Slide 1: Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions
Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions Andy Davis, Research Director NCC Group Image from: p1fran.com
Slide 2: NCC Group offices
UK Offices North American Offices Australian Offices Manchester - Head Office San Francisco Sydney Cheltenham Atlanta Edinburgh New York Leatherhead Seattle London Thame European Offices Amsterdam - Netherlands Munich – Germany Zurich - Switzerland
Slide 3: Agenda
Agenda Part One: • Overview of the USB enumeration phase • Different USB stack implementations • USB testing platform • Installed drivers and supported devices • Fingerprinting techniques • Umap demo Part Two: • The Windows 8 RNDIS kernel pool overflow • Challenges faced when exploiting USB bugs • C
Slide 4: Part One: Information gathering
Part One: Information gathering • Why do we care? • If you connect to a device surely you already know the platform? • Embedded devices are mostly based on Linux anyway aren't they? • Allows you to focus your testing on only supported functionality
Slide 5: USB Background stuff
USB Background stuff Image from: blog.brickhousesecurity.com
Slide 6: Overview of the USB enumeration phase
Overview of the USB enumeration phase • What is enumeration for? • Assign an address • Speed of communication • Power requirements • Configuration options • Device descriptions • Identify class drivers • Lots of information exchange – implemented in many different ways Image from :http://ewalk2.blog
Slide 7: The USB enumeration phase
The USB enumeration phase < Get Device descriptor > Set Address < Get Device descriptor < Get Configuration descriptor < Get String descriptor 0 < Get String descriptor 2 < Get Configuration descriptor < Get Configuration descriptor > Set Configuration
Slide 8: Enumeration phase peculiarities
Enumeration phase peculiarities • Why is the device descriptor initially requested twice? • Why are there multiple requests for other descriptors? • Class-specific descriptors: < Get Hub descriptor < Get HID Report descriptor
Slide 9: Different USB stack implementations
Different USB stack implementations • Typical components of a USB stack • Windows USB driver stack • Linux USB stack • Embedded Access USB stack Image from: blogs.msdn.com
Slide 10: Typical components of a USB stack
Typical components of a USB stack • Host Controller hardware • USB System software: • Host Controller Driver – Hardware Abstraction Layer • USB Driver • Class drivers • Application software Image from: www.wired.com
Slide 11: Windows USB driver stack
Windows USB driver stack Image from: msdn.microsoft.com
Slide 12: Linux USB stack
Linux USB stack Image from: www.linux-usb.org
Slide 13: Embedded Access USB stack
Embedded Access USB stack Image from: www.embedded-access.com
Slide 14: Interacting with USB
Interacting with USB Image from: www.nvish.com
Slide 15: USB interaction requirements
USB interaction requirements • Need to capture and replay USB traffic • Full control of generated traffic • Class decoders extremely useful • Support for Low/High/Full speed required • USB 3.0 a bonus
Slide 16: USB testing – gold-plated solution
USB testing – gold-plated solution • Commercial test equipment
Slide 17: USB testing – the cheaper approach
USB testing – the cheaper approach • Facedancer (http://goodfet.sourceforge.net/hardware/facedancer21)
Slide 18: Best solution: A combination of both
Best solution: A combination of both • Device data can be carefully crafted • Host response data can be captured • Microsecond timing is also recorded • All class-specific data is decoded
Slide 19: Information enumeration
Information enumeration Image from: network.nature.com
Slide 20: Target list
Target list • Windows 8 • Ubuntu Linux 12.04 LTS • Apple OS X Lion • FreeBSD 5.3 • Chrome OS • Linux-based TV STB
Slide 21: Installed drivers and supported devices
Installed drivers and supported devices • Enumerating supported class types – standard USB drivers • Enumerating all installed drivers • Other devices already connected
Slide 22: Enumerating supported class types
Enumerating supported class types Where is USB class information stored? Device Descriptor Interface Descriptor
Slide 23: Installed drivers and supported devices
Installed drivers and supported devices • Drivers are referenced by class (Device and Interface descriptors) • Also, by VID and PID: • For each device class VID and PID values can be brute-forced (can easily be scripted using Facedancer) • Although there may be some shortcuts…. • Valid PIDs and VIDs
Slide 24: Enumerating installed drivers
Enumerating installed drivers Not installed: Installed: All communication stops after “Set Configuration”
Slide 25: Sniffing the bus - Other connected devices
Sniffing the bus - Other connected devices • Data from other devices will be displayed on other addresses • Controlling other devices? (untested)
Slide 26: Fingerprinting techniques
Fingerprinting techniques • Descriptor request patterns • Timing information • Descriptor types requested • Responses to invalid data • Order of Descriptor requests
Slide 27: OS Identification
OS Identification Linux-based TV STB Windows 8 < Get Max LUN (Mass Storage) < Get Max LUN (Mass Storage) > CBW: INQUIRY > CBW: INQUIRY < MSC Data In < MSC Data In < CSW - Status Passed < CSW - Status Passed > CBW: TEST UNIT READY > CBW: INQUIRY < CSW - Status Passed < MSC Data In > CBW: READ CAPACIT
Slide 28: Application identification
Application identification gphoto2 (Linux) “Photos” Metro app (Windows 8) > Image: OpenSession > Image: OpenSession < Image: OK < Image: OK > Image: GetDeviceInfo > Image: GetDeviceInfo < Image: DeviceInfo < Image: DeviceInfo < Image: OK < Image: OK > Image: GetStorageIDs > Image: SetDevicePropValue
Slide 29: Request patterns unique elements?
Request patterns unique elements? • Windows 8 (HID) – 3 x Get Configuration descriptor requests (others have two) • Apple OS X Lion (HID) – Set Feature request right after Set Configuration • FreeBSD 5.3 (HID) – Get Status request right before Set Configuration • Linux-based TV STB (Mass Storage) –
Slide 30: Timing information (work in progress…)
Timing information (work in progress…)
Slide 31: Timing information (work in progress…)
Timing information (work in progress…)
Slide 32: Using timing information? (work in progress…)
Using timing information? (work in progress…) • Large amount of variance over entire enumeration phase: • 4.055s, 3.834s, 3.612s, 3.403s, 3.089s • Much greater accuracy between specific requests: • Between String Descriptor #0 and #2 requests - 5002us, 5003us, 5003us, 4999us, 5001us • If we know the
Slide 33: Descriptor types requested
Descriptor types requested • Microsoft OS Descriptors (MOD) • Used for “unusual” devices classes • Devices that support Microsoft OS Descriptors must store a special USB string descriptor in firmware at the fixed string index of 0xEE. The request is:
Slide 34: Responses to invalid data
Responses to invalid data • Different USB stacks respond to invalid data in different ways • Maximum and minimum values • Logically incorrect values • Missing data • In some cases: Crashes (potential vulnerabilities) • Other cases: Unique behaviour Image from: windows7.iyogi.com
Slide 35: Invalid data unique elements?
Invalid data unique elements? Windows (all versions) If you send a specific, logically incorrect HID Report descriptor this happens:
Slide 36: Invalid data unique elements?
Invalid data unique elements? Windows (all versions) If you send a specific, logically incorrect HID Report descriptor this happens:
Slide 37: Order of Descriptor requests
Order of Descriptor requests • Some USB stacks request data from devices in a different order • Different drivers may request different descriptors multiple times • Sometimes descriptors are re-requested after enumeration is complete
Slide 38: Demo: umap
Demo: umap Image from: us.cdn4.123rf.com
Slide 39: Umap overview
Umap overview • Supported device classes can be enumerated • Operating system information can be enumerated • Devices with specific VID/PID/REV can be emulated • The enumeration phase and class-specific data can be fuzzed • Endpoint protection systems configuration can be assessed • Endpoint protect
Slide 40: Part Two: Potentially exploitable USB bugs
Part Two: Potentially exploitable USB bugs Image from: www.biro-media.hr
Slide 41: The Windows RNDIS kernel pool overflow
The Windows 8 RNDIS kernel pool overflow • MS13-027 • usb8023x.sys - default (Microsoft-signed) Windows Remote NDIS driver that provides network connectivity over USB. • When the following USB descriptor field is manipulated a Bug check occurs indicating a kernel pool overwrite: Configuration descri
Slide 42: The Bug Check
The Bug Check BAD_POOL_HEADER (19) The pool is already corrupt at the time of the current request. <Truncated for brevity> Arguments: Arg1: 00000020, a pool block header size is corrupt. Arg2: 83e38610, The pool entry we were looking for within the page. Arg3: 83e38690, The next pool entry. Arg4: 08
Slide 43: The SelectConfiguration() function
The SelectConfiguration() function
Slide 44: The crash point
The crash point SelectConfiguration(x)+9B SelectConfiguration(x)+98 SelectConfiguration(x)+90 SelectConfiguration(x)+9F SelectConfiguration(x)+At SelectConfiguration(x)+Aas SelectConfiguration(x)+Aas SelectConfiguration(x)+Aas SelectConfiguration(x)+*Ae SelectConfiguration(x)+Aac SelectConfiguration
Slide 45: Analysis #1
Analysis #1 When bNumInterfaces = 3 (one more than it should be) and bNumEndpoints = 2 (valid value) Next kernel pool: 849c3b28 10 00 0a 04 56 61 64 6c-6b 8f 94 85 28 8c 90 85 ....Vadlk...(... becomes: 849c3b28 00 00 0a 04 56 61 64 6c-6b 8f 94 85 28 8c 90 85 ....Vadlk...(... So we’re overwriting "Pr
Slide 46: Analysis #2
Analysis #2 When bNumInterfaces = 3 (one more than it should be) and bNumEndpoints = 5 (three more than it should be) Next kernel pool: 84064740 17 00 03 00 46 72 65 65-48 2d 09 84 30 a8 17 84 ....FreeH-..0... becomes: 84064740 17 00 03 00 00 72 65 65-48 2d 09 84 30 a8 17 84 .....reeH-..0... So we’r
Slide 47: What's going on?
What’s going on? kd> dt nt!_POOL_HEADER – +0x000 PreviousSize : Pos 0, 8 Bits – +0x000 PoolIndex : Pos 8, 8 Bits – +0x000 BlockSize : Pos 16, 8 Bits – +0x000 PoolType : Pos 24, 8 Bits – +0x004 PoolTag : Uint4B – +0x008 ProcessBilled : Ptr64 _EPROCESS By manipulating bNumInterfaces and bNumEndpoints
Slide 48: Some pseudo code
Some pseudo code for (i=0; i<something->count; i++) { list[i].descriptor = USBD_ParseConfigurationDescriptorEx (...); if(!list[i] .descriptor) break; list[i].descriptor = NULL; newthing = USB_CreateConfigurationRequestEx(thing, list); if(newthing) { ptr = &newthing->somemember; for (i=0; i<something
Slide 49: Challenges faced when exploiting USB bugs
Challenges faced when exploiting USB bugs • Lack of feedback channel • The bug is often in kernel code • Descriptors are generally very size-constrained • Typical impact of USB exploitation typically restricted to privilege escalation • Modern operating systems e.g. Windows 8 have comprehensive expl
Slide 50: Conclusions
Conclusions • The USB enumeration phase reveals useful information for fingerprinting • Class-specific communication is potentially even more revealing • Even vendors with mature SDL processes have USB bugs • USB bugs can potentially be exploited, to provide privilege escalation • …but it is extreme
Slide 51: Questions?
Questions? Andy Davis, Research Director NCC Group andy.davis ‘at’ nccgroup ‘dot’ com