1
00:00:00,000 --> 00:00:08,960
Okay, welcome to our talk, Evil Genius, Why You Shouldn't Trust That Keyboard, by Farid Perez and Mauro Eldridge from DC5411.

2
00:00:09,900 --> 00:00:16,420
Before we start, let's make a brief introduction on this talk and on ourselves, the speakers.

3
00:00:17,320 --> 00:00:22,420
I am Mauro Eldridge, I'm an Argentine hacker and I'm the founder of DC5411.

4
00:00:22,780 --> 00:00:37,340
I work as a cybersecurity architect and I was a speaker the last years at DEFCON Las Vegas, Siberia, Roadsec Brazil, Dragonjar Colombia, POSCON Iran and the Texas Cyber Summit, among other conferences.

5
00:00:39,980 --> 00:00:42,200
Thank you, Mauro.

6
00:00:42,200 --> 00:00:49,660
Hello everyone, my name is Farid Perez Saez, I am a Colombia hacker assisting in communication.

7
00:00:49,760 --> 00:00:59,380
I work as a professor at the University of La Guajira and I am a member of DC5411 group.

8
00:00:59,380 --> 00:01:06,220
Also, being a speaker at Dragonjar Colombia, I'm now a DEFCON in this village.

9
00:01:07,080 --> 00:01:16,080
The objective of this talk is to explain bad USB attacks in a different way, combining hardware hacking, human hacking and social engineering.

10
00:01:16,600 --> 00:01:25,940
In this case, we will explain this type of attack using one of our evil creations, a tampered keyboard, which acts as a remote keylogger.

11
00:01:26,800 --> 00:01:36,180
As you can see in this photograph, it seems to be a classic keyboard, a normal cheap keyboard without any suspicious.

12
00:01:37,220 --> 00:01:40,700
But well, you may be wrong.

13
00:01:42,020 --> 00:01:45,020
It looks pretty normal.

14
00:01:46,300 --> 00:02:10,980
This talk is divided into two chapters, the social engineering one, where we try to create a plausible alibi and the necessary conditions for our attack to be effective, and the hardware hacking one, where we explain the mechanics to build a bad USB with cheap ports and how we use this bad USB for exfiltration of data.

15
00:02:12,600 --> 00:02:22,660
Just a little disclaimer, the speakers have full permission from affected parties to conduct this experiment in an authorized manner.

16
00:02:22,680 --> 00:02:32,160
This is a complex reptilian exercise, and the authors weren't involved directly or indirectly in any illegal activity.

17
00:02:33,260 --> 00:02:36,840
Let's start with the first, the social engineering.

18
00:02:36,840 --> 00:02:49,840
The point of the experiment was to infect a user without any direct interaction, using only the bad USB keyboard, but without being able to touch it, even to connect it.

19
00:02:50,160 --> 00:02:58,360
So we had to rely on social engineering or human hacking to get someone else to do their job on our behalf.

20
00:02:59,520 --> 00:03:02,080
This is what we had so far.

21
00:03:02,180 --> 00:03:09,680
Our victim, an educational institution, had no physical access to the place or help from the inside.

22
00:03:09,920 --> 00:03:18,660
They only had an open guest Wi-Fi connection, which we were not allowed to mess with, and it was segregated from the main network.

23
00:03:18,960 --> 00:03:25,860
So, at first, it might not seem like a really valuable asset at first.

24
00:03:25,860 --> 00:03:39,680
And we had a modified keyboard with our bad USB in its original box, with its accessories and manuals and everything you expect to find in a brand new unboxed item, right?

25
00:03:41,120 --> 00:03:45,230
So let's try to simplify this equation.

26
00:03:45,230 --> 00:03:50,510
We had no physical access from the inside and an original box.

27
00:03:50,510 --> 00:03:59,230
We had to create an attack vector from these really pure assets.

28
00:03:59,770 --> 00:04:03,710
So what can we do with no physical access and a box?

29
00:04:03,890 --> 00:04:13,150
The obvious first thing that came to our mind was the fake postal service.

30
00:04:13,490 --> 00:04:15,930
We have a postal imposter.

31
00:04:16,350 --> 00:04:27,990
This was way out of our scope, so we wanted to do something similar but not so violent.

32
00:04:28,670 --> 00:04:33,010
So we came with this little strategy.

33
00:04:36,050 --> 00:04:42,610
Delivering an unsolicited keyboard could only be some strange and suspicious.

34
00:04:42,610 --> 00:04:48,050
You are not expecting an unsolicited keyboard any day of the week.

35
00:04:48,330 --> 00:04:58,310
So we had to improve our game and resort to helping the local industry by printing a few extra things for a small price.

36
00:04:58,830 --> 00:05:02,370
And these few extra things are the following.

37
00:05:03,870 --> 00:05:15,710
Note that we have censored the trademark, the brand, because the manufacturer is not linked in any way.

38
00:05:15,710 --> 00:05:19,150
It's not related to the stock or this experiment.

39
00:05:20,770 --> 00:05:33,690
So we had for a few dollars, we had stickers, a t-shirt, and a neatly packaged keyboard ready to be sent to the institution along with a simple letter.

40
00:05:34,410 --> 00:05:36,770
Absolutely nothing to suspect.

41
00:05:37,350 --> 00:05:39,610
Well, maybe.

42
00:05:40,230 --> 00:05:45,790
The package was sent via a well-known private courier app who confirmed its receipt.

43
00:05:48,010 --> 00:05:55,990
A few hours later, we were already quite concerned with the package market as received, but nothing happening.

44
00:05:56,410 --> 00:06:01,410
After a while, our keylogging data began to populate.

45
00:06:01,750 --> 00:06:08,910
Now you might question, you might ask yourself, how does this bad USB keyboard work?

46
00:06:09,570 --> 00:06:18,930
So, now my partner, Farid, the hardware hacker of the group, will explain you the magic behind this electronic tampering.

47
00:06:19,530 --> 00:06:21,690
Thank you, Mauro.

48
00:06:21,690 --> 00:06:36,170
Here we have the planned component used in this project, which if we want to do it ourselves, we must have a normal keyboard of the model most used in your country.

49
00:06:36,170 --> 00:06:53,610
The wireless network component for Arduino ESP8260 and Arduino Nano, a standard USB cable and command and control server, the Arduino programming interface, and above all, lots of patience.

50
00:06:54,290 --> 00:07:01,830
In this diagram, it is possible to observe the keyboard schematic.

51
00:07:01,830 --> 00:07:25,150
It depicts the operation from the moment the user inerts the keyboard's USB cable without generating that the keyboard has the Arduino Nano device with an ESP8260 wireless interface.

52
00:07:25,150 --> 00:07:47,490
For setting all the information entered to the keyboard to a C2 server, which will use PHP MySQL and PHP tools, where the hacker will be receiving all the information entered by our already tampered keyboard.

53
00:07:48,930 --> 00:07:55,130
All TPs are cheap and easy to conceal inside the device.

54
00:07:55,610 --> 00:08:02,810
This part does not add significant weight to the keyboard.

55
00:08:03,190 --> 00:08:08,930
There is no sign that could make the victim suspicious.

56
00:08:11,070 --> 00:08:19,950
In this image, you can see each component mentioned in the functional prototype of the attach.

57
00:08:20,910 --> 00:08:28,870
This image presents the POST method code to server C2.

58
00:08:30,150 --> 00:08:44,680
This image shows the C2 server connection code, or how to use USB model to steal data online.

59
00:08:45,080 --> 00:09:05,420
As you may already know, this bad USB has a command and control server, which is built upon a LAMP stack, Linux, Apache, MySQL, PHP and PHP MyAdmin, database and a simple table, as you may see now.

60
00:09:06,240 --> 00:09:10,000
You can see that there are at least 28 rows.

61
00:09:10,000 --> 00:09:12,560
These rows represent sessions.

62
00:09:12,580 --> 00:09:18,820
I'll take a moment to explain you what sessions are on this bad USB keyboard.

63
00:09:19,240 --> 00:09:33,140
Once the buffer of the keyboard stops receiving data for a certain amount of time, it closes the buffer and uploads its contents to the web server, this command and control server.

64
00:09:33,220 --> 00:09:39,540
So it has separated different inputs by sessions.

65
00:09:39,640 --> 00:09:43,280
Let's try to inspect some of these sessions.

66
00:09:43,440 --> 00:10:05,880
For example, here, session number 11 is when the user attempts to access gmail.com, but instead of entering its credentials, the victim jumps into another task, let's say Microsoft Word, and starts typing a document about Torres Javier.

67
00:10:06,320 --> 00:10:14,700
Then he goes back to Gmail, enters his credentials, or hers credentials, and passwords.

68
00:10:16,840 --> 00:10:20,090
We have another example here of passwords.

69
00:10:21,260 --> 00:10:23,740
And then internal instructions.

70
00:10:23,740 --> 00:10:31,780
For example, on number 20 it says I have bought a rim of paper for the office.

71
00:10:32,640 --> 00:10:40,140
On session 21 it says I have made a Mercado Todo recharge for the office.

72
00:10:40,140 --> 00:10:41,980
And it continues, right?

73
00:10:44,030 --> 00:10:47,910
Here we can see on session 24 another password.

74
00:10:47,910 --> 00:10:54,830
Try to picture obtaining these passwords with other methods, for example with cracking.

75
00:10:55,270 --> 00:11:05,490
It won't be certainly impossible, but it will take you a longer time than simply using this bad USB.

76
00:11:06,190 --> 00:11:11,910
On session 25 we have our first case of personal identifiable information.

77
00:11:12,470 --> 00:11:28,990
As you can see behind the encoding error, it says Cédula Ciudadanía, which means, translated from Spanish, national ID, which is the equivalent for the SSN, the social security number in the USA.

78
00:11:28,990 --> 00:11:35,470
It's a number that identifies a citizen, so it is treated as private information.

79
00:11:37,690 --> 00:11:44,410
Then on session 22 we have the login from an online banking site.

80
00:11:44,410 --> 00:11:46,910
Obviously the credentials were there too.

81
00:11:49,420 --> 00:11:53,520
So far, you may ask yourself what you can do.

82
00:11:53,520 --> 00:12:04,400
Well, you can obtain credentials for any local or remote service, for local users or cloud services or different providers online.

83
00:12:05,220 --> 00:12:11,300
You can obtain private information about users, resources, documents and infrastructure.

84
00:12:12,000 --> 00:12:17,600
You can discover internal conversations or communications, as we have seen before.

85
00:12:17,600 --> 00:12:25,640
You can see internal orders, for example, or internal documents about daily basis tasks.

86
00:12:26,840 --> 00:12:43,360
You can use this keyboard as a pivot for new attacks, and in very specific scenarios, rare scenarios, an attacker could compromise an entire supply chain, replacing normal keyboards with infected ones.

87
00:12:45,530 --> 00:13:01,050
I know this may sound actually a little bit crazy or a little bit too rare or too unique, but some days ago counterfeit or fake Cisco switches were deployed in production.

88
00:13:01,930 --> 00:13:15,190
So a network engineer saw that his core switch was failing or acting clunky, tried to troubleshoot it and ended up finding that it was a counterfeit one.

89
00:13:15,630 --> 00:13:18,270
That's about counterfeit hardware.

90
00:13:18,270 --> 00:13:35,350
I want to offer you a small appendix with a brief explanation and comparison of fake hardware, and to speak about the possibility of using it for red teaming, aside from what everybody else is using it for, you know, shading.

91
00:13:37,790 --> 00:13:43,870
You might notice first case, it's the keyboard that we were talking about.

92
00:13:43,870 --> 00:13:45,630
This is our own prototype.

93
00:13:46,310 --> 00:13:55,830
You might find no substantial differences on the outside, no evidence of tampering, nothing really to worry about.

94
00:13:56,630 --> 00:14:03,930
And this is the original one, with a non-stock picture from an e-commerce site.

95
00:14:03,930 --> 00:14:08,570
As you see, there are no differences between them.

96
00:14:09,250 --> 00:14:14,650
But this tampering is not really limited to any kind of hardware.

97
00:14:14,650 --> 00:14:17,410
You can tamper anything you want.

98
00:14:18,010 --> 00:14:27,410
For example, let's take a look at this set of speakers that we have tampered ourselves, for another case study.

99
00:14:28,470 --> 00:14:36,470
These speakers might look, as the keyboard, really normal on the outside, nothing really weird about them.

100
00:14:36,470 --> 00:14:41,710
But once you open them, you find they are tampered.

101
00:14:41,710 --> 00:14:50,690
You find that they have another hardware pieces scattered around, which makes it really suspicious to a trained eye.

102
00:14:51,590 --> 00:14:56,830
Now let's take a look at a photograph of these original speakers.

103
00:14:57,670 --> 00:15:00,770
Again, a non-stock picture from an e-commerce site.

104
00:15:00,770 --> 00:15:02,410
They are recently unboxed.

105
00:15:02,530 --> 00:15:08,270
As you might see, there's nothing to worry about, nothing really strange or weird about them.

106
00:15:09,490 --> 00:15:13,150
But this is not only limited to small hardware.

107
00:15:14,670 --> 00:15:21,610
Even critical hardware like switches, in this case core switches from Cisco, can be tampered with.

108
00:15:22,570 --> 00:15:33,130
This is a very good comparison between an original Cisco switch board and two counterfeit ones.

109
00:15:33,210 --> 00:15:35,390
The source is F-Secure.

110
00:15:35,770 --> 00:15:40,110
As you can see, the one in the left, it's the original one.

111
00:15:40,350 --> 00:15:43,690
The second and third are counterfeit.

112
00:15:43,690 --> 00:15:56,110
Take a look at the second, on the lower half, it has the Cisco trademark printed on the board, while the third one not.

113
00:15:56,470 --> 00:16:03,970
So differences are subtle and can be really overlooked by an untrained eye.

114
00:16:03,970 --> 00:16:07,270
This is what's the dangerous part of this.

115
00:16:07,270 --> 00:16:11,830
It is very easy to be misled by this hardware.

116
00:16:11,990 --> 00:16:16,410
It doesn't end here, this is not something new as I said before.

117
00:16:17,070 --> 00:16:26,050
A user on Reddit a year ago posted about being a victim of counterfeit Cisco devices.

118
00:16:26,670 --> 00:16:35,750
Let's take a look at first at an original Cisco switch from panel and then a counterfeit one.

119
00:16:36,270 --> 00:16:42,450
The sources on these images are Reddit, the original post, and eBay.

120
00:16:43,790 --> 00:16:46,130
This is the original one.

121
00:16:46,810 --> 00:16:52,490
As you may see, this is what you expect to unbox from Cisco.

122
00:16:53,350 --> 00:16:56,090
And this is the counterfeit one.

123
00:16:56,730 --> 00:17:02,150
It's basically what you expect again to unbox when you buy a Cisco switch.

124
00:17:02,150 --> 00:17:08,030
So there are no really really big differences.

125
00:17:08,510 --> 00:17:15,610
Some of the most noted differences on counterfeits are the bright on the numbers of the ports.

126
00:17:15,610 --> 00:17:22,470
As you may see 1, 2, 11, 13, 12, and 14, 23, 24, etc.

127
00:17:22,670 --> 00:17:26,870
This is something that is most noted on the internet.

128
00:17:26,870 --> 00:17:32,050
The brightest of those numbers, nothing else from the front.

129
00:17:33,370 --> 00:17:38,330
And some people noted that the screws are different.

130
00:17:38,750 --> 00:17:49,710
So unless you open it, or unless you have something really really specific about it, you won't suspect.

131
00:17:50,610 --> 00:17:58,690
This is just to make you understand the dangers of counterfeit or fake hardware.

132
00:17:58,690 --> 00:18:04,190
And that are out there, there are people dedicated to faking this kind of hardware.

133
00:18:04,390 --> 00:18:09,230
Not only for a redeeming exercise like ourselves, but to make a profit from it.

134
00:18:09,230 --> 00:18:18,590
And it is really really dangerous to corporations, or to small companies, and to almost every institution out there.

135
00:18:20,650 --> 00:18:28,670
So before we close this talk, we would like to share a little demo with you about this keyboard and how it acts.

136
00:18:31,350 --> 00:18:36,630
So since this is a demo, we'll use two laptops and one of the infected keyboards.

137
00:21:14,170 --> 00:21:19,850
Time to say goodbye and jump to the conclusions, and obviously the questions and answers.

138
00:21:21,430 --> 00:21:28,610
Our conclusions are that you always have to be wary of any new device, whether USB or not.

139
00:21:28,610 --> 00:21:32,810
This may seem obvious, but anyone could be a victim.

140
00:21:33,330 --> 00:21:44,150
Be honest, would you have suspected of this keyboard if you just saw it lying around in a desktop or in your office?

141
00:21:44,610 --> 00:21:46,510
Probably not.

142
00:21:47,750 --> 00:22:00,050
And bear in mind that with a few dollars anyone can build or even buy a product of this type, in this case.

143
00:22:01,310 --> 00:22:05,650
It is never possible to use preventive measures against SBS.

144
00:22:06,530 --> 00:22:13,670
And always remember that the mousetrap works because the mouse doesn't quite understand why the cheese is free.

145
00:22:13,890 --> 00:22:18,970
So educate your users to do not pick things from strangers.

146
00:22:21,810 --> 00:22:30,330
You can get in touch with us at GitGov, Mauro Eldridge and DC5411, or on Twitter, you have our handlers here.

147
00:22:30,650 --> 00:22:38,390
We are always open to discuss about hardware hacking, social engineering and hacking in general, so we'll be more than happy to talk with you.

148
00:22:39,050 --> 00:22:44,450
If you have any questions, we'll gladly answer them in the chat.

149
00:22:44,510 --> 00:22:44,970
Thank you!