[Applause]
so hello everyone I'm Luca and today I'm
going to talk about heat attacks most of
you knows know what I am what I'm going
to talk about so what I will what I will
show you today is despite the usual heat
attacks i will show you some some new
offensive devices were developed lately
last year and we'll see what we can
achieve with this new generation of heat
attacks what you will which will be the
intakes of this presentation well after
this presentation you will be even more
paranoid about USB devices you will
learn about new tools for frankie
colleagues phone customers or scare she
chose because that's what we like most
you will forget about rubber ducky and
bash barney and most importantly you
will not trust any more USB dildo and
palm breasts so let's make a short recap
of what our hid devices despite the D of
hid is ready device human interface
device according to wikipedia is a type
of computer device usually used by
humans that which takes input and gives
output humans kind of dump definition
but that's Wikipedia what we know about
each HIDs while we use everyday
keyboards mice game controllers and what
we also know about out that most of the
time do not need drivers external
drivers Windows OS X Linux they do
recognize keyboards automatically there
are some corner cases like you know a
sax is asking you to press some some
specific keystrokes just identified the
keyboard language but anyway usually
most of the time our tribe words what is
another feature an interesting feature
of this class of devices well usually
are ignored by DLP solutions I know that
there are some solutions like G data
that has a USB card that is dedicated to
the
HIV attacks but most of them do not care
about hid human interface devices they
care mostly about flash drives so you
cannot plug it in the next version of
Stuxnet for example here is an example
of like two weeks ago I was checking my
antivirus solution I had in my corporate
laptop I cannot give you the name is and
practically this device this solution as
you can see allows to whitelist or
blacklist block USB devices as you can
see in the list there are plenty of them
but there is only one missing hid
devices so keyboards are not Y cannot be
whitelist or blacklisted by this
solution which is an issue and of course
another feature of keyboards and mice is
that they are not usually under the
antivirus cope so what could possibly go
wrong what we know most of you probably
knows the first generation of he
defensive devices like the most common
and shown also on mr. robot TV series is
rubber ducky rubber ducky was and is a
delicate dedicated hardware which of
course can can be used in multiple
platforms because it depends on the
payload so it's compatible Windows Linux
OS X and so on has multiple payloads has
the ability to change v ID and PID what
is v ID ID ID is version ID and PID is
product ID these two identifiers should
be uniquely identifying a specific type
of a specific brand of a device like HP
keyboard blah-blah-blah zr1 as a
specific v ID HP or ya and product ID is
that pacifically of that specific type
of keyboard so in this case rubber ducky
was able to spoof those VI D s and P n
DS because some DLP solutions that are
blacklisting whitelisting hid devices
can can be bypassed by spoofing
such ID the only set
thing of rubber ducky is still the price
it's around 55 euro if you want to buy
from us to Europe and this kind of
expensive
the other solution was a do-it-yourself
solution based on teensy as a hardware
part and from the software framework
point of view were both open-source
wrote Ilya and Phu KD and this was the
first generation between 2009 10 11 the
second generation is can be dated around
2014-2015 and these two devices one bad
USB which was the outcome of a research
made by Carson Wall and the guys from SR
labs from Germany practically what they
figured out they figured out that on the
market there are existing USB devices
like USB flash drives or USB hubs that
have a very specific type of controller
like phi sun which can be reflashed
so by reflashing by hacking the femur
and reflashing it they were able to turn
a very simple and commercial solution
like i just be a flash drive or a USB
hub in a rubber ducky like so malicious
keystroke injecting device another
device developed around the same period
thousand 15 by the NSA playset guys from
us practically what they did they
recreated a device an implant hardware
implant developed back in time by NSA
around 2008 leaked by northern in 2013
and the codename by a DNS ETL tool was
called cottonmouth which i will show you
later the original leaked paper and
practically they recreated it called it
terrarium scope and has the same
functionality was the first kind of USB
hardware implant open source and open
hardware able to once connected to the
target machine was able to create a
product radio radio communication
channel so that way an attacker was able
to connect to that target even if was
air-gapped i will talk a lot about air
gap so what is an air-gapped environment
for the ones that do not know that air
gapped environment is very simple
imagine a computer station or an entire
well relatively small land that are not
connected to other networks just imaging
a HMI human machine interface of a
nuclear plant is not supposed
technically is not supposed to be
connected to in turn we know we know
what bridge can come out of that so in
this case this particular implant was
the first of that kind able to bypass
this kind of air-gapped restriction the
third generation can be dated around
2017 and still ongoing is divided in two
devices the first one that I was working
on and I will show you in deep in depth
is called Wynn injector you can see it
as a rubber ducky on steroids if you
want to make comparisons with something
instead the other one developed by
markus now called Pompey you can see it
has a Bosch Banyan steroids what they're
doing well with injector is a dedicated
hardware exactly right rubber ducky so
not a do-it-yourself solution why I
decided to design that because many pen
testers either do not have time to you
know solve their stuff you know play
with electronics devices or either they
do not know how to do that they don't
want to spend time in that they prefer
to own like active directory's and using
Death Star and trends so yeah and so
practically I designed is harder show
dedicated hardware as rubber ducky is
able to is multi-platform able to spoof
VI D PID because it's important well to
bypass DLP solutions and the most
important part respect rubber ducky it
has Wi-Fi so in this case the attacker
in one way or in another as soon as the
tar the rubber dial sorry the mid
injector gets connected to the target
machine the attacker remotely from
outside the building or with the call
home function if of course he needs to
preset existing Wi-Fi network to connect
the wid injector and then reach outside
he's able to connect remotely to the
target machine and inject the payload
whenever he wants because another sad
thing feature of rubber ducky is that
you can you
have to run the payload immediately it
runs I mean as soon as you plug you can
run it of course you can put delay but
you cannot exactly decide at which exact
moment three great promotion and another
thing we wanted to keep it cheap so it's
around 13 euro now because the the cost
of atmega 34 raised and I'm not getting
any royalty so I just wanted people to
get it people said Oh looks cool I want
it so I just asked a manufacturer in
China to do it
pumpy pumpy is another cool device the
only expense here is just the Raspberry
Pi zero because it's based on words very
pi zero which is around 15 euro and the
software itself is open search of course
also we detector is open source and open
our what is what are the main feature of
pompey will see later a bit more in
depth but the idea is that it has Wi-Fi
as well so we can remote control
remotely control it with injector and it
is also USB to Ethernet adapter you know
CDC gadget from USB protocol so it can
create a internet connection just by
plugging in into a USB port of the
target machine you can emulate also USB
flash drive file system so which is cool
it has the ability to quote back a
command control server so you can be on
the other side of the world and control
it remotely again able to spoof me idea
and PID as well and recently mark was
added a patched version of the drivers
of the Broadcom Wi-Fi chipset in a way
that now this little teeny tiny toy is
not only Batman asteroid but is also
almost close to Wi-Fi pineapple on
steroids so it's it's really powerful
and lately
during yeah around approximately
jack-in-the-box he was working on a new
feature that here is the video because
due to time constraints I could not show
you all the demos so probably I will
publish later even other so this one was
a demo made by Markus which is showing a
next-generation air gap bypass I will
explain you later what it is ok let's go
back the weed injector these are the
schematics I released and how it's
composed with injector the main two
components of weed injector are atmega
30 to you for most of us that played
with arduino knows it because it is
implemented in some Arduino micro Pro
and Friends
so is there doing a friendly
microcontroller and ESP 12 ESP 12 is
known to be used is the old version of
the ESP family now most likely most of
you will know ESP 32 anyway
this type of Wi-Fi chipset are very
common in IOT devices like you know
these power sockets that you can control
from a web app mobile app so let that
thing why it's nice because in a little
small form-factor chipset which is this
black thing behind on the PCB you have
what four megabyte flash NAND flash
Wi-Fi support both has access point and
client mode and TCP stack and DNS
support so you have plenty of
capabilities there another thing I
wanted to add and I added in the PCB is
this thing that in rubber ducky door is
not is a simple pin out bridge that is
practically giving the ability to the
attacker to use the four pins of a USB
connection to weaponize USB gadgets we
will see later what I mean weaponizing
USB gadget another thing I decided to
add was the hole sensor because many
times when you weaponize a gadget or you
put in your plug it in any USB case and
you want to unbreak it or reset it or a
flash it it's annoying
plug it in destroy the USB keys and so
on so with the hole sensor you just need
to put close a magnet and will simulate
the button pressed so I was talking
about USB gadgets what what it means
well you know many of you is already
aware and probably you're doing security
awareness trainings within your
companies about how danger is picking a
USB flash drive from another parking lot
reception gas area and plug it in in
your laptop to check what is inside so
most of the people now knows that trick
and is harder and is getting harder and
harder for red teamers
to prove that he is an issue so another
thing you can do is to trick people to
think that there are of course other USB
gadgets on the market that usually raise
less suspiciousness like for example if
you see a USB flash drive you think
there might be a malware there but if
you see a plasma ball or a cup heater
without that cough though a fan or a USB
beer fridge I mean if you see this kind
of of devices your awareness will be
less high so in this case what you can
do with you know by weaponizing USB
gadgets you can test for social
engineering awareness exactly as you
were doing with the flash drive you can
bypass physical access restriction to a
target device because as I told you both
pompey and with injector have Wi-Fi
capability so imagine like here I made
an example this is a fake brochure from
a leaders office in supplies so
practically you weaponize a plasma ball
you pack it back you take that brochure
you pack everything you maybe you even
create a fake web domain just to give a
you know a shape of you know a more
serious operation then you pack
everything you send through UPS FEDEX to
the target or receptionist of the
company and then most likely the guy
will see the plasma ball will think
plasma ball if he's really smart he
thinks oh plasma ball has no data
connection just you know five volt so
most likely it will plug it it I know I
heard people that were using on during
engagements and they had this they did
succeed so it is working so otherwise
instead of plasma ball you can always
add a hub USB hub controller and
weaponize a mouse either then you can
ship the mouse or during a physical
engagement you can replace an existing
Mouse no one will notice it and another
thing is but that is restrictive most
likely to just one person in the world
is that if you are Kim Jung hoon and
wanna have fun pawning international
delegates you have always the chance to
that by giving them USB fans of course
we have no no one managed to to pop open
that USB fan so we don't know if there
was or not an implant but the
possibility is still there okay I
described the hardware part of with
injector the software part is the one
that is delivered by default with with
the injector is called ESP exploit v2
which is an evolution of with why I'm
not really a good developer so a guy
Koree harding decided to improve it so
luckily for everyone so he s point v2
has many features like hidden ssh SS ID
so for more abstract cooperation you
just hit the SSID so employees around
the company will not see that there is
like weed injector access point there it
has SP portal prudential harvester we
will see later what it is multi-platform
move the keyboard language ability to
auto start like rubber ducky in case you
want to just use it during an engagement
with physical access you can just plug
it in and replicate the rubber ducky
ability to change setting on the fly
live payloads ability to convert if you
already have a list of darkest crypt for
rubber ducky you just need to copy paste
in the web browser once you are
connected to the grid injector and will
automatically convert to the with
injector shinta so easy peasy ability to
update the femur over there so you don't
need to unplug and plug or a plug and
play with arduino if you're not you know
used to it
able to spoof vad PID and the best part
i like it is ability to bypass
air-gapped environments we will see
later proof-of-concept about that ducky
script so as I said before if you
already have a doc you scrape you just
connect to the access point created by
with the injector copy paste the darkest
ref and automatically the this
JavaScript will convert it to the real
syntax used by weed injector so very
easy and user-friendly this is how to
change the layout language layout
because is delivered by with by default
MIDI in
keyboard so like French keyboard and so
on you just need to go in the width
repour on github copy paste the ASCII
map replace it in our put it in at the
arduino either and just flash back the
USB device and then you will have a
compatible with injector for any kind of
keyboard you prefer here is an example
of how to spoof v ID a PID again this
nin pitar code is in the github repo
here what we care mostly is the v ID the
PID and the name you can put an
arbitrary name actually you can use even
for fuzzing probably operative systems
if you start to play with charge and of
course is compatible well here I put as
an example at the end you just need to
move to add this Nippert at the end of
boards dot ext Lord we know either
and then just reflash with injector so I
I talked already many times about air
gap bypass here is an example for
example my favorite operating system
right now is Windows 10 because it's not
complaining any any how about serial
connection so as soon as you plug it in
poof serial connected not drivers no
issues no nothing and here's an examples
what you will see now you will see okay
in this virtual machine is completely
isolated so there is no Bluetooth
connection electronic connection or
Wi-Fi is so-called air gap this is the
the full machined real laptop where the
attacker is connected through Wi-Fi so
in this case the wind injector is
plugging in into the air gap machine and
you will think just make an assumption
somehow that we detector got connected
either social engineering plasma ball
whatever
kidnapping whatever so once it's
connected we run a payload this panel in
this case is Windows so it's running a
PowerShell script what we'll do we'll
execute a common in this case Who am I
take the common and push it back through
the serial connection to the with
injector at that point the attacker will
be able to retrieve that information
anytime he wants from the web win
injector
access point and ESP flash so now the
attacker is connecting to the default
SSID of with injector which is the
payload
here you can see the vADM ple uses it to
filter and find the with injector
connected of course if you spoofed the
idea and PID you need to change that
part in the script that's what's the
common Who am I and now as soon as run
the comment of course can be faster the
the injection but I wanted to slow down
just to show you a bit you know that is
not like you know fake proof-of-concept
so now is looking for the serial taking
the common and then the attacker is able
to see the exfiltrated data from an
air-gapped environment so we fully
bypass and imagine that the attacker
right now could be outside the nuclear
implant so it shouldn't be like you know
built on machine and as you can see is
matching of course we can do the same in
a Linux based machine payload is
different but the idea is the same so we
look for well in this case is lilypad
because this default name of the with
the injector from serial comm point of
view but you can as soon as you you
change through the spoofing technique
you just need to change accordingly the
script so what it does is look which
serial which serial port is the with
injector execute if config is set back
the shield data before I mentioned also
ESP port a credential harvester well the
idea is it's a very dumped rogue access
point it doesn't have yet the karma
attacks abilities like Wi-Fi pineapple
for example simply because we figured
out that there is a Wi-Fi chips within
there we can create any arbitrary Wi-Fi
hotspot so we thought just let's put it
there and let's see if might be useful
for some engagements and then eventually
later improve it with karma attacks so
the idea is that it ready Rex any HTTP
requests to some default pages we can
customize customize up to three specific
domains like in this case was like
microsoft.com blackhat
bbc.com so in this case if that the
victim goes to connect to this rogue
access point goes to bbc.com well we can
play we can discuss about HSTs
but in a brand new computer it goes like
for example here you can see that it
tries to check if there is Microsoft is
trying to check if there is a hotspot so
it makes requests without HTTPS so in
that case I'm ready directly there is
also of course the casual template so
any website you are visiting the DNS
requests will be routing you the reply
will route route you to my login page
fake login page so in that case you can
you know fish anyone and of course all
the credentials will be store in DSP
flash so you just need the attacker just
in to go in the USB port all log dot txt
and get it as I said I'm working on the
Karma Tech implementation and the ESP
chipset so Stadium will see another
software Wharf to be mentioned is us
abuse was developed by rogue and apes
from sans post and the idea is that as
well he's based on cottonmouth this is
the original PDF leaked by Snowden was
created this device implant was created
in 2008 by NSA Tao and practically is
rip the u.s. abuse is replicating the
same functionalities the idea the main
feature is to the main goal is to bypass
circuit restriction so what it does is
once the the win injector flashed me us
abuse is connected to a PC create some
Wi-Fi access point start a stealthy
screensaver killer so imagine the
situation that somehow win injector got
connected to your machine you are
usually have the setup screen saver
setup kick in after one minute right 60
second so in that case imagine that you
go to take the coffee and you don't lock
your laptop because you know that in 60
seconds by the time you are to the
coffee machine already kicked in the
screensaver in this case us abuse is
likely moving on one pixel the mouse so
is immolating a mouse in a way that the
screen server will never kick in so in
the meanwhile the guy is enjoying the
coffee the attacker from outside the
building connects will find at work and
starts a fires the first powershell
stage
which is which is what is doing is
creating a heat row tunnel so human
interface devices at different classes
so in this case is creating a heat roll
I would say device but it's bad shape
panel which is used to exfil data and
actually as main channel communication
channel between weeding value as abuse
itself and the the PowerShell strip that
is injected in memory from on the target
machine
so after this channel is established it
returns a CMD shell to the attacker if I
will have time after the presentation I
will show you how it looks like this is
really cool and after that is pretty
much game over an air-gapped environment
compromised outside the building or
inside the room remotely like that
what's next well this is we delete so
the idea is the same is using again
atmega 32 you for as keystrokes
injecting the voice as also USB 24 22
controller what it is it's just a USB
hub controller so instead of weaponizing
a USB gadgets by using by by using an
external USB hub is already implemented
in a PCB so you just need to solder
there the pins that goes like you know
if he is a mouse here you put the input
from the keyboard herbs from the mouse
and here the cable that goes to the
target machine so easy the most
important feature of we delete is that
instead of ESP this time I replaced it
with a well the first version will have
a 2g base man for the simple reason that
still many places in Europe and in the
world
2g still a thing so and it's cheaper
this base man than this one
the second version I started already to
work on so it's just matter of because
both of them communicate on you are T so
serial connection with atmega so it's
just matter of redesigning the PCB a bit
so the second version we will have a MV
iot
so LTE so everywhere in the world is
supposed to work flawlessly so how how
it works already the work flow from from
this new device well the idea is that
the attackers send an SMS source in some
way we delete was connected to the
target machine of course so it sends an
SMS like do air-gap Who am I
we delete take the common inject makes a
key structure injection into the target
so in this case like that PowerShell
script I showed you before would be the
injector almost similar code within with
who am i common in it we delete waits
for the answer back of Who am I output
takes the output in this case contoso
all each and sends back through SMS to
the attacker that can be potentially on
the other side of the world because
again whip ok weaponize is he plasma
ball and then can Shifu FedEx everywhere
around so this is an example what you
will see is a laptop completely again
air-gap no connection whatsoever and
that keyboard was weaponized with
wittily so as soon as you plug it in it
takes few seconds to boot up connect
with 2g network and then is pretty much
operative
here from the common control bot from an
SMS you sound like am I in do air gap
mode so we will get back the the output
of that and then this mass fly is you
know goes from the mobile network of the
attacker mobile network we delete and I
start the injection take the output
sense through serial and then we delete
will send the SMS back with as you can
see with my with Who am I output and of
course she's sending also an
acknowledgement about common receive
because in case you just want to inject
like a PowerShell Empire stage like you
don't need like output so it just send
you an acknowledgment that was executing
and here is the classic calculator so as
you can see no output back but just you
know acknowledgement that was executed
just to be sure that you know it was
received and executed another thing I
added well since we have a GSM or anyway
mobile network days man we have
microphone capabilities so I thought
yeah why not
acoustic so surveillance so by adding a
microphone we can easily like stand like
make call send the number of the the
attacker or anyone that want to be
called from we delete with the lead will
receive the common start enable the
microphone and then start the acoustic
surveillance by calling back the the
attacker control number so you will be
able also to listen conversation around
that's not enough I was not satisfied
enough about the capabilities so I
wanted to add also a NRF chipset 24 l01
and what it does well most of you most
likely heard it about you know crazy
radio the ones that loves to use drones
you know you can use with drone hacking
and in this case Mouse jacking wireless
keyboards and mice and I will show you
now what it means so imagine like that
you you you manage to wheedle it gets
attached to a victim
and then you want to hunt for is click
wireless keyboards or mice in this case
the usual calculator proof that we can
send and receive back information and
here the depailler well in this case
after do mouse jack right now was yeah I
wrote foo Bo doesn't matter what you
write at the final release will be like
a number of channel hops or seconds
doesn't matter
and now we start to scan so imagine like
another target with another machine is
using the my the mouse or the keyboard
and generates traffic's so in this case
we delete sees the traffic follow the
hopping and then inject keep keystrokes
so again I try to inject key strokes and
succeeded in this case for proof of
concept I use the same laptop but the
wireless keyboard should be connected to
another victim of course another thing
I'm working on is a hybrid command
control so not only SMS days but because
SMS has the 140 charge limitation for
SMS so you know extra training later is
it's not that you know reliable so the
idea is Packers Shenzhen SMS like Who am
I tweedily it in Jack the payload get
back the output and instead of sending
back an SMS is uploading through HTTP
making an HTTP POST we see two
controlled by the attacker and then
sends an acknowledgment to the attacker
to SMS again and then the Packer knows
that you just need to visit the exhale
txt and will be able to get like
mimicked artists output instead of you
know something else another thing I'm
working on is the with mobile connector
because someone said connecting every
time to the Wi-Fi access point visiting
a web browser in is annoying
so this is what I'm going to work what
I'm going to release next is our config
who I able to once you said the first
time we'll be able to auto connect to
the access point so you don't need as
soon as you open the uber app we'll
connect and then most other important
thing is that the increase the payloads
will not be stored on the ESP device the
view the injector will be stored on the
mobile app so we'll be a pain in the ass
from blue teaming point of view how to
retrieve those payloads yes will not be
store anymore there another thing as I
said I mentioned before I would like to
bring karma attacks to the ESP chipset
so in that case in this case will be not
only a rubber ducky on steroids but a
little brother of Wi-Fi pineapple which
is always good because the hardware is
the same that you already have short
brief discussion about pong time this is
our the main feature bypass air-gapped
environment as we saw before Windows 10
lock picker and Wi-Fi cover channel the
Wi-Fi cover channel is the best feature
I love it
practically enables the keystroke
injection bringing up the USB HID tunnel
that the same Heathrow Tunnel us abuse
deal then delivers dotnet library client
via well they each shady tunnel into
memory and invoke a its net library from
PowerShell and then is done
the attacker needs to remove the pump I
walk away and then the machine the
target machine will try to connect to
the commander control server of the
attacker within the pump I and then
everything will be done in a hidden
channel through the probe request of a
Wi-Fi chip set of the title of the
victim so in that case the victim will
not need to attack to connect physically
to the pump I access point but will be
all probe requests so the the victim
will not notice anything here are some
videos because I'm show you but really
cool thing developed by Markus there are
two operational mode of
Pompey on premises so the attacker
connects outside the building outside
the room to pump I or otherwise pump I
can call home as you can see here is one
module I added to the Raspberry Pi with
adjacent cheap basement which can call
you home your command control server
wherever it is so you don't need even
close access to the building here a very
short demo how it works spawn PI is in
this case again air-gapped environment
fully protected upon PI got connected
and now the attacker connects to the
network
okay the attacker is connected to the
pump i network Wi-Fi network and then
fires the first stage which is a
powershell script and then it fires the
second stage called shell boom
full usual shell remotely connected to
an air-gapped environment so we didn't
need these air gapped environment
doesn't have an even have Wi-Fi network
enabled so full remote shell like that
these are some other mods around
available with if you like to play with
electronics really cool some mitigations
well the most important is don't trust
and on USB devices ever if you want
really to trust them just us use a USB
condom so just you can buy it like
sing-sing stop or you can make it just
cut off the the data cables of USB cable
other kind of mitigations well here i
suggest you to make a photo check out
the video later is practically what you
do you use dev rules to restrict access
they restrict the creation of new
registration of new devices on linux or
if you're lazy you can already use open
source tools to achieve the same idea
for windows there are open source tool
as well I like duck hunt because of four
different operational modes so depending
on what you want to achieve you can be
super paranoid or just log any new
devices connected and here are some
artifacts for blue teamers here instead
of responders here are most likely you
already know most of them these are some
places where you can find like
information about hit devices connected
timestamp and so on LBI dep ID so here
is an example this is the first time
device was plugged in here we have a
tool three word tool called USB the view
which shows last time plug first time
plug and actually in here
if you're smart enough as blue TM you
can even check sometimes you can spoof
vADM PID but there are other other IDs
on a USB device so like fumer version
you know tons of them in descriptors so
if you are a bad attacker you can spoof
vADM PID but you can forget about femur
version so a forensics guy can use this
kind of logs to check if was inserted a
real HP keyboard or a smooth one another
thing that we can find on Windows 10 and
Windows since we understand and Windows
2016 Windows Server 2016 is this group
policy well is these policies audit PNP
activity once these policy is enabled
every time you plug it in a human
interface device will trigger the event
64 16 which is called a new external
device was recognized by the system this
is very good because it's giving a lot
of information like device name class
name VAD PID timestamp so it's always
good you know especially if you use
system owners plank and all these you
know detection system even you know
remote handling sending sending remotely
this event lock is very good for
detection of course you can also do
advanced forensics like a very simple
thing imagine that blue team finds or
get access to one weed injector for
example just plug it in a in a Linux
machine and just by using the default
ESP tool not yeah yeah you can dump the
image of it of the ESP name and then you
just need to run strings not even you
know either stuff like that and you can
find exactly what was stored in this
case was the ESP portal credential
artist er that you know the attacker
successfully retrieved information from
a poor guy that's fall victim and then
you can see then see you can even see
attackers information like
SSID password in this case our default
credentials but imagine like an attacker
that changed them and you know fails on
ops AK and maybe you can correlate by
using all scenes by finding you know
maybe
you will figure out who is was the
attacker of course you can also dump
Arduino humor is a AVR controller so you
just need to dump the femur and then try
to reverse-engineer it with radar so a
bit harder than using strings and USB
tool to dump the image from ESP but
still not the path well here some
resources and die gas I'm pretty much
done I don't know if I have two minutes
for questions
five minutes we have five minutes anyone
has questions I don't see one right
there
is there any way to detect the user
activity to avoid launching scripts when
he's in front of the screen or typing on
his keyboard or moving his mouse for
example I heard just half of it is there
any user activity is there any way to
detect that the user is active to avoid
launching stuff on the screen while he
is in front of it so you're asking if
the the user can detect the activity or
wait because oh well in your demos we
can see that the device is opening to
execute and then there are some actually
for example in PowerShell there are two
lines of code that what they do is for
example one line makes the background
color the same color of the font and
then another line takes down the entire
window choose matter of one most two
seconds so usually that's the difference
between rubber ducky and weed injector
or Pompey in this case what what type of
do is usually I don't care about these
two seconds three seconds of of activity
because the user is already compromised
that yeah I mean afterwards of course if
the user is marked enough and sees
something flashing around will call the
blue team usually I triggered when they
I know that the victim is around so
imagine a receptionist so I call the
receptionist and then I trigger when you
know she's not looking at the money so
in that way you but yeah of course I
mean this kind of attacks relies on the
fact that you know can be detected and
not saying that are undetectable though
it can be reused can be used this trick
of you know background and font color
the same and are reducing after a few
second for example in pop up on pi the
video I showed you was what two seconds
the first stage let me check
so yeah it is possible
you you can can your name doll D okay
okay look now one two three three
seconds it can be improved this is the
default one so yeah of course can be
detected I'm not saying that you know if
you if you are fast enough and you're I
mean I bet that HR and play is I mean
because we are IT security guys so if
you see something like flashing you
immediately raise an alert but usually
them is like thank you thank you yes I
thank you for the presentation
I like to complete the question of my
friend over there because you do stealth
is one point but the other point is that
the user has to stop using any hid
device during the script injection so in
fact is not only stopping not noticing
something is happening you have to stop
using your your computer
in fact overlapping it might be an issue
but yes I said usually I tend to
remotely inject when I know that for
example us abuse is using the trick of
the screensaver killer so in that way is
attacking the the the attacker will
trigger it when he knows that the guy is
not around yes there are some means like
for example if you are into hardware
hacking you can add like a photo resist
or the photo resist or will detect like
for example if you weaponize a mouse and
you have the photoresistor and you can
use that matrix so you know
photoresistor you know the light is
changing the value so you can use that
as a metric to see if the guy is around
or not so that can be a way yeah can I
just complete another question maybe are
you planning to work on a dynamic VI
DP ID spoofing because I see that in
that way you have to somehow compile the
firmware with the v ID and PID yeah I
understand the thing the thing that V ID
a PID spoofing was mainly for
engagements where you have the Recon
phase available so you walk around the
building and you see a lot of you know
standard Lenovo keyboards so you go back
to your company office wherever and then
you buy the novel and weaponize it and
then you manually from a myriad flash
the female with spoofing ad ad ad
dynamically the dynamic VI D and P ID
spoofing could be doable because rubber
ducky is doing that from input the the
that file in the SD card and is doing
that from that side
I never investigated that I can
instigate I will yeah I can put it as an
announcement in github thank you thank
you thank you
[Applause]