WEBVTT 00:00.000 --> 00:08.960 Okay, welcome to our talk, Evil Genius, Why You Shouldn't Trust That Keyboard, by Farid Perez and Mauro Eldridge from DC5411. 00:09.900 --> 00:16.420 Before we start, let's make a brief introduction on this talk and on ourselves, the speakers. 00:17.320 --> 00:22.420 I am Mauro Eldridge, I'm an Argentine hacker and I'm the founder of DC5411. 00:22.780 --> 00:37.340 I work as a cybersecurity architect and I was a speaker the last years at DEFCON Las Vegas, Siberia, Roadsec Brazil, Dragonjar Colombia, POSCON Iran and the Texas Cyber Summit, among other conferences. 00:39.980 --> 00:42.200 Thank you, Mauro. 00:42.200 --> 00:49.660 Hello everyone, my name is Farid Perez Saez, I am a Colombia hacker assisting in communication. 00:49.760 --> 00:59.380 I work as a professor at the University of La Guajira and I am a member of DC5411 group. 00:59.380 --> 01:06.220 Also, being a speaker at Dragonjar Colombia, I'm now a DEFCON in this village. 01:07.080 --> 01:16.080 The objective of this talk is to explain bad USB attacks in a different way, combining hardware hacking, human hacking and social engineering. 01:16.600 --> 01:25.940 In this case, we will explain this type of attack using one of our evil creations, a tampered keyboard, which acts as a remote keylogger. 01:26.800 --> 01:36.180 As you can see in this photograph, it seems to be a classic keyboard, a normal cheap keyboard without any suspicious. 01:37.220 --> 01:40.700 But well, you may be wrong. 01:42.020 --> 01:45.020 It looks pretty normal. 01:46.300 --> 02:10.980 This talk is divided into two chapters, the social engineering one, where we try to create a plausible alibi and the necessary conditions for our attack to be effective, and the hardware hacking one, where we explain the mechanics to build a bad USB with cheap ports and how we use this bad USB for exfiltration of data. 02:12.600 --> 02:22.660 Just a little disclaimer, the speakers have full permission from affected parties to conduct this experiment in an authorized manner. 02:22.680 --> 02:32.160 This is a complex reptilian exercise, and the authors weren't involved directly or indirectly in any illegal activity. 02:33.260 --> 02:36.840 Let's start with the first, the social engineering. 02:36.840 --> 02:49.840 The point of the experiment was to infect a user without any direct interaction, using only the bad USB keyboard, but without being able to touch it, even to connect it. 02:50.160 --> 02:58.360 So we had to rely on social engineering or human hacking to get someone else to do their job on our behalf. 02:59.520 --> 03:02.080 This is what we had so far. 03:02.180 --> 03:09.680 Our victim, an educational institution, had no physical access to the place or help from the inside. 03:09.920 --> 03:18.660 They only had an open guest Wi-Fi connection, which we were not allowed to mess with, and it was segregated from the main network. 03:18.960 --> 03:25.860 So, at first, it might not seem like a really valuable asset at first. 03:25.860 --> 03:39.680 And we had a modified keyboard with our bad USB in its original box, with its accessories and manuals and everything you expect to find in a brand new unboxed item, right? 03:41.120 --> 03:45.230 So let's try to simplify this equation. 03:45.230 --> 03:50.510 We had no physical access from the inside and an original box. 03:50.510 --> 03:59.230 We had to create an attack vector from these really pure assets. 03:59.770 --> 04:03.710 So what can we do with no physical access and a box? 04:03.890 --> 04:13.150 The obvious first thing that came to our mind was the fake postal service. 04:13.490 --> 04:15.930 We have a postal imposter. 04:16.350 --> 04:27.990 This was way out of our scope, so we wanted to do something similar but not so violent. 04:28.670 --> 04:33.010 So we came with this little strategy. 04:36.050 --> 04:42.610 Delivering an unsolicited keyboard could only be some strange and suspicious. 04:42.610 --> 04:48.050 You are not expecting an unsolicited keyboard any day of the week. 04:48.330 --> 04:58.310 So we had to improve our game and resort to helping the local industry by printing a few extra things for a small price. 04:58.830 --> 05:02.370 And these few extra things are the following. 05:03.870 --> 05:15.710 Note that we have censored the trademark, the brand, because the manufacturer is not linked in any way. 05:15.710 --> 05:19.150 It's not related to the stock or this experiment. 05:20.770 --> 05:33.690 So we had for a few dollars, we had stickers, a t-shirt, and a neatly packaged keyboard ready to be sent to the institution along with a simple letter. 05:34.410 --> 05:36.770 Absolutely nothing to suspect. 05:37.350 --> 05:39.610 Well, maybe. 05:40.230 --> 05:45.790 The package was sent via a well-known private courier app who confirmed its receipt. 05:48.010 --> 05:55.990 A few hours later, we were already quite concerned with the package market as received, but nothing happening. 05:56.410 --> 06:01.410 After a while, our keylogging data began to populate. 06:01.750 --> 06:08.910 Now you might question, you might ask yourself, how does this bad USB keyboard work? 06:09.570 --> 06:18.930 So, now my partner, Farid, the hardware hacker of the group, will explain you the magic behind this electronic tampering. 06:19.530 --> 06:21.690 Thank you, Mauro. 06:21.690 --> 06:36.170 Here we have the planned component used in this project, which if we want to do it ourselves, we must have a normal keyboard of the model most used in your country. 06:36.170 --> 06:53.610 The wireless network component for Arduino ESP8260 and Arduino Nano, a standard USB cable and command and control server, the Arduino programming interface, and above all, lots of patience. 06:54.290 --> 07:01.830 In this diagram, it is possible to observe the keyboard schematic. 07:01.830 --> 07:25.150 It depicts the operation from the moment the user inerts the keyboard's USB cable without generating that the keyboard has the Arduino Nano device with an ESP8260 wireless interface. 07:25.150 --> 07:47.490 For setting all the information entered to the keyboard to a C2 server, which will use PHP MySQL and PHP tools, where the hacker will be receiving all the information entered by our already tampered keyboard. 07:48.930 --> 07:55.130 All TPs are cheap and easy to conceal inside the device. 07:55.610 --> 08:02.810 This part does not add significant weight to the keyboard. 08:03.190 --> 08:08.930 There is no sign that could make the victim suspicious. 08:11.070 --> 08:19.950 In this image, you can see each component mentioned in the functional prototype of the attach. 08:20.910 --> 08:28.870 This image presents the POST method code to server C2. 08:30.150 --> 08:44.680 This image shows the C2 server connection code, or how to use USB model to steal data online. 08:45.080 --> 09:05.420 As you may already know, this bad USB has a command and control server, which is built upon a LAMP stack, Linux, Apache, MySQL, PHP and PHP MyAdmin, database and a simple table, as you may see now. 09:06.240 --> 09:10.000 You can see that there are at least 28 rows. 09:10.000 --> 09:12.560 These rows represent sessions. 09:12.580 --> 09:18.820 I'll take a moment to explain you what sessions are on this bad USB keyboard. 09:19.240 --> 09:33.140 Once the buffer of the keyboard stops receiving data for a certain amount of time, it closes the buffer and uploads its contents to the web server, this command and control server. 09:33.220 --> 09:39.540 So it has separated different inputs by sessions. 09:39.640 --> 09:43.280 Let's try to inspect some of these sessions. 09:43.440 --> 10:05.880 For example, here, session number 11 is when the user attempts to access gmail.com, but instead of entering its credentials, the victim jumps into another task, let's say Microsoft Word, and starts typing a document about Torres Javier. 10:06.320 --> 10:14.700 Then he goes back to Gmail, enters his credentials, or hers credentials, and passwords. 10:16.840 --> 10:20.090 We have another example here of passwords. 10:21.260 --> 10:23.740 And then internal instructions. 10:23.740 --> 10:31.780 For example, on number 20 it says I have bought a rim of paper for the office. 10:32.640 --> 10:40.140 On session 21 it says I have made a Mercado Todo recharge for the office. 10:40.140 --> 10:41.980 And it continues, right? 10:44.030 --> 10:47.910 Here we can see on session 24 another password. 10:47.910 --> 10:54.830 Try to picture obtaining these passwords with other methods, for example with cracking. 10:55.270 --> 11:05.490 It won't be certainly impossible, but it will take you a longer time than simply using this bad USB. 11:06.190 --> 11:11.910 On session 25 we have our first case of personal identifiable information. 11:12.470 --> 11:28.990 As you can see behind the encoding error, it says Cédula Ciudadanía, which means, translated from Spanish, national ID, which is the equivalent for the SSN, the social security number in the USA. 11:28.990 --> 11:35.470 It's a number that identifies a citizen, so it is treated as private information. 11:37.690 --> 11:44.410 Then on session 22 we have the login from an online banking site. 11:44.410 --> 11:46.910 Obviously the credentials were there too. 11:49.420 --> 11:53.520 So far, you may ask yourself what you can do. 11:53.520 --> 12:04.400 Well, you can obtain credentials for any local or remote service, for local users or cloud services or different providers online. 12:05.220 --> 12:11.300 You can obtain private information about users, resources, documents and infrastructure. 12:12.000 --> 12:17.600 You can discover internal conversations or communications, as we have seen before. 12:17.600 --> 12:25.640 You can see internal orders, for example, or internal documents about daily basis tasks. 12:26.840 --> 12:43.360 You can use this keyboard as a pivot for new attacks, and in very specific scenarios, rare scenarios, an attacker could compromise an entire supply chain, replacing normal keyboards with infected ones. 12:45.530 --> 13:01.050 I know this may sound actually a little bit crazy or a little bit too rare or too unique, but some days ago counterfeit or fake Cisco switches were deployed in production. 13:01.930 --> 13:15.190 So a network engineer saw that his core switch was failing or acting clunky, tried to troubleshoot it and ended up finding that it was a counterfeit one. 13:15.630 --> 13:18.270 That's about counterfeit hardware. 13:18.270 --> 13:35.350 I want to offer you a small appendix with a brief explanation and comparison of fake hardware, and to speak about the possibility of using it for red teaming, aside from what everybody else is using it for, you know, shading. 13:37.790 --> 13:43.870 You might notice first case, it's the keyboard that we were talking about. 13:43.870 --> 13:45.630 This is our own prototype. 13:46.310 --> 13:55.830 You might find no substantial differences on the outside, no evidence of tampering, nothing really to worry about. 13:56.630 --> 14:03.930 And this is the original one, with a non-stock picture from an e-commerce site. 14:03.930 --> 14:08.570 As you see, there are no differences between them. 14:09.250 --> 14:14.650 But this tampering is not really limited to any kind of hardware. 14:14.650 --> 14:17.410 You can tamper anything you want. 14:18.010 --> 14:27.410 For example, let's take a look at this set of speakers that we have tampered ourselves, for another case study. 14:28.470 --> 14:36.470 These speakers might look, as the keyboard, really normal on the outside, nothing really weird about them. 14:36.470 --> 14:41.710 But once you open them, you find they are tampered. 14:41.710 --> 14:50.690 You find that they have another hardware pieces scattered around, which makes it really suspicious to a trained eye. 14:51.590 --> 14:56.830 Now let's take a look at a photograph of these original speakers. 14:57.670 --> 15:00.770 Again, a non-stock picture from an e-commerce site. 15:00.770 --> 15:02.410 They are recently unboxed. 15:02.530 --> 15:08.270 As you might see, there's nothing to worry about, nothing really strange or weird about them. 15:09.490 --> 15:13.150 But this is not only limited to small hardware. 15:14.670 --> 15:21.610 Even critical hardware like switches, in this case core switches from Cisco, can be tampered with. 15:22.570 --> 15:33.130 This is a very good comparison between an original Cisco switch board and two counterfeit ones. 15:33.210 --> 15:35.390 The source is F-Secure. 15:35.770 --> 15:40.110 As you can see, the one in the left, it's the original one. 15:40.350 --> 15:43.690 The second and third are counterfeit. 15:43.690 --> 15:56.110 Take a look at the second, on the lower half, it has the Cisco trademark printed on the board, while the third one not. 15:56.470 --> 16:03.970 So differences are subtle and can be really overlooked by an untrained eye. 16:03.970 --> 16:07.270 This is what's the dangerous part of this. 16:07.270 --> 16:11.830 It is very easy to be misled by this hardware. 16:11.990 --> 16:16.410 It doesn't end here, this is not something new as I said before. 16:17.070 --> 16:26.050 A user on Reddit a year ago posted about being a victim of counterfeit Cisco devices. 16:26.670 --> 16:35.750 Let's take a look at first at an original Cisco switch from panel and then a counterfeit one. 16:36.270 --> 16:42.450 The sources on these images are Reddit, the original post, and eBay. 16:43.790 --> 16:46.130 This is the original one. 16:46.810 --> 16:52.490 As you may see, this is what you expect to unbox from Cisco. 16:53.350 --> 16:56.090 And this is the counterfeit one. 16:56.730 --> 17:02.150 It's basically what you expect again to unbox when you buy a Cisco switch. 17:02.150 --> 17:08.030 So there are no really really big differences. 17:08.510 --> 17:15.610 Some of the most noted differences on counterfeits are the bright on the numbers of the ports. 17:15.610 --> 17:22.470 As you may see 1, 2, 11, 13, 12, and 14, 23, 24, etc. 17:22.670 --> 17:26.870 This is something that is most noted on the internet. 17:26.870 --> 17:32.050 The brightest of those numbers, nothing else from the front. 17:33.370 --> 17:38.330 And some people noted that the screws are different. 17:38.750 --> 17:49.710 So unless you open it, or unless you have something really really specific about it, you won't suspect. 17:50.610 --> 17:58.690 This is just to make you understand the dangers of counterfeit or fake hardware. 17:58.690 --> 18:04.190 And that are out there, there are people dedicated to faking this kind of hardware. 18:04.390 --> 18:09.230 Not only for a redeeming exercise like ourselves, but to make a profit from it. 18:09.230 --> 18:18.590 And it is really really dangerous to corporations, or to small companies, and to almost every institution out there. 18:20.650 --> 18:28.670 So before we close this talk, we would like to share a little demo with you about this keyboard and how it acts. 18:31.350 --> 18:36.630 So since this is a demo, we'll use two laptops and one of the infected keyboards. 21:14.170 --> 21:19.850 Time to say goodbye and jump to the conclusions, and obviously the questions and answers. 21:21.430 --> 21:28.610 Our conclusions are that you always have to be wary of any new device, whether USB or not. 21:28.610 --> 21:32.810 This may seem obvious, but anyone could be a victim. 21:33.330 --> 21:44.150 Be honest, would you have suspected of this keyboard if you just saw it lying around in a desktop or in your office? 21:44.610 --> 21:46.510 Probably not. 21:47.750 --> 22:00.050 And bear in mind that with a few dollars anyone can build or even buy a product of this type, in this case. 22:01.310 --> 22:05.650 It is never possible to use preventive measures against SBS. 22:06.530 --> 22:13.670 And always remember that the mousetrap works because the mouse doesn't quite understand why the cheese is free. 22:13.890 --> 22:18.970 So educate your users to do not pick things from strangers. 22:21.810 --> 22:30.330 You can get in touch with us at GitGov, Mauro Eldridge and DC5411, or on Twitter, you have our handlers here. 22:30.650 --> 22:38.390 We are always open to discuss about hardware hacking, social engineering and hacking in general, so we'll be more than happy to talk with you. 22:39.050 --> 22:44.450 If you have any questions, we'll gladly answer them in the chat. 22:44.510 --> 22:44.970 Thank you!