ABYSS OF BADUSB
- 1. ABYSS OF BADUSB MOPI – Japanese student who researches about information security
- 2. #WHOAMI MOPI (plz follow me on twitter => @naogramer) • Senior High-school Student in Japan (Grade 11th) • Like to use Python 3.x, C++ (with Win32 API) • Most interested topic = DFIR (Digital Forensics Incident Response • Sorry for bad English …… (Studied abroad in Canada for just 1 year) 401 – Unauthorized I don‘t want to release my face to internet…… Actually, there is some but…… orz.
- 3. WHAT IS BADUSB USB device with malicious firmware which uses to get all secret data inside your computer and mess up everything.
- 4. LETS TALK ABOUT BORING HISTORY Actually, BadUSB is not BadUSB. $ alias BadUSB BadUSB
- 5. REAL AND TRUE BADUSB This is the “REVERSE ENGINEERED” real and true BadUSB. (Psychson)
- 6. REVERSE ENGINEERED…… True, real, and original BadUSB exploits are not available. Information of exploits has been released in BlackHat USA 2014, but exploit code wasn’t released out. BOOM!!! But some challenger reverse engineered and released on GitHub!!!
- 7. TRUE AND REAL ONE IS USELESS… Psychson only supports really few specific USB devices, and some of them are already discontinued or fixed up.
- 8. ARDUINO IS GREAT DECISION Some Arduino boards support USB output function. This will be big help if you are beginner, because it officially supports everything needs in BadUSB.
- 9. HOW_2_ATTACK • Payload format depends on the types of BadUSB (If you are using Arduino, you can write payload with C-like lang.) • You should make stealth (no GUI, silence) as much as you can. • There is many advanced options. (eg: RAT, Dropper, etc…)
- 10. LET’S TRY I have implemented simple dropper code for USB output supported Arduino. GitHub Repository: https://gist.github.com/moppoi5168/e64466fd748e7169dfd6521241a74bfb
- 11. WHAT IS THIS CODE DOING It opens command prompt (administrator) and download execution files to c:¥windows_update.exe using PowerShell. And then it will execute c:¥windows_update.exe. Very simple dropper J.
- 12. ANY QUESTIONS?