When USB devices attack Manchester Grey Hats PRESENTED BY: Tim - PowerPoint PPT Presentation

Jan 28, 2023 •370 likes •606 views

When USB devices attack Manchester Grey Hats PRESENTED BY: Tim Wilkes @mcrgreyhats Disclaimer: Please dont be a dick. I accept no responsibility. Ever. For Anything. 1997 was not a good year... Windows 95 OSR 2.5 came out

When USB devices attack Manchester Grey Hats PRESENTED BY: Tim Wilkes @mcrgreyhats
Disclaimer: Please don’t be a dick. I accept no responsibility. Ever. For Anything.
1997 was not a good year... · Windows 95 OSR 2.5 came out · Difgerent connectors for difgerent devices · USB Support · Autorun was a thing · Clippy...
Fast forward to 2017... · USB Keyboards · USB Storage · USB Network · USB Serial Interfaces · USB fans ? · USB gimmicks
So USB does quite a bit... · How does the computer know what device is attached? ·
Interested in USB Development? · Try the HIDIOT by Rawhex. · Rawhex is not Digistump · The HIDIOT is not a digispark · They are compatible · The HIDIOT is awesome for USB development · Rawhex are awesome – We have 2 HIDIOTS to give out
Just to back up a little · Season 2 (Episode 3) of Hak5 released the USB Switchblade based on USBdumper (2006) · Later USB-hacksaw · Utilized Autorun with the USB storage. · Later became the basis for the...
USB Rubber ducky
Must be a good idea... · Many imitators · Peensy / T eensy · Digispark / ATTiny based · BAD USB · Now the Bash Bunny is also available · Network / storage /keyboard / serial
Also The Lan turtle · Network based attacks · Imitators too · Poison tap
Enter Mr Robot · USB drops · Rubber ducky costs $50 · Bash Bunny costs $150 · Not cheap / disposable
Way too expensive · So what about the alternatives? · T eensy is around £10 · Peensy is more (+ soldering) · BADUSB – PITA (if you can fjnd the drive) · Digispark is £1 – We have a winner!
Downsides · Looks – requires camoufmage · Limited memory · Can’t type out meterpreter (directly) · Has no feedback (but none of the devices do)
Speaking of Feedback... · If you enjoy the workshop, please leave feedback on meetup.com
Is everyone set up for the Workshop? · Do you have the Arduino software installed? · Do you have the digispark board installed? · http://digistump.com/package_digistump_ index.json · Drivers?
The IDE
Ex 1 - Blinken Lights
Ex 2 – T ext in Notepad
Ex 3 - Fakeupdate
Ex 4 – Web deploy
Ex 5 - Random Number Gen · Don’t use in anger!
Ex 6 – Rubber Ducky Payload
Questions? CONTACT: usb@php-systems.com License statement goes here. Creative Commons licenses are good.

Recommend

Threats to Mobile Devices Possible attack threats to mobile devices Network exploit

Threats to Mobile Devices Possible attack threats to mobile devices Network exploit Hackers takes advantage of vulnerability or flaw of users web browser on mobile device in WiFi communication to attack victims. Hackers send

464 views • 30 slides

A Cache Poisoning Attack Targeting DNS Forwarding Devices Xiaofeng Zheng , Chaoyi Lu, Jian Peng,

Poison Over Troubled Forwarders: A Cache Poisoning Attack Targeting DNS Forwarding Devices Xiaofeng Zheng , Chaoyi Lu, Jian Peng, Qiushi Yang, Dongjie Zhou, Baojun Liu, Keyu Man, Shuang Hao, Haixin Duan and Zhiyun Qian DNS Forwarder Devices

593 views • 20 slides

Attack vectors on mobile devices Tam Hanna aka @tamhanna About /me Tam HANNA

Attack vectors on mobile devices Tam Hanna aka @tamhanna About /me Tam HANNA CEO, Tamoggemon Ltd. Runs web sites about mobile computing Starting thoughts Different user perceptions Mobile phones are always on the

923 views • 74 slides

WAMOS 2018 Common Attack Vectors of IoT Devices 09.08.2018 Alexios Karagiozidis Motivation

WAMOS 2018 Common Attack Vectors of IoT Devices 09.08.2018 Alexios Karagiozidis Motivation Botnetworks and Internet attacks increased rapidly Examples of security issues: Mirai-Bot-Network CVE-2018-10967, bufferoverflow via

848 views • 27 slides

Attack on Traffic Systems These attack examples have happened in the past. We will take an

From start to finish how a cyber attack would be performed on traffic system, we will go over first day >> exploitation of the device >> the real-world aftermath. Mission Secure, Inc. Attack on Traffic Systems These attack examples

556 views • 18 slides

Dropping legacy devices in Qemu Gabriel Laskar <gabriel@lse.epita.fr> Why do we need a

Dropping legacy devices in Qemu Gabriel Laskar <gabriel@lse.epita.fr> Why do we need a smaller VM? Reduced boot time Smaller attack surface Performances Why not? ISA Devices On a fixed io address (non discoverable, no

419 views • 12 slides

Cohesive Devices Cohesive devices Cohesive devices are like

Cohesive Devices Cohesive devices Cohesive devices are like road signs. They keep the text running smoothly , making it clear which direc8on to

431 views • 7 slides

ATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on

ATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks Yandong Li* 1 Lijun Li* 1 Liqiang Wang 1 Tong Zhang 2 Boqing Gong 3 *Equal Contribution 1 University of Central Florida 2 Hong

440 views • 11 slides

Detecting a Biological Attack The attack will not be obvious; it may take hours or days to know.

Detecting a Biological Attack The attack will not be obvious; it may take hours or days to know. Current biological diagnostics are very effective at identifying agents, but theyre slow. We already have an infrastruc- ture in place to

233 views • 8 slides

ss 8 Class Cl CSC 495/583 Topics of Software Security PLT, GOT & Return-to-plt Attack

ss 8 Class Cl CSC 495/583 Topics of Software Security PLT, GOT & Return-to-plt Attack & GOT Overwrite Attack Dr. Si Chen (schen@wcupa.edu) Review Page 2 ret2libc Attack Page 3 libc C standard library Provides

662 views • 36 slides

in Mixed-Signal IoT Devices Dennis R. E. Gnad, Jonas Krautter, Mehdi B. Tahoori I NSTITUT FR T

Leaky Noise: New Side-Channel Attack Vectors in Mixed-Signal IoT Devices Dennis R. E. Gnad, Jonas Krautter, Mehdi B. Tahoori I NSTITUT FR T ECHNISCHE I NFORMATIK C HAIR OF D EPENDABLE N ANO C OMPUTING KIT University of the State of

480 views • 36 slides

ASSISTIVE DEVICES ASSISTIVE DEVICES & RELAY SERVICES Communications & Alert Devices

ASSISTIVE DEVICES ASSISTIVE DEVICES & RELAY SERVICES Communications & Alert Devices Flashing lights for doorbells & fire alarms, etc. Scrolling text & text inputs on g p shelter intercoms Vibrate for baby crying, etc.

251 views • 11 slides

.tr DDoS Attack December 2015 Attila zgit .tr ccTLD Manager Dec, 2015 .tr DDoS Attack A

.tr DDoS Attack December 2015 Attila zgit .tr ccTLD Manager Dec, 2015 .tr DDoS Attack A Summary of a 3 weeks long experience 2016-03-07 Dec 2015 DDoS Attack on .TR 2 Before DDoS q Infrequent Small scale DoS and DDos Attacks Few

606 views • 14 slides

A New Side-Channel Attack on RSA Prime Generation Thomas Finke, Max Gebhardt, Werner Schindler

A New Side-Channel Attack on RSA Prime Generation Thomas Finke, Max Gebhardt, Werner Schindler Federal Office for Information Security (BSI), Germany Lausanne, September 7, 2009 Outline r Introduction and Motivation r The Attack r Basic attack

514 views • 25 slides

Cryptanalysis of PRINT CIPHER : The Invariant Subspace Attack Gregor Leander, Mohamed

Description of PRINT CIPHER The Attack Relation To Truncated Differential Attack Conclusion Cryptanalysis of PRINT CIPHER : The Invariant Subspace Attack Gregor Leander, Mohamed Abdelraheem, Huda AlKhzaimi, and Erik Zenner DTU Mathematics

598 views • 37 slides

Ransomware Attack Briefing Presidents Leadership Council October 21, 2019 August 8 Cyberattack

Ransomware Attack Briefing Presidents Leadership Council October 21, 2019 August 8 Cyberattack Summary : The attack was severe and sophisticated; categorized as a catastrophic attack. It was highly strategic with regard to timing

329 views • 16 slides

TCPDB.DAT case Archive file signatures Attack surface Attack vectors Defense Conclusions P A

Introduction Motivation SAP compression algorithms Archive file programs SAP archive file formats CAR SAR v2.00 SAR v2.01 Relative/absolute paths TCPDB.DAT case Archive file signatures Attack surface Attack vectors

913 views • 49 slides

ASCs 5.1 Surround ATTACK Wall walls and corners. Its name, ATTACK is an acronym that

December 7-8, 2001, Beverly Hills, CA. Corporation, at the Surround 2001 International Conference and Technology Showcase, .E., President of Acoustic Sciences Transcript of a seminar presented by Arthur Noxon P ASCs 5.1 Surround ATTACK Wall

243 views • 6 slides

Identifying Attack Vectors Professor Larry Heimann Web Application Security Information Systems

Identifying Attack Vectors Professor Larry Heimann Web Application Security Information Systems Nothing is in isolation Attack surface An attack surface is the total number of possible attack vectors Think of a house, with the

309 views • 15 slides

Input Input devices Text entry Positional input Input Devices 1 iPod Wheel Input Devices 2

Input Input devices Text entry Positional input Input Devices 1 iPod Wheel Input Devices 2 MacBook Wheel (The Onion) - https://youtu.be/9BnLbv6QYcA - https://www.student.cs.uwaterloo.ca/~cs349/videos/macbook_wheel.mp4 Input Devices 3

737 views • 32 slides

Attack Class: Address Spoofing L. Todd Heberlein 23 Oct 1996 Net Squared Inc. todd@NetSQ.com

Attack Class: Address Spoofing L. Todd Heberlein 23 Oct 1996 Net Squared Inc. todd@NetSQ.com Overview of Talk l Introduction l Background material l Attack class l Example attack l Popular questions l Extensions UCD Vulnerabilities Group l

759 views • 24 slides

Examples of I/O Devices Device Behaviour Partner Data Rate (Mbit/sec) Keyboard Input Human

Lecture 14: I/O Controllers & Devices RS 232 UART/ modem ACIA USB printer video CPU monitor Serial ATA disk SA SCSI ETHERNET LAN I/O controllers I/O devices Inf2C Computer Systems - 2013-2014 1 Examples of I/O Devices Device

620 views • 19 slides

Recent Attack Technologies Neil Long OxCert Introduction Hope for audience participation!

Recent Attack Technologies Neil Long OxCert Introduction Hope for audience participation! At least two aspects Target payloads Attack origins Future? arenas Attack Payloads Buffer overflow Format strings

535 views • 18 slides

Todays lecture Human Factors for Input ! Input devices Devices ! Restrict attention to

Todays lecture Human Factors for Input ! Input devices Devices ! Restrict attention to mechanical input devices ! Mice ! Keyboards ! Pens CSE 510 ! What are issues relating to input? Richard Anderson ! How do you evaluate different devices?

173 views • 5 slides