DerbyCon 2014 - Making BadUSB Work For You

•Download as PPTX, PDF•

10 likes•35,405 views

The document discusses techniques for modifying USB flash drive firmware to add custom functionality or bypass security features. It describes the boot process and firmware update process for USB drives. The authors demonstrate creating custom firmware that implements a hidden storage partition and bypasses password protection. They provide source code and tools to allow others to modify USB drive firmware for research purposes.

Devices & Hardware

Making BadUSB
Work For You
Adam Caudill (@adamcaudill)
Brandon Wilson (@brandonlwilson)

What is BadUSB?
● NOT a technical flaw
● NOT a vulnerability

● Always starts at boot ROM
● Attempts to read firmware from NAND
● If successful, first 32KB loaded to XDATA
● If not, waits to receive code to RAM and
executes it
Boot Process

Paging
...
Page 0 Page 1 Page 2 Page A
Base section
0x0000
0x5000
0xEFFF

Firmware Update Process
Boot ROM Burner Executable Firmware

Pain Points
● Patching existing firmware
o Very touchy
o Limited RAM available
● Writing from-scratch firmware
o NAND sucks
o Non-standard command sets
o Bad block management
o Global wear leveling
● Lots...and lots...of pin shorting

New Tools
● Desktop Flasher
● Firmware Patcher
● HID payload injector

What We've Done
● Custom HID firmware
● Hidden partition patch
● Password protection bypass patch

Hidden Partition Patch
Read Request
(Get LBA
0x00000073)
Patch
(Use hidden
area?)
Section 1
(Public)
Section 2
(Hidden)

Defense & Detection
● Composite devices
● Modified firmware
?

Source Code & Tools
Drive: bit.ly/badusb4you
Code: github.com/adamcaudill/Psychson
Burner & Stock Firmware:
usbdev.ru/files/phison/

Special Thanks
Security Research Labs
● Karsten Nohl
● Sascha Krißler
● Jakob Lell

Special Thanks
Richard Harman (@xabean)
ShmooCon 2014
Controlling USB Flash Drive Controllers
bit.ly/1xaNkbP

Thanks
github.com/adamcaudill/Psychson
Adam Caudill (@adamcaudill)
Brandon Wilson (@brandonlwilson)

What's hot

Thick Client Testing AdvancedNSConclave

Privileged identity managementNis

Identity & Access Management - Securing Your Data in the 21st Century EnterpriseLance Peterman

DDoS Saldırı Analizi - DDoS ForensicsBGA Cyber Security

Database auditing essentialsCraig Mullins

Patch Management Best Practices Ivanti

Role Based Access Control - OverviewHitachi ID Systems, Inc.

Derbycon - The Unintended Risks of Trusting Active DirectoryWill Schroeder

Hacklenmiş Windows Sistem AnaliziBGA Cyber Security

Privileged Access Management (PAM)danb02

Ports, pods and proxiesLibbySchulze

OWASP Top 10 Vulnerabilities - A5-Broken Access Control; A6-Security Misconfi...Lenur Dzhemiliev

EMEA Airheads- LACP and distributed LACP – ArubaOS SwitchAruba, a Hewlett Packard Enterprise company

Role based access control - RBACAjit Dadresa

Siber Tehdit Avcılığı (Threat Hunting)BGA Cyber Security

Windows Sistemlerde Yetkili Hesapları İzleyerek Yanal Hareketleri YakalamaBGA Cyber Security

Siber Güvenlikte Yapay Zeka Uygulamaları - WebinarBGA Cyber Security

Burpで指定文字列を検索abend_cve_9999_0001

Webinar: SOC Ekipleri için MITRE ATT&CK Kullanım SenaryolarıBGA Cyber Security

Security Patterns with the WSO2 ESBWSO2

What's hot (20)

Thick Client Testing Advanced

Privileged identity management

Identity & Access Management - Securing Your Data in the 21st Century Enterprise

DDoS Saldırı Analizi - DDoS Forensics

Database auditing essentials

Patch Management Best Practices

Role Based Access Control - Overview

Derbycon - The Unintended Risks of Trusting Active Directory

Hacklenmiş Windows Sistem Analizi

Privileged Access Management (PAM)

Ports, pods and proxies

OWASP Top 10 Vulnerabilities - A5-Broken Access Control; A6-Security Misconfi...

EMEA Airheads- LACP and distributed LACP – ArubaOS Switch

Role based access control - RBAC

Siber Tehdit Avcılığı (Threat Hunting)

Windows Sistemlerde Yetkili Hesapları İzleyerek Yanal Hareketleri Yakalama

Siber Güvenlikte Yapay Zeka Uygulamaları - Webinar

Burpで指定文字列を検索

Webinar: SOC Ekipleri için MITRE ATT&CK Kullanım Senaryoları

Security Patterns with the WSO2 ESB

Viewers also liked

Controlling USB Flash Drive Controllers: Expose of Hidden Featuresxabean

BadUSB — On accessories that turn evil by Karsten NohlPriyanka Aash

SanDisk SecureAccess Encryption - Forensic Processing & USB FlashingBrent Muir

SC Magazine Congress Chicago - BadUSB & BeyondAdam Caudill

"There's a pot of Bitcoins behind the ransomware rainbow"Christiaan Beek

SanDisk SecureAccess Encryption 1.5Brent Muir

Introduction to c#singhadarsh

BadUSB, and what you should do about itrobertfisk

AirHopper: Bridging the Air-Gap between Isolated Networks and Mobile Phones u...mordechaiguri

Raspberry PiのUSB OTGを試すKenichiro MATOHARA

Introduction to c#Ravi Jakashania

Raspberry Pi ZeroBaoshi Zhu

Am I being spied on: Low-tech ways of detecting high-tech surveillance (DEFCO...Philip Polstra

Penetration Testing Execution Phases Nasir Bhutta

Visual studio 2015 and .net core 5 – get ready to rumbleTadeusz Balcer

Pascal Programming Session 1Ashesh R

Secret of Intel Management Engine by Igor SkochinskyCODE BLUE

Pascal programming languageMahesh Kodituwakku

Viewers also liked (18)

Controlling USB Flash Drive Controllers: Expose of Hidden Features

BadUSB — On accessories that turn evil by Karsten Nohl

SanDisk SecureAccess Encryption - Forensic Processing & USB Flashing

SC Magazine Congress Chicago - BadUSB & Beyond

"There's a pot of Bitcoins behind the ransomware rainbow"

SanDisk SecureAccess Encryption 1.5

Introduction to c#

BadUSB, and what you should do about it

AirHopper: Bridging the Air-Gap between Isolated Networks and Mobile Phones u...

Raspberry PiのUSB OTGを試す

Introduction to c#

Raspberry Pi Zero

Am I being spied on: Low-tech ways of detecting high-tech surveillance (DEFCO...

Penetration Testing Execution Phases

Visual studio 2015 and .net core 5 – get ready to rumble

Pascal Programming Session 1

Secret of Intel Management Engine by Igor Skochinsky

Pascal programming language

Similar to DerbyCon 2014 - Making BadUSB Work For You

UKOUG 2011: Practical MySQL TuningFromDual GmbH

Open Source Data DeduplicationRedWireServices

BKK16-304 The State of GDB on AArch64Linaro

BlackHat 2009 - Hacking Zigbee Chips (slides)Michael Smith

Armadillos - or how to bypass code readout protection on microcontrollersAndrew Tierney

Placas base evoluciongatarufo

Hardware hackingTavish Naruka

All Flash is not Equal: Tony Pearson contrasts IBM FlashSystem with Solid-Sta...Tony Pearson

Placas base evolucion[1]zuzanitah

CArcMOOC 07.02 - Non-volatile memory devicesAlessandro Bogliolo

Java fx on raspberry pi gerrit grunwaldNLJUG

Fun with JavaFX8 on the Raspberry PiNLJUG

Matrix glitcher tutorialJosé Mota

Operation Unthinkable – Software Defined Storage @ Booking.com (Peter Buschman)data://disrupted®

Quickboot on i.MX6Gary Bisson

Welcome to pc hardwarejaydeepdwivedi

Innodisk at aditech customer meet 2015Vilas Fulsundar

Cy7 introductionKunhui Wu

Making a Process (Virtualizing Memory)David Evans

Aditech innodisk-flash disk technologyVilas Fulsundar

Similar to DerbyCon 2014 - Making BadUSB Work For You (20)

UKOUG 2011: Practical MySQL Tuning

Open Source Data Deduplication

BKK16-304 The State of GDB on AArch64

BlackHat 2009 - Hacking Zigbee Chips (slides)

Armadillos - or how to bypass code readout protection on microcontrollers

Placas base evolucion

Hardware hacking

All Flash is not Equal: Tony Pearson contrasts IBM FlashSystem with Solid-Sta...

Placas base evolucion[1]

CArcMOOC 07.02 - Non-volatile memory devices

Java fx on raspberry pi gerrit grunwald

Fun with JavaFX8 on the Raspberry Pi

Matrix glitcher tutorial

Operation Unthinkable – Software Defined Storage @ Booking.com (Peter Buschman)

Quickboot on i.MX6

Welcome to pc hardware

Innodisk at aditech customer meet 2015

Cy7 introduction

Making a Process (Virtualizing Memory)

Aditech innodisk-flash disk technology

Recently uploaded

一比一原版(CSUEB毕业证书)东湾分校毕业证原件一模一样ayoqf

Point of Care Testing in clinical laboratoryoyebolasonuga14

🌹Patia⬅️ Vip Call Girls Bhubaneswar 📱9777949614 Book Well Trand Call Girls In...Call Girls Mumbai

Abortion pills in Jeddah |+966572737505 | Get CytotecAbortion pills in Riyadh +966572737505 get cytotec

怎样办理圣芭芭拉分校毕业证（UCSB毕业证书）成绩单留信认证ehyxf

Top profile Call Girls In Palghar [ 7014168258 ] Call Me For Genuine Models W...gajnagarg

怎样办理昆士兰大学毕业证（UQ毕业证书）成绩单留信认证ehyxf

在线办理(scu毕业证）南十字星大学毕业证电子版学位证书注册证明信oopacde

一比一定(购)国立南方理工学院毕业证(Southern毕业证)成绩单学位证wpkuukw

一比一原版(Otago毕业证书)奥塔哥理工学院毕业证成绩单学位证靠谱定制uodye

Critical Commentary Social Work Ethics.pptxبشير امين حيدر

Abortion Pill for sale in Riyadh ((+918761049707) Get Cytotec in Dammamahmedjiabur940

Mankhurd Call Girls, 09167354423 Mankhurd Escorts Services,Mankhurd Female Es...Priya Reddy

一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证wpkuukw

Call Girls Amethi 9332606886 HOT & SEXY Models beautiful and charming call g...Sareena Khatun

Abortion pills in Dammam +966572737505 Buy CytotecAbortion pills in Riyadh +966572737505 get cytotec

Mass storage systems presentation operating systemsnight1ng4ale

In Riyadh Saudi Arabia |+966572737505 | Buy Cytotec| Get Abortion pillsAbortion pills in Riyadh +966572737505 get cytotec

Guwahati Escorts Service Girl ^ 9332606886, WhatsApp Anytime Guwahatimeghakumariji156

怎样办理维多利亚大学毕业证（UVic毕业证书）成绩单留信认证tufbav

Recently uploaded (20)

一比一原版(CSUEB毕业证书)东湾分校毕业证原件一模一样

Point of Care Testing in clinical laboratory

🌹Patia⬅️ Vip Call Girls Bhubaneswar 📱9777949614 Book Well Trand Call Girls In...

Abortion pills in Jeddah |+966572737505 | Get Cytotec

怎样办理圣芭芭拉分校毕业证（UCSB毕业证书）成绩单留信认证

Top profile Call Girls In Palghar [ 7014168258 ] Call Me For Genuine Models W...

怎样办理昆士兰大学毕业证（UQ毕业证书）成绩单留信认证

在线办理(scu毕业证）南十字星大学毕业证电子版学位证书注册证明信

一比一定(购)国立南方理工学院毕业证(Southern毕业证)成绩单学位证

一比一原版(Otago毕业证书)奥塔哥理工学院毕业证成绩单学位证靠谱定制

Critical Commentary Social Work Ethics.pptx

Abortion Pill for sale in Riyadh ((+918761049707) Get Cytotec in Dammam

Mankhurd Call Girls, 09167354423 Mankhurd Escorts Services,Mankhurd Female Es...

一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证

Call Girls Amethi 9332606886 HOT & SEXY Models beautiful and charming call g...

Abortion pills in Dammam +966572737505 Buy Cytotec

Mass storage systems presentation operating systems

In Riyadh Saudi Arabia |+966572737505 | Buy Cytotec| Get Abortion pills

Guwahati Escorts Service Girl ^ 9332606886, WhatsApp Anytime Guwahati

怎样办理维多利亚大学毕业证（UVic毕业证书）成绩单留信认证

DerbyCon 2014 - Making BadUSB Work For You

1. Making BadUSB Work For You Adam Caudill (@adamcaudill) Brandon Wilson (@brandonlwilson)

2. What is BadUSB? ● NOT a technical flaw ● NOT a vulnerability

3. Patriot 8GB Supersonic Xpress

4. Phison 2251-03

5. Reverse Engineering

6. A word of warning...

7. ● Always starts at boot ROM ● Attempts to read firmware from NAND ● If successful, first 32KB loaded to XDATA ● If not, waits to receive code to RAM and executes it Boot Process

8. Pin Shorting

9. Paging ... Page 0 Page 1 Page 2 Page A Base section 0x0000 0x5000 0xEFFF

10. Firmware Update Process Boot ROM Burner Executable Firmware

11. Pain Points ● Patching existing firmware o Very touchy o Limited RAM available ● Writing from-scratch firmware o NAND sucks o Non-standard command sets o Bad block management o Global wear leveling ● Lots...and lots...of pin shorting

12. Quick Reset Cable

13. New Tools ● Desktop Flasher ● Firmware Patcher ● HID payload injector

14. What We've Done ● Custom HID firmware ● Hidden partition patch ● Password protection bypass patch

15. Custom HID Firmware

16. Hidden Partition Patch Read Request (Get LBA 0x00000073) Patch (Use hidden area?) Section 1 (Public) Section 2 (Hidden)

17. Password Protection Bypass

18. Defense & Detection ● Composite devices ● Modified firmware ?

19. Source Code & Tools Drive: bit.ly/badusb4you Code: github.com/adamcaudill/Psychson Burner & Stock Firmware: usbdev.ru/files/phison/

20. Special Thanks Security Research Labs ● Karsten Nohl ● Sascha Krißler ● Jakob Lell

21. Special Thanks Richard Harman (@xabean) ShmooCon 2014 Controlling USB Flash Drive Controllers bit.ly/1xaNkbP

22. Thanks github.com/adamcaudill/Psychson Adam Caudill (@adamcaudill) Brandon Wilson (@brandonlwilson)

DerbyCon 2014 - Making BadUSB Work For You

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (18)

Similar to DerbyCon 2014 - Making BadUSB Work For You

Similar to DerbyCon 2014 - Making BadUSB Work For You (20)

Recently uploaded

Recently uploaded (20)

DerbyCon 2014 - Making BadUSB Work For You