start	end	text
0	4680	Okay, welcome to our talk, Evil Genius, Why You Shouldn't Trust That Keyboard,
4680	8960	by Farid Perez and Mauro Eldridge from DC5411.
9900	16420	Before we start, let's make a brief introduction on this talk and on ourselves, the speakers.
17320	22420	I am Mauro Eldridge, I'm an Argentine hacker and I'm the founder of DC5411.
22780	28820	I work as a cybersecurity architect and I was a speaker the last years at DEFCON Las Vegas,
28820	35280	Siberia, Roadsec Brazil, Dragonjar Colombia, POSCON Iran and the Texas Cyber Summit,
35280	43680	among other conferences. Thank you, Mauro. Hello everyone,
43680	49660	my name is Farid Perez Saez, I am a Colombia hacker assisting in communication.
49760	59380	I work as a professor at the University of La Guajira and I am a member of DC5411 group.
59380	66220	Also, being a speaker at Dragonjar Colombia, I'm now a DEFCON in this village.
67080	72540	The objective of this talk is to explain bad USB attacks in a different way,
72540	76080	combining hardware hacking, human hacking and social engineering.
76600	81480	In this case, we will explain this type of attack using one of our evil creations,
81640	85940	a tampered keyboard, which acts as a remote keylogger.
86800	93260	As you can see in this photograph, it seems to be a classic keyboard, a normal cheap keyboard
93260	105020	without any suspicious. But well, you may be wrong. It looks pretty normal.
106300	112680	This talk is divided into two chapters, the social engineering one, where we try to create
112860	119800	a plausible alibi and the necessary conditions for our attack to be effective, and the hardware
119800	126240	hacking one, where we explain the mechanics to build a bad USB with cheap ports and how we use
126240	135960	this bad USB for exfiltration of data. Just a little disclaimer, the speakers have
137180	142660	full permission from affected parties to conduct this experiment in an authorized manner.
142680	152160	This is a complex reptilian exercise, and the authors weren't involved directly or indirectly in any illegal activity.
153260	159860	Let's start with the first, the social engineering. The point of the experiment was to infect a user
159860	168220	without any direct interaction, using only the bad USB keyboard, but without being able to touch it,
168220	175300	even to connect it. So we had to rely on social engineering or human hacking to get someone else
175300	184080	to do their job on our behalf. This is what we had so far. Our victim, an educational
184980	191340	institution, had no physical access to the place or help from the inside. They only had an open
191340	197520	guest Wi-Fi connection, which we were not allowed to mess with, and it was segregated from the main
197520	207080	network. So, at first, it might not seem like a really valuable asset at first. And we had a modified
207080	213100	keyboard with our bad USB in its original box, with its accessories and manuals and everything
213100	225230	you expect to find in a brand new unboxed item, right? So let's try to simplify this equation.
225230	234050	We had no physical access from the inside and an original box. We had to create an attack vector
234790	243710	from these really pure assets. So what can we do with no physical access and a box?
243890	253150	The obvious first thing that came to our mind was the fake postal service.
253490	263350	We have a postal imposter. This was way out of our scope, so we wanted to do something
264110	273010	similar but not so violent. So we came with this little strategy.
276050	282610	Delivering an unsolicited keyboard could only be some strange and suspicious.
282610	290290	You are not expecting an unsolicited keyboard any day of the week. So we had to improve our game
290290	298310	and resort to helping the local industry by printing a few extra things for a small price.
298830	302370	And these few extra things are the following.
303870	312490	Note that we have censored the trademark, the brand, because the manufacturer is not
312490	319150	linked in any way. It's not related to the stock or this experiment.
320770	328650	So we had for a few dollars, we had stickers, a t-shirt, and a neatly packaged keyboard
329290	336770	ready to be sent to the institution along with a simple letter. Absolutely nothing to suspect.
337350	345790	Well, maybe. The package was sent via a well-known private courier app who confirmed its receipt.
348010	352810	A few hours later, we were already quite concerned with the package market
352810	361410	as received, but nothing happening. After a while, our keylogging data began to populate.
361750	368910	Now you might question, you might ask yourself, how does this bad USB keyboard work?
369570	376310	So, now my partner, Farid, the hardware hacker of the group, will explain you the magic behind this
376870	385570	electronic tampering. Thank you, Mauro. Here we have the planned component used in this
385570	393530	project, which if we want to do it ourselves, we must have a normal keyboard of the model
393530	403170	most used in your country. The wireless network component for Arduino ESP8260 and Arduino Nano,
403350	409870	a standard USB cable and command and control server, the Arduino programming interface,
409870	421830	and above all, lots of patience. In this diagram, it is possible to observe the keyboard schematic.
421830	434250	It depicts the operation from the moment the user inerts the keyboard's USB cable without
434870	445150	generating that the keyboard has the Arduino Nano device with an ESP8260 wireless interface.
445150	456110	For setting all the information entered to the keyboard to a C2 server, which will use PHP MySQL and PHP
456110	467490	tools, where the hacker will be receiving all the information entered by our already tampered keyboard.
468930	475130	All TPs are cheap and easy to conceal inside the device.
475610	482810	This part does not add significant weight to the keyboard.
483190	488930	There is no sign that could make the victim suspicious.
491070	499950	In this image, you can see each component mentioned in the functional prototype of the attach.
500910	508870	This image presents the POST method code to server C2.
510150	524680	This image shows the C2 server connection code, or how to use USB model to steal data online.
525080	531580	As you may already know, this bad USB has a command and control server,
531580	541660	which is built upon a LAMP stack, Linux, Apache, MySQL, PHP and PHP MyAdmin,
541660	545420	database and a simple table, as you may see now.
546240	553480	You can see that there are at least 28 rows. These rows represent sessions. I'll take a
553480	560880	moment to explain you what sessions are on this bad USB keyboard. Once the buffer of the keyboard
560880	569080	stops receiving data for a certain amount of time, it closes the buffer and uploads its contents
569640	578020	to the web server, this command and control server. So it has separated different inputs
578020	587040	by sessions. Let's try to inspect some of these sessions. For example, here, session number 11
587040	596280	is when the user attempts to access gmail.com, but instead of entering its credentials,
597340	603620	the victim jumps into another task, let's say Microsoft Word, and starts typing a document
603620	612840	about Torres Javier. Then he goes back to Gmail, enters his credentials, or hers credentials,
612840	620090	and passwords. We have another example here of passwords.
621260	625860	And then internal instructions. For example, on number 20 it says
626690	637620	I have bought a rim of paper for the office. On session 21 it says I have made a Mercado Todo
637620	647910	recharge for the office. And it continues, right? Here we can see on session 24 another password.
647910	654830	Try to picture obtaining these passwords with other methods, for example with cracking.
655270	665490	It won't be certainly impossible, but it will take you a longer time than simply using this bad USB.
666190	671910	On session 25 we have our first case of personal identifiable information.
672470	679410	As you can see behind the encoding error, it says Cédula Ciudadanía, which means,
679410	687330	translated from Spanish, national ID, which is the equivalent for the SSN, the social security
687330	695470	number in the USA. It's a number that identifies a citizen, so it is treated as private information.
697690	706910	Then on session 22 we have the login from an online banking site. Obviously the credentials were there too.
709420	716720	So far, you may ask yourself what you can do. Well, you can obtain credentials for any local
716720	724400	or remote service, for local users or cloud services or different providers online.
725220	731300	You can obtain private information about users, resources, documents and infrastructure.
732000	737600	You can discover internal conversations or communications, as we have seen before.
737600	745640	You can see internal orders, for example, or internal documents about daily basis tasks.
746840	753100	You can use this keyboard as a pivot for new attacks, and in very specific scenarios,
753100	759500	rare scenarios, an attacker could compromise an entire supply chain,
759500	768210	replacing normal keyboards with infected ones. I know this may sound actually a little bit crazy
768210	778350	or a little bit too rare or too unique, but some days ago counterfeit or fake Cisco switches were
778350	788090	deployed in production. So a network engineer saw that his core switch was failing or acting clunky,
788890	795190	tried to troubleshoot it and ended up finding that it was a counterfeit one.
795630	801210	That's about counterfeit hardware. I want to offer you a small appendix with a brief
801210	807930	explanation and comparison of fake hardware, and to speak about the possibility of using it
807930	815350	for red teaming, aside from what everybody else is using it for, you know, shading.
817790	825630	You might notice first case, it's the keyboard that we were talking about. This is our own prototype.
826310	833470	You might find no substantial differences on the outside, no evidence of tampering, nothing
833470	842910	really to worry about. And this is the original one, with a non-stock picture from an e-commerce
842910	853370	site. As you see, there are no differences between them. But this tampering is not really limited to
853370	861170	any kind of hardware. You can tamper anything you want. For example, let's take a look at this set
861170	870950	of speakers that we have tampered ourselves, for another case study. These speakers might look,
870950	877430	as the keyboard, really normal on the outside, nothing really weird about them. But once you
877430	884670	open them, you find they are tampered. You find that they have another hardware pieces
884670	890690	scattered around, which makes it really suspicious to a trained eye.
891590	896830	Now let's take a look at a photograph of these original speakers.
897670	902410	Again, a non-stock picture from an e-commerce site. They are recently unboxed.
902530	908270	As you might see, there's nothing to worry about, nothing really strange or weird about them.
909490	913150	But this is not only limited to small hardware.
914670	921610	Even critical hardware like switches, in this case core switches from Cisco, can be tampered with.
922570	933130	This is a very good comparison between an original Cisco switch board and two counterfeit ones.
933210	941410	The source is F-Secure. As you can see, the one in the left, it's the original one. The second and
941410	950990	third are counterfeit. Take a look at the second, on the lower half, it has the Cisco trademark
952110	962070	printed on the board, while the third one not. So differences are subtle and can be really overlooked
962070	970690	by an untrained eye. This is what's the dangerous part of this. It is very easy to be misled by this
970690	979410	hardware. It doesn't end here, this is not something new as I said before. A user on Reddit a year ago
979410	989070	posted about being a victim of counterfeit Cisco devices. Let's take a look at first
989770	998070	at an original Cisco switch from panel and then a counterfeit one. The sources on these
998070	1006130	images are Reddit, the original post, and eBay. This is the original one.
1006810	1016090	As you may see, this is what you expect to unbox from Cisco. And this is the counterfeit one.
1016730	1024270	It's basically what you expect again to unbox when you buy a Cisco switch. So there are no really
1025610	1032970	really big differences. Some of the most noted differences on counterfeits are the bright
1032970	1042470	on the numbers of the ports. As you may see 1, 2, 11, 13, 12, and 14, 23, 24, etc.
1042670	1049810	This is something that is most noted on the internet. The brightest of those numbers,
1049810	1058330	nothing else from the front. And some people noted that the screws are different.
1058750	1068150	So unless you open it, or unless you have something really really specific about it,
1068150	1077950	you won't suspect. This is just to make you understand the dangers of counterfeit or fake
1077950	1084190	hardware. And that are out there, there are people dedicated to faking this kind of hardware.
1084390	1090590	Not only for a redeeming exercise like ourselves, but to make a profit from it. And it is really
1090590	1097810	really dangerous to corporations, or to small companies, and to almost every institution out
1097810	1106730	there. So before we close this talk, we would like to share a little demo with you about this
1106730	1116630	keyboard and how it acts. So since this is a demo, we'll use two laptops and one of the infected keyboards.
1274170	1279850	Time to say goodbye and jump to the conclusions, and obviously the questions and answers.
1281430	1288610	Our conclusions are that you always have to be wary of any new device, whether USB or not.
1288610	1297550	This may seem obvious, but anyone could be a victim. Be honest, would you have suspected
1298290	1306510	of this keyboard if you just saw it lying around in a desktop or in your office? Probably not.
1307750	1318590	And bear in mind that with a few dollars anyone can build or even buy a product of this type,
1318590	1325650	in this case. It is never possible to use preventive measures against SBS.
1326530	1331450	And always remember that the mousetrap works because the mouse doesn't quite understand
1331450	1338970	why the cheese is free. So educate your users to do not pick things from strangers.
1341810	1348610	You can get in touch with us at GitGov, Mauro Eldridge and DC5411, or on Twitter,
1348610	1353610	you have our handlers here. We are always open to discuss about hardware hacking,
1353610	1358390	social engineering and hacking in general, so we'll be more than happy to talk with you.
1359050	1364970	If you have any questions, we'll gladly answer them in the chat. Thank you!