Slide 1: USB under the bonnet
USB under the bonnet Andy Davis, Research Director NCC Group
Slide 2: Who am I
Who am I • Research Director at NCC Group • 10 years working in various security roles within UK Government • 13 years working in commercial Cyber Security roles, primarily research-related • Hands-on researcher - presented many security papers at conferences and identified over 100 vulnerabilities
Slide 3: Agenda
Agenda • An overview of USB basics and some classic examples of where vulnerabilities have been previously identified • How to test for USB host security vulnerabilities using a combined hardware/software approach • The power of open source software when triaging bugs in embedded systems • How explo
Slide 4: Why talk about USB in cars?
Why talk about USB in cars? • When did USB first appear in cars? • What is USB used for in cars? • Why is USB a security concern? • How do attackers exploit USB vulnerabilities?
Slide 5: USB Primer
nccgroup~ USB Primer ec
Slide 6: USB primer - architecture
USB primer - architecture • The aim of USB was to find a solution to the mixture of connection methods to the PC • Currently four speeds of data transfer: • Low – 1.5Mbps (keyboard, mouse etc.) • Full – 12Mbps (originally for all other devices) • High – 480Mbps (developed in response to FireWire) •
Slide 7: USB primer - terminology
USB primer - terminology • The USB bus • When the host is transmitting a packet of data, it is sent to every device connected to an enabled port. It travels downwards via each hub in the chain which resynchronises the data transitions as it relays it. Only one device, the addressed one, actually acc
Slide 8: Configurations, Interfaces, and Endpoints
Configurations, Interfaces, and Endpoints • The device contains a number of descriptors (as shown to the right) which help to define the device’s capabilities • A device can have more than one configuration, though only one at a time, and to change configuration the whole device would have to stop f
Slide 9: USB enumeration
USB enumeration NCCQfOUP * Pull-up resistor on data line — Indicates device was connected (reset device) * Get Device descriptor — what's the max packet size? — address 0 * Reset then Set Address - for the rest of the communications use this address » Get Device descriptor — What are the device basi
Slide 10: Recent USB host bugs in the IT world
Recent USB host bugs in the IT world • CVE-2011-2295: Oracle Sun Solaris USB Local Buffer Overflow Vulnerability • CVE-2012-3723: Apple Mac OS X USB Hub Descriptor bNbrPorts Heap overflow • MS13-027: The Windows 8 RNDIS kernel pool overflow • CVE-2013-3200: Microsoft Windows USB Descriptor Handling
Slide 11: USB host bugs in IVI systems
USB host bugs in IVI systems • We have tested a number of different infotainment USB implementations • Embedded systems are just as vulnerable to USB driver bugs as the IT world • We have generally identified more bugs in embedded systems within vehicles than traditional operating systems • Exploita
Slide 12: How I first started finding USB bugs (2011)
How I first started finding USB bugs (2011) • Arduino microcontroller • Fuzzer written in C++ • Only emulates USB HID devices • Only allows semi-automated fuzzing • Identified bugs in: • Windows 7 • Windows XP • OS X • Limitations – not really fast enough to emulate most USB devices
Slide 13: USB fuzzer – the next generation (2012)
USB fuzzer – the next generation (2012) • Dedicated USB test equipment hardware • USB capture and playback • Emulates any USB host or device • Understands and analyses the different USB device classes • Uses a scripting language to generate USB traffic • Costs approx. USD1200 (plus specific class an
Slide 14: How I find them now (2013 onwards)
How I find them now (2013 onwards) • Facedancer and umap • Umap is open source software - https://github.com/nccgroup/umap • Facedancer is open source hardware - http://goodfet.sourceforge.net/hardware/facedancer21/ Image: http://blog.j-michel.org/
Slide 15: Demo: USB testing
nccgroup~ Demo: USB testing Ec
Slide 16: The power of open source
The power of open source • Fuzz testing is very effective, but only identifies potential bugs • To triage bugs, either a development environment is required… • …or if the USB stack is open source you can triage on Linux Image: http://images.atelier.net
Slide 17: How else can USB be exploited?
How else can USB be exploited? • Malicious firmware updates • Malicious content that attacks media parsers • Viral code that uses USB as the transport mechanism • USB-based vendor engineering tools usage Image: http://us.cdn4.123rf.com
Slide 18: USB exploitation restrictions
USB exploitation restrictions • Bug triage is often challenging • Driver exploit development is not for the faint hearted! • USB descriptors often have limited space for attack payloads • Race condition bugs can sometimes have strict timing limitations • Physical access is required in order to inser
Slide 19: USB exploitation impact
USB exploitation impact • Code Execution: Running malicious code on an infotainment system, potentially (depending on vehicle architecture) resulting in access to the CAN bus and to cyber physical systems • Data Loss: Exfiltrating sensitive data such as Personally Identifiable Information (PII) or c
Slide 20: Unique challenges in automotive
Unique challenges in automotive • Challenges: • People want to listen to their music • People want to charge their devices • Firmware and map data needs to be updated • Vehicle systems need to be tested using USB-based tools • BadUSB recently highlighted the implicit trust issues around USB • Soluti
Slide 21: Security through obscurity – Lessons from the IT world
Security through obscurity – Lessons from the IT world • Time and time again we see this in embedded systems • Hidden “Security mechanisms” designed to authenticate users who are allowed to update firmware • Hidden USB class drivers that are used for vendor tools • Hidden engineering menus that assi
Slide 22: Conclusions
Conclusions • The USB protocol is already in many vehicles and is here to stay • USB within vehicles may not have been previously considered a serious attack vector • I have shown that the impact of successful USB attack can be serious • Just because physical access is required doesn’t mean the thre
Slide 23: Questions?
Questions? Andy Davis, Research Director NCC Group andy.davis ‘at’ nccgroup ‘dot’ com
Slide 24: The Unique Automotive Cyber Security Partnership
The Unique Automotive Cyber Security Partnership Automotive Expertise Cyber Security Experts Connected Car Architectures Information Assurance Security Leadership Penetration Testing Industry Insight System & Software Security info@sbd.co.uk info@nccgroup.com An engineering approach to cyber securit