“Plug and Root,” the USB Key
to the Kingdom
Darrin Barrall and David Dewey
SPI Dynamics
July 27, 2005

Who wouldn’t plug these in??

They Could Be Owning You• Very little in the realm of USB security– OS level issues• Autorun– USB Protocol Enforcement• USB equivalent of raw sockets

Attack Vector• Basically a hardware trojan• Not the idea of walk-up and own (whilethat is a nice side effect)

Autorun• By default, only works with nonremovable media• How to make a USB thumb drive “nonremovable”

In-System Programming• Many USB controllers allow for ISP• Allows an attacker to “re-flash” the device
with his own information• Make the device tell Windows it’s a nonremovable device

Here’s Why this Attack is Lame
• Attack is in user space– Yes, there are plenty of ways to escalate
privileges, but it sure would be nice to not have todo them.

• Autorun must be enabled• USB protocol is not enforced anywhere– Let’s target that.

Peripherals / VID + PID• Many preconfigured USB controllers available
on the market– Philips– Intel– Etc.

• SL811 – Allows for the configuration of allpieces of the USB pie – the proverbial rawsocketHost• USB is like TCP– Built on a state machine– Believes that it will get what it wants

Windows Expecting Us to Be
NiceWindows Expecting Us to Be
Nice (Cont’d)

POOF!!

The Rest is Up to You• Heap Overflow• Who’s up for the challenge??

Power Up• USB gives us ~5V• Blowing the USB power supply could be
fun – but a little lame

Throw the Switch• USB does not require the physical removal ofa device for it to be “removed”• This allows a device to be “inserted” and“removed” as neededFaces• SL811 does not store the descriptors
internally• This allows the chip to appear to be ANY
device supported by the OS• This allows the device to enter and execute
portions of drivers that are not thoroughly
field tested

Emulation• Emulating other devices• Device drivers are typically written with a lotof trust• Our emulating device will exploit that trust
relationship

Writable Read-Only Devices• Host-side code makes a request to read an
address from the “read-only” device• The meta-device returns garbage data
• The host is happy thinking it just read data
• The address requested is the four bytes ofdata recorded by the meta-device

Empty the “Trash”• Hand one to your janitor and $20

Class• Class drivers allow multiple vendors to create
similar devices without the need for individual
drivers• Allows for a broad attack against the classdriverPatched??
• Say the driver you’ve been exploiting
eventually gets patched• VID++; //Need I say more??

Meta-Hub• Hubs are so different, they have their own
section in the USB specs• Many more attack vectors• Possible BlackHat 2006 speech??
• See you then!

DefenseEpoxy the USB Port Shut

Just kidding

Software Solution• http://www.safend.com/• Requires the client to be installed on everymachine• Tell the software that you are a device that isallowed to be there• No USB protocol enforcement??

Nice Idea
• Software solution to enforce USB
protocol and disable Autorun

Hardware• Nice theory• In-line USB device that would perform
protocol enforcement to perform all thevalidation the OS should doReferences•

Toaster Oven Reflow:– http://www.seattlerobotics.org/encoder/200006/oven_art.htm•Parts:– http://www.digikey.com•

All Things USB:
– http://www.usb.org/•

All Things USB 1.1:
– http://www.usb.org/•usb1.1spec

SL811 Datasheet:– http://www.cypress.com/portal/server.pt?space=CommunityPage&control=S
etCommunity&CommunityID=209&PageID=259&fid=10&rpn=SL811HS•

Useful Pages:– http://www.beyondlogic.org/usbnutshell/usb1.htm– http://usbdeveloper.com/

QUESTIONS?
Darrin Barrall and David Dewey
SPI Dynamics