much, actually.
906510	915170	We have taken into account the most expensive prices available and, even though that, it is not expensive at all.
915650	924170	You can have a classic keyboard for 9 or 12 dollars, an Arduino Nano for 7 to 13 dollars
924170	932470	and the ESP8266, which is a very popular product, for 10 or 12 dollars.
933090	943530	And let's suppose you want to have a cloud instance for your command and control server, it will cost something around 5 dollars a month.
943530	949950	So, for 30 or 35 dollars you can have your hardware hacking cluster.
951590	959190	Now it's time for a demo to see how the keyboard might work on our controlled environment.
1120590	1125050	Time to jump into conclusions and questions and answers.
1125990	1135670	You have to always be wary of any new device, whether USB or not. Anyone, and I say anyone, could be a victim.
1135670	1147890	Let's be honest here. Would you have been able to detect this tampered keyboard in your environment, for example, if it was lying around the desks of your office?
1148770	1159090	What makes this situation worse overall is that, with a few dollars, anyone could build or even buy a product of this type.
1159090	1168370	Watch out for counterfeit hardware. Just some days ago, fake Cisco switches were found deployed in production environments.
1168550	1172130	And nothing less than core switches.
1174190	1188810	And think about it. If we were able to produce these apparatus with so few resources, it is safe to assume that an entity with greater resources could produce them on a large scale.
1191090	1201490	So, if you want to get in touch with us at GitHub, feel free to add us at Mauro Eldridge and DC5411. Or on Twitter, you have our handlers here.
1201490	1210150	We are always happy to talk about hardware hacking and hacking in general, so don't be shy to join.
1210970	1222650	And we are here to answer any of your questions, so we hope you liked this talk, and we are looking forward to seeing you again next year. Thank you.