2019.04.
26 TLP:WHITE
THE RISE OF EVIL HID
DEVICES
Franck Bitsch (@Requiem_fr)
Arthur Villeneuve (@Crypt0_M3lon)
(@CertSG)
BLUE TEAM - 2006
8 members
https://github.com/certsocietegenerale
IRM
FIR
FAME
SWORDPHISH
RED TEAM - 2018
2 members
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 2
TABLE OF CONTENTS
1. INTRODUCTION
2. ATTACKER PERSPECTIVES
3. MALICIOUS HID DEVICES ANALYSIS
4. TAKE AWAY
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 3
1
MALICIOUS HID
DEVICES
INTRODUCTION
INTRODUCTION
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 5
INTRODUCTION
Back in December 30, 2013
The NSA “toolbox” leaked to the press
Hardware and software implants in use since 2008, at least…
Originally cost about $20,000
Far cheaper implants designed since
COTTONMOUTH-1 is a HID implant – TRINITY embeds a microcontroller and memory, HOWLERMONKEY is a radio-frequency module used for remote control
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 6
RUBBER DUCKY
SOLD BY HAK5 SINCE 2010-11
One of the earliest widely available malicious HID device
Connectivity: USB
External communication method: None
Payload storage:
Payload uses a dedicated compiled scripting language
Stored on a FAT32 SD card (payload.bin)
Launch method: automatically when plugged or via push-button
Exfiltration method: through the executed payload, none via the board
Visual aspect: USB stick by default, can probably be embedded in another type of device
Price: $45
Basic capabilities, no way to remotely interact with the device
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 7
WHID INJECTOR
CREATED BY LUCA BONGIORNI IN 2017
Presented at Hack In Paris 2018, Defcon, BlackHat US/EU, etc.
Forensic detection methods published by the author
Connectivity: USB, Wi-Fi
External communication method: Wi-Fi (4G for WHID Elite)
Can create an access point or join an existing network
Payload storage: on the local chip
Launch method: Wi-Fi or automatically when plugged
Exfiltration method: Wi-Fi or serial port (Win 10+, Linux, etc.) embedded on the board
Visual aspect: USB key by default, can be embedded in another type of device
Price: $15 for the WHID ($20 for USB hub + a mouse)
Most complete device, possibility to live interact and exfiltrate data though
Wi-Fi. Can be hidden in a real device
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 8
USB NINJA
CREATED BY THE RFID RESEARCH GROUP IN 2018
Based on Mike Grover (@_MG_) work https://mg.lol/blog/
Connectivity: USB, Bluetooth Low Energy (BTLE)
External communication method: BTLE
Bluetooth password is hardcoded
Payload storage: as a compiled Arduino program on the board
Launch method: automatically when plugged or triggered via Bluetooth remote control
Exfiltration method: via the executed payload, none via the board
Visual aspect: functional USB cable (Micro USB, USB Type C & Lightning)
Price: $180 (for the complete kit : USB cable / magnetic ring / BTLE remote control)
Interesting device by its form factor, possibility to remotely launch the
payload though BTLE
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 9
2
ATTACKER
PERSPECTIVES
GAIN REMOTE ACCESS
Remember Mr. Robot’s season 1 episode 6:
Darlene drops a USB stick in a parking so Elliot can gain access to the prison’s network
This technique is used by Red Teams during their missions
Classical payload is to call a one-liner PowerShell:
Other opportunities?
Use “lolbins” to download and execute malicious files
– certutil.exe
– bitsadmin.exe
– etc.
Drop embedded files within the payload and execute them
LOLBINS: “Live-Off-the-Land Binaries” – legitimate files available on a system’s default installation that can be used for malicious purposes
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 11
EXFILTRATE DATA
With WHID Cactus, you can use a serial port to exfiltrate data
On Windows 10, serial ports are automatically handled by the system
In our case, this attack does not bypass USB DLP solution
The payload is simple:
Read and encode the file we want to exfiltrate
Iterate though all available COM ports
Try to write an encoded file on each COM port
From an attacker’s viewpoint, we need to be able to access the Web interface of the device in order to download exfiltrated data
On close range: just connect to the WHID access point
Longer range: connect the WHID to a public Wi-Fi available from outside
Very long range: connect through a 4G network (with the future WHID Elite version)
No range at all: go to the office to pick up your malicious devices (you or someone hired to do this job… you know like an evil maid…)
“EVIL MAID”: threat model for unattended devices that may be accessed by potentially malicious third parties
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 12
3
MALICIOUS HID
DEVICES
ANALYSIS
IT ALL STARTS WITH AN ALERT
As an Incident Response team, how would you respond to
a situation involving malicious HID devices?
Usual starting point: somehow an alert is raised
• Your data leak prevention system is triggered
• An alert in your SIEM fires
• A user reports suspicious behavior
“SIEM”: Security Information and Event Management tool -
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 14
DIGITAL FORENSICS AND INCIDENT RESPONSE
The basic IR / forensic analysis
Collect and raw
dump suspected
devices
Gather related • External device / USB usage
Analyze dumps
devices • Program execution
• File or folder opening
• File download
Extract Indicators
Run Threat hunting
of Compromise
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 15
DIGITAL FORENSICS
External device / USB usage and program execution
• Lots of useful artifacts:
• Amcache.hve
• MRU run commands
• SOFTWARE hive registry
• SYSTEM hive registry Amcache stores useful information regarding program execution
Sample event from Windows audit logs
• Plug and Play log files
• Prefetch files
• Windows event logs
USB devices leave timestamped traces of usage in the Plug n’ Play log files (capture above) and the Registry (capture below)
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 16
DIGITAL FORENSICS
External device / USB usage and program execution
• Useful Windows event IDs in our case:
• PnP:
• Event ID 20001: Plug and play driver install attempted.
• %system root%\System32\winevt\logs\System.evtx (win 7/8/10)
Event ID 225 means your USB device cannot be removed
because it's currently used by the listed process...
• Event ID 225: The application System with process id xxx stopped the in our case PowerShell...
removal or ejection for the device USB\VID_xxxx&PID_xxxx\xxxxxxxxxxxx.
This nice “side effect” makes the link between PowerShell
• %system root%\System32\winevt\logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx usage and our suspicious USB device
• PowerShell:
• Event ID 400: upon the start of any local or remote PowerShell activity.
• Event ID 403: upon the end of the PowerShell activity.
• Event ID 600: indicating the onset of PowerShell remote activity on both
source and destination systems.
• %system root%\System32\winevt\logs\Windows PowerShell.evtx
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 17
DIGITAL FORENSICS
External device / USB usage and program execution
Base64-encoded payload from a Windows event (right) decoded to discover relevant artifacts (center/down)
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 18
SUSPICIOUS USB DEVICE
So far we only know that a USB device was used to launch a PowerShell payload…
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 19
SUSPICIOUS USB DEVICE
The basic rule: do not plug any suspicious device
without prior analysis
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 20
SUSPICIOUS USB DEVICE ANALYSIS
No risk? Really?
USB KILLER V3 Mr. Self Destruct
project
from
Mike Grover
USB killer fries systems it is connected to by delivering high-voltage current when plugged-in.
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 21
SUSPICIOUS USB DEVICE ANALYSIS
The basic process:
1. External inspection
2. Internal inspection
3. Component identification
4. Interaction with the device: data dump
5. Dump analysis
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 22
THE SIMPLE CASE: RUBBER DUCKY
1. Extract the SD card from the device
2. Use your favorite forensic tool to retrieve current and deleted files
Payloads can be decoded using a Perl script or online
https://github.com/hak5darren/USB-Rubber-Ducky/blob/master/Decode/ducky-decode.pl
https://ducktoolkit.com/decode
Remember that payloads depend on the keyboard layout ☺
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 23
WHID INJECTOR
In our case the WHID injector was hidden inside a mouse
BUT
it could be hidden inside any USB device with enough room
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 24
WHID INJECTOR
Let’s dump this flash memory chip!
1. Unsolder it to avoid any potential interference
2. Solder it back to a breakout board
3. Connect to the Serial Peripheral Interface (SPI) pins
4. Invoke the holy spirit of electronics …
5. And …
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 25
WHID INJECTOR
Dump the chip and try to read some data…
flashrom is a tool that can automatically extract the content of various chips
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 26
WHID INJECTOR https://prog2017.rmll.info/IMG/pdf/hydrabus_rmll.pdf
If the targeted chip is not supported by a tool such as flashrom, you can use hardware tools
that allow you to talk directly with the chip such as HydraBus
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 27
WHID INJECTOR The device embeds an ESP8266 microcontroller which use SPIFFS
Data extraction to manage files storage on the external EN25Q32 SPI flash
Wi-Fi configuration Payloads
And… some intel about the attacker…
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 28
WHID INJECTOR
Stolen data extraction
Remember the PowerShell command line run on the targeted computer?
Is there any chance to recover stolen data from the flash dump?
From carving the ROM dump (left) we end up finding the contents of the « secret.jspg » file that were referenced earlier.
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 29
USB NINJA
Somehow your forensic analysis leads you to this device…
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 30
USB NINJA
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 31
Work still ongoing on this one
USB NINJA Stay tuned !
Step 2
Step 1
Chip off the BLE module
Chip off the AVR µController
And try to dump its content
And try to dump its content
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 32
4
TAKEAWAYS
TAKEAWAYS
IoT / Hardware Implant there is still a lot to be done in the forensics field
Electronics available to everyone no longer reserved to state-sponsored attackers
Equipment and practice are keys to success
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 34
Thank you for your attention
Questions?
Let’s keep in touch
https://github.com/certsocietegenerale
@CertSG
@Crypt0_M3lon
@Requiem_fr
DFRWS EU 19 │ TLP: WHITE │ 2019.04.26 │ 35
