The threat on your desk: Building an evil USB-C dock

https://research.aurainfosec.io/pentest/threat-on-your-desk-evil-usbc-dock/

by voxadam • 3 years ago

196 100 3 years ago

research.aurainfosec.io

seanherron• 3 years ago

The author is right that USB-C docks can be used to hide malicious devices - but the same is true of any USB device. You could hide a Pi Zero in a mouse, keyboard, memory stick, or anything else that you can open up and access the USB headers. Scary - but also requires a higher level of physical access than other vectors such as phishing.

snow_mac• 3 years ago

Or they could pre-make a bunch of docks and swap them out at a cowering space or target office building. Easy enough to gain physical access to most offices. You could get a job with the cleaning crew

micromacrofoot• 3 years ago

I imagine this is how a lot of basic espionage already happens?

tedivm• 3 years ago

They could order a bunch from amazon or newegg and then return them. It wouldn't be as targeted but it would still get some interesting results.

LanceH• 3 years ago

Slap the companies logo on it and mail 100 of them to the office.

npteljes5• 3 years ago

They also bundle a separate CPU inside the real CPU, and gave it full access over the system.

https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...

metadat• 3 years ago

Do ARM processors have a similar mechanism?

Edit: Yes, it's called TrustZone.

https://en.wikipedia.org/wiki/ARM_architecture_family#Securi...

naikrovek5• 3 years ago

I love how people forget what this is for. that's "love" in sarcasm quotes, if it isn't clear.

this is for me when I want to enable virtualization on a user's laptop remotely, without sending a human to their desk or to their house to enter the bios password and to enable virtualization or do whatever else I need done in there.

this is how I ship a laptop from the manufacturer directly to an end user, at their home, and they unbox it, turn it on, log in, and the computer becomes a corporate-managed device. I don't have to fly someone out so they can set up the computer, or ship the computer to the office for configuration before it gets shipped again to the end user.

this is not a nefarious thing, nor is it a target for hackers, because there are far easier ways to trick someone into doing something which lets the hacker onto their system.

matheusmoreira3• 3 years ago

This is just the tip of the iceberg. Turns out our operating systems are actually just sandboxed applications in the hardware manufacturer's proprietary hellscape. Not only are they not real operating systems anymore, they are no longer even in real control of pretty much anything.

https://youtu.be/36myc8wQhLo

bobsmooth3• 3 years ago

Do co-working spaces usually have shared peripherals besides docks?

dotancohen• 3 years ago

I've seen monitors, keyboards, mice, network printers, wifi access.

Cthulhu_3• 3 years ago

Even a simple charging cable can contain e.g. a HID chip while still working as a charging cable. I saw an unattended cable on a table at work once, I'm sure someone who needs one would've used it without second thought. But our employer is also sending fake phishing emails to make people aware, I wouldn't be surprised if they also plant devices like that.

...and if they don't I should propose it, sounds like a fun project. Leave a random cable or USB stick that just shows a warning that it could have been malicious. Or something that just opens up https://nyan.cat and sets the volume to max :D.

panarky2• 3 years ago

Let's say I buy a USB-C dock made by Sabrent or Anker.

Are there good reasons to believe they're safe, that the brands are trustworthy?

Are there good reasons to believe that the brand name that's printed on the case means it's actually made by that company?

How could anyone determine if it contains a keylogger, or an HDMI screen grabber, or a network sniffer, or a reverse shell, or a rootkit installer?

npteljes5• 3 years ago

I don't think you can determine much, without looking into the actual device somehow, and being also knowledgeable to make sense of what you see.

Even with trusted brands, a malicious actor can attack the vendor. For example, one could order devices, tamper with them, and then send them back via returns. The vendor likely tests it a bit, and then repackages it and sells it as refurbished, or maybe even as a new one.

The fun thing is that the same is true with software. Looking at a source code is hard enough, even for experienced programmers, and then how do you verify a piece of software that you don't even have the source code to? And if you have the code, how do you verify that the software is made out of that code?

People basically just operate on trust, you can't verify much of the stuff. Just try to stick to entities with reputation, and hope for the best.

xen2xen1• 3 years ago

Go pick a random one from the store?

zabzonk2• 3 years ago

well, on this basis, you can't trust your actual pc, laptop or phone either, never mind a hub.

if you don't want to spend your entire life living in a faraday cage, there must be some level of trust.

nighthawk454• 3 years ago

It's hard to have any realistic basis for trust, absent maybe independent review. Even then companies have been known to significantly adjust components for the same SKU after the review cycle ends.

For Anker in particular, sadly there may be a reason _not_ to trust them. See the recent Anker-owned Eufy cloud camera scandel

ObjectiveSeePee• 3 years ago

These are normally used for targeted attacks. Unless someone is specifically after you such a device is usually safe. Sometimes the USB ID can be used to figure out the vendor but that could also be fake. You could determine something is odd by looking at what device comes up when it is connected. Does it come with drivers? A new network interface etc. Or by comparing the inside/firmware of a known good one with the model you have.

hnbad• 3 years ago

Did everyone forget the Snowden leaks?

The US government rerouted CISCO routers to a factory that tampered with them before sending them to their final destinations. There's no reason to believe this stopped or isn't still being done in similar ways. It doesn't have to be a USB-C dock, it could be anything.

aksss• 3 years ago

We don’t talk about the Snowden leaks enough. It’s truly shocking what was in there and we’ve all uttered a collective “meh”. I don’t know what SHOULD be done, or could be done, but it’s odd how rarely that data is incorporated into popular perception of the government and how much rarer still it is that we discuss it and contemplate what has been taking place in the intervening years.

panarky2• 3 years ago

These are targeted attacks by a nation state. That's not my threat model. I'm just trying to be reasonably secure against ordering a name brand device and having it exfil secrets.

ethbr0• 3 years ago

Imho, there's a big difference between supply chain attacks on core Cisco routers vs USB hubs.

These attacks are not easy or cheap, and by their very nature need to be deployed in small % of total installs (as every use increases the likelihood of discovery).

Criminal organizations interested in ransoming details might be interested in casting a wide net, but intelligence services less so.

bobsmooth3• 3 years ago

You trust that brands wouldn't spend the money adding invisible hardware into consumer devices.

expertentipp• 3 years ago

They indeed add invisible hardware. Many smartphones have radio chip. It's hard to find a household appliance or consumer electronics without some bluetooth chip. Can I listen to radio or connect external speaker to them? hell no...

zamnos• 3 years ago

Supply chain management is a whole area of study. iPhones and ChromeOS are the only two devices I trust in the retail supply chain to be too difficult to be casually pwned but still boot. But even then, the evil maid attack doesn't have to fully subvert the booted OS to be useful. A device inside an up to date ChromeOS laptop could just record the keyboard keystrokes to an SD card to be retrieved later, which would get the evil maid your passwords. That's why you've got MFA but it's scary to think about!

Dalewyn• 3 years ago

Are there good reasons to believe they're safe, that the brands are trustworthy?

No. Sentimental values aren't an objective measure.

Are there good reasons to believe that the brand name that's printed on the case means it's actually made by that company?

No. Most companies don't manufacture their products, in fact.

How could anyone determine if it contains a keylogger, or an HDMI screen grabber, or a network sniffer, or a reverse shell, or a rootkit installer?

By having a sacrificial computer that tests every single piece of hardware and software before they are allowed access into your inner sanctum.

rektide2• 3 years ago

lsusb will tell you what it is pretending to be on a real os. Everyone else is hosed & hopeless.

Even still, it could be intercepting & mitm'ing your devices. There are some potential advanced games here. But without also having a network device to exfiltrate out on, it seems pointless. As soon as you have USB networking the risk skyrockets though.

throwaway7422• 3 years ago

That assumes it is constantly advertising itself. If it say reconfigured itself every hour for a couple seconds the odds of seeing in on any given lsusb are quite low.

harles• 3 years ago

Are there good reasons to believe they're safe, that the brands are trustworthy?

There are good reasons to believe Anker is not trustworthy [0].

[0] https://arstechnica.com/gadgets/2022/11/eufys-no-clouds-came...

owl57• 3 years ago

I can't quite wrap my head around this. Apparently they advertised a consumer device with remote access over the WWW as "No Clouds"? And the advertisement actually worked, as in, many "privacy-minded security camera buyers" believed that obvious bullshit?

Cthulhu_3• 3 years ago

How could anyone determine if it contains a keylogger, or an HDMI screen grabber, or a network sniffer, or a reverse shell, or a rootkit installer?

I like to think people that know their trade (electronics, etc) can figure this out; the absence of proof of there being things like keyloggers in these docks is enough for me. Same with the distrust of ZTE devices, has there been any conclusive evidence that there actually IS espionage or remote controls in there, or is it fearmongering to protect the US / western market?

leetrout• 3 years ago

I thought it was odd that Google distributed security keys as swag at All Thing Open.

I tossed mine in the trash. Odds that is was legit? 99.99%?

But just seemed like a major oversight to just toss out usb devices en masse

triactual4• 3 years ago

Maybe I’m missing something but these USB attacks require interaction with kernel drivers so if you plug in a dock that then presents mysterious storage or HID functions, you’re going to know.

j5155• 3 years ago

Does anything on your PC notify you about plugging in a keyboard? I know mine doesn’t, and it definitely doesn’t prompt me about whether to use it either. You could check what devices you have connected but I doubt many people would do that every single time they come to work.

triactual4• 3 years ago

Yeah, this is more of a UI problem that could be solved with a little effort. I would be concerned about a device that replaced the hub itself rather than simply adding a function. The core issue is that a system can always notify the user of newly connected devices (Windows seems to about half the time). But a malicious MCU emulating a hub and compromising or stealing data at the USB protocol level could appear exactly as expected. It could key log, inject, etc., undetected because it doesn’t have to interact with kernel drivers as anything other than the expected hub.

pabs3• 3 years ago

On Linux, GNOME has some USB protections when USBGuard is installed.

kalleboo• 3 years ago

Macs warn you and require approval for any new USB device, including a keyboard, starting with macOS Venture.

bikingbismuth• 3 years ago

MacOS has a pop up that tries to identify the keyboard layout. If this screen came up when I plugged something in that wasn’t a keyboard, I would assume the device was malicious.

It is probably possible to automate the keystrokes to quickly kill this screen though.

amelius4• 3 years ago

You could insert a device between the actual keyboard and the computer (man in the middle).

userbinator2• 3 years ago

Realistically, you would have to open the device to determine whether or not it has been tampered with.

...or you could use something invented a century ago, called an X-ray machine.

bobsmooth3• 3 years ago

Lemme pull out my pocket x-ray machine an examine every dock I plug my computer into. We all have one, right?

throwaway7422• 3 years ago

I bought a pair of x-ray spectacles from a comic book for $1.50. I use them to inspect all my computer accessories.

userbinator2• 3 years ago

I was referring to companies who do this to hardware that crosses their trust boundaries, and I can safely say that those who care enough about this stuff will definitely do that.

cristiioan4• 3 years ago

Better is to have all your devices in a trusted place(or multiple) or with you all the time(in a backpack).

stacktrust• 3 years ago

Use the simplest USB dock with the least amount of ports for your specific use case. Simpler docks have less physical room and lower baseline power to hide malicious mods. e.g. this StarTech dock costs 50% less than one with ethernet. It can be used with a USB-ethernet adapter, which allows both the dock and ethernet adapter to be evaluated separately, https://www.amazon.com/gp/product/B09DGRJMYK/

We need crowdsourced behavioral fingerprints and open-source test suites for peripherals which may be subject to supply chain or shipment interdiction. Measure power consumption and response latency baselines, when idle and with reference workloads. Fingerprint units of the same model procured via multiple supply chains: brick & mortar, online, different couriers, new/used.

More generally, there is ongoing work for integrity verification of devices, including PCIe device authentication [1][2], USB device authentication [3] and SPDM for remote attestation between DICE-RoT and system firmware, before allowing a device to communicate with the system.

[1] PCIe component auth, https://pcisig.com/pcie®-component-authentication

[2] Intel PCI Express Device Security, https://www.intel.com/content/dam/www/public/us/en/documents...

[3] https://www.zdnet.com/article/usb-type-c-gets-authentication...

USB data blocker with transparent case for physical inspection: https://portablepowersupplies.co.uk/product/pure-usb-data-bl....

Do we need transparent docks?

Cthulhu_3• 3 years ago

Use your own dock, not someone else's if at all possible.

I don't think transparent docks would work because a serious enough actor can make it look and work like the real thing.

rkagerer• 3 years ago

Floppy disks were just that - they couldn't be keyboards and dataloggers with transmitters, masquerading as disks.

amelius4• 3 years ago

And no autorun.exe

cristiioan4• 3 years ago

This is why I keep all the hardware I use at home or in my backpack. If I have to go to the bathroom, I will take my backpack with me when I'm not at home.

stonegray• 3 years ago

With all that space inside it would be interesting to try adding a mmwave presence detector. It could be extremely hard to detect if it only connects to the machine when nobody's nearby.

izacus• 3 years ago

Has anyone ever been convicted and sent to jail (or at least fined) for creating a device that attacks other devices?

donatj• 3 years ago

I bought one of these cheap no name USB-C cables that shows the current charging PD wattage on a tiny built in LCD. I have been using it for months to charge my Android phone and MacBook.

I recently bought a little used Yoga Thinkpad, I’m not really a Windows guy. On plugging just the cable into a USB port with nothing on the other end Windows made its little “device plugged in” ba-da-doop sound that Windows makes.

I didn’t see anything interesting in my quick scan of device manager but that single ba-da-doop stopped me from using my favorite cable cold turkey. I should investigate it further.

tenebrisalietum• 3 years ago

I bet it added a serial port (under Ports) that software can use to read the wattage.

csdvrx• 3 years ago

That'd be wonderful and practical! Op, do you have a reference for your USB-C cable?

bartvk• 3 years ago

I use iStat Menus on macOS, and configure it such that it displays the MacBook power draw. It only works on Intel-based laptops; on the new ARM-based M1 MacBooks, that sensor no longer available. Probably a security thing (rowhammer?).

Such a cable would be very useful but your comment makes me think twice...

divingdragon• 3 years ago

On Linux you can use `lsusb` to get a cleaner list of all connected USB devices.

The threat on your desk: Building an evil USB-C dock

Related Stories