Fake keyboard: PCs hacked with custom Android USB drivers

http://arstechnica.com/security/news/2011/01/fake-keyboard-pcs-hacked-with-custom-android-usb-drivers.ars

by shawndumas • 16 years ago

40 20 16 years ago

pinko• 16 years ago

Wouldn't one simple defense be to have the OS pop up a window requiring the user to hit a specific unpredictable key (or short key sequence) when a new keyboard is plugged in?

joe_bleau• 16 years ago

What if no one is there to press those keys, or there's no keyboard? I recently did a project with a USB HID interfaced microcontroller pushing data into windows, and there would have been no way for anyone to hit keys that weren't there.

Splines• 16 years ago

It's a difficult problem to solve, and probably not worth the effort. Anything you do is fraught with running into the "Keyboard not detected, press F1 to continue" situation, especially in an uncontrolled environment like Windows.

jbri• 16 years ago

The only "defense" I can see working is having only one set of USB ports be permissible for human interface devices - if a legitimate HID is plugged into a different port, the OS just pops up a notification about an input device connected to a wrong port. If a malicious USB device is connected to a non-input port, then the OS pops up that notification and the user knows that something fishy is going on.

nupark• 16 years ago

You could build a device that's a lot smaller / less obvious than a cell phone for less than $20.

With an SMD AVR microcontroller, you could power it direct from the USB port, and the device would be not much bigger than a USB stick. In fact, you could embed it in a USB flash drive case (I suppose that bonus points would be awarded for also operating as a USB flash drive).

Example: http://www.obdev.at/products/vusb/hidkeys.html

[Edit]

Some quick googling shows that this is not a new idea:

http://www.taranfx.com/pc-mac-usb-hid-hack

http://www.pjrc.com/teensy/

$18 for a 1.2" by 0.7" USB-enabled ATMEGA32U4 -- and the only reason it's so 'large' is that they break out the atmega's pins to support prototyping, incude a SPST (switch), etc.

JonnieCache2• 16 years ago

This would be a good start: http://generichid.sourceforge.net/index.html

A toolkit for making your own USB human interface devices. Supports a variety of chipsets, including the AVR variants in the parent comment. Comes with its own crazy visual drag and drop programming language.

Get involved!

EDIT: Aha! found the link I was looking for: "Program Your Own Mayhem-Causing USB Dongle" http://hackaday.com/2010/04/05/program-your-own-mayhem-causi...

It's a video presentation BTW. And it is seriously devious: "There’s also a light sensor that can be used to activate a command once an unknowing victim has shut off the lights in the office and left for the day."

EDIT2: For bonus evil-points, solder it into a USB hub, run a real HID into the same hub, and hide the whole thing inside the HID, with the hub's host port wired up to the cable of the HID. Read the link below to see what I mean.

http://www.thice.nl/hide-your-data-in-plain-sight-usb-hardwa...

spiffworks• 16 years ago

Indeed, using a smartphone to emulate a keyboard is definitely overkill, but it is also a really effective mechanism. Nobody thinks twice before plugging someone else's phone into their computers.

fhars• 16 years ago

The haunted USB cable uses this idea, too: http://imakeprojects.com/Projects/haunted-usb-cable/

fleitz• 16 years ago

Or you could just bring a keyboard and mouse with you and take control of the computer the old fashioned way. I'm sure it would be much easier to type on than the android on screen keyboard.

Also, there are USB keyboard replay devices out already that are much smaller than an android phone, if the goal was to automate the process.

I really fail to see why this is noteworthy other than the fact that someone developed a USB keyboard driver for android which is cool. It doesn't open any new attack vectors. I mean really how many computers are out there that don't have a keyboard and mouse but have accessible USB ports AND that it would look suspicious to have brought your own keyboard and mouse, but it wouldn't look suspicious to plug your phone into it.

I suppose the one thing it would enable is a social engineering trick where you convince the persons secretary to go plug your phone into the computer you don't have access to. Maybe something along the lines of "<insert boss' name here>, needs you to plug his phone it's running low on battery, can you plug it in?" and then come back a few minutes later to get the phone.

wzdd• 16 years ago

It opens one new attack vector I think---any exploit targeting an Android phone could be used to deliver a different exploit to the computer the phone is connected to. Given that this requires a kernel driver (on the phone side), it would have to be pretty great exploit. You would have to be pretty motivated to do this instead of, e.g. sending 1 billion emails with an attached virus.jpg.exe, but it is a new vector.

stcredzero2• 16 years ago

For penetrating a particular target, this is very interesting. Bribe a repairman into leaving such a device plugged into a developer workstation at a company where everyone goes home at 5 or 6. The device presents itself as a USB hub, then waits until late at night, when it connects its keyboard and types out and compiles an entire rootkit. This would even work at companies which lock down USB ports against removable drives.

Better yet, the device could act as an attacker's remote shell by downloading commands using curl and uploading redirected stdout and stderr.

frankus• 16 years ago

I wouldn't underestimate the social engineering aspect of it.

Refusing to charge someone's dying phone with your computer comes across as kind of a dick move, since it's perceived as costing you nothing and really helping out the other person.

Especially now that POS systems and what not have USB ports, it's not too farfetched that someone would ask a non-techy waitperson to please charge their phone for them, meanwhile it downloads the last thousand customers' credit card numbers.

jacmet• 16 years ago

Minor correction: someone reimplemented a USB keyboard driver for Linux - f_hid has been part of the mainline kernel since ~1 year: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6...

I don't know why they didn't just use that one - Presumably because their Android phone uses an ancient kernel version.

gus_massa• 16 years ago

It is not a bug, it is a feature! :)

It is possible to build a configurable (dynamic?) keyboard on the Android, like the keyboard in http://www.alltechnologynews.com/razer-switchblade-laptop-fo... . (I saw an article about it here a few months ago, but I can't find it.)

And perhaps it can be useful for non game activities too.

gvb• 16 years ago

10 Immutable Laws of Security http://technet.microsoft.com/en-us/library/cc722487.aspx

Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore.

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.

---

Law #1 should be expanded nowadays: "If a bad guy can persuade you to plug his widget into your computer, it's not your computer anymore. In the USB case, the widget (phone) contains the bad guy's program.

3vad3• 16 years ago

Adrian Crenshaw a.k.a Irongeek has already done something like this using the Teensy ( http://www.pjrc.com/teensy/ ) programmable usb device. The upside is it is programmable either using C or the Arduino dev environment. It costs under $20 and can be made to look much more unobtrusive than a phone. Combine this with some good social engineering and you have yourself a dangerous penetration testing tool. For more info check out Adrian's writeup http://www.irongeek.com/i.php?page=security/programmable-hid...

Fake keyboard: PCs hacked with custom Android USB drivers

Related Stories