Slide 1: USB attacks need physical access right? Not any more...
USB attacks need physical access right? Not any more... Andy Davis, Research Director NCC Group
Slide 2: Agenda
Agenda • The problem with USB bugs • The USB bugs I’ve found and how I found them • Demo: iOS 7 bug • A contrived example of a remote USB bug via Bluetooth • Demo: Windows hidparse.sys bug • USB redirection via RDP • Demo: Windows 2012 usbaudio.sys bug (triggered remotely) • The implications for fut
Slide 3: The problem with USB bugs
The problem with USB bugs • Physical access required • Vendors aren’t really interested • Local bugs have their place, but have a limited impact Image: www.norcalblogs.com
Slide 4: Recent high profile USB host bugs
Recent high profile USB host bugs • CVE-2011-2295: Oracle Sun Solaris USB Local Buffer Overflow Vulnerability • CVE-2012-3723: Apple Mac OS X USB Hub Descriptor bNbrPorts Heap overflow • MS13-027: The Windows 8 RNDIS kernel pool overflow • CVE-2013-3200: Microsoft Windows USB Descriptor Handling Loc
Slide 5: How I first started finding USB bugs (2011)
How I first started finding USB bugs (2011) • Arduino microcontroller • Fuzzer written in C++ • Only emulates USB HID devices • Only allows semi-automated fuzzing • Has found bugs in: • Windows 7 • Windows XP • OS X • Limitations – not really fast enough to emulate most USB devices
Slide 6: USB fuzzer – the next generation (2012)
USB fuzzer – the next generation (2012) • Dedicated USB test equipment hardware • USB capture and playback • Emulates any USB host or device • Understands and analyses the different USB device classes • Uses a scripting language to generate USB traffic • Costs approx. USD1200 (plus specific class an
Slide 7: How I find them now (2013…)
How I find them now (2013…) • Facedancer and umap • https://github.com/nccgroup/umap Image: http://blog.j-michel.org/
Slide 8: What has umap found most recently?
What has umap found most recently? • CVE-2014-1287 : iOS 7 arbitrary code execution in kernel mode Image: ipadinministry.revguy.net
Slide 9: Demo: iOS bug
Demo: iOS 7 bug Image: us.cdn4.123rf.com
Slide 10: Contrived example of remote USB bug
Contrived example of remote USB bug • Discovered a null-pointer dereference in hidparse.sys in 2011 • Microsoft not interested – not really a security issue • Triggered by inserting a malicious device • HID report descriptor is parsed during enumeration phase • Blue screen occurs
Slide 11: Contrived example of remote USB bug
Contrived example of remote USB bug Windows (all versions) – not patched :
Slide 12: What else uses HID report descriptors?
What else uses HID report descriptors? • Bluetooth keyboards! • During pairing, report descriptor is parsed • Very tenuous, as this isn’t really a USB bug it’s a HID parsing bug • First attempt to move away from direct physical access
Slide 13: I have a spare Arduino…
I have a spare Arduino… Small, portable, programmable USB device to trigger USB vulnerabilities:
Slide 14: Demo: hidparse.sys bug via Bluetooth
Demo: hidparse.sys bug via Bluetooth Image from: us.cdn4.123rf.com
Slide 15: USB Redirection via RDP
USB Redirection via RDP Numerous legacy “High-level” redirection capabilities: • Easy Print • Drive Redirection • Smart Card Redirection • Plug-and-Play Device Redirection • Input Redirection • Audio Redirection • Port Redirection
Slide 16: Problem with High-level USB redirection
Problem with High-level USB redirection
Slide 17: Problem with High-level USB redirection
Problem with High-level USB redirection
Slide 18: Problem with High-level USB redirection
Problem with High-level USB redirection
Slide 19: Enter “RemoteFX USB Redirection”…
Enter “RemoteFX USB Redirection”… Image: www.norcalblogs.com
Slide 20: RemoteFX USB Redirection
RemoteFX USB Redirection hemoterX USB Redirection... IRDP High-Level Device Redirection... [Does not require drivers on the client [requires drivers for the device to be installed the client Requires the device driver to be installed on the ally does not require drivers on the [ss one redirection me
Slide 21: Enable RemoteFX on the client
Enable RemoteFX on the client Computer Configuration\Administrative Templates\Windows Components \Remote Desktop Services\Remote Desktop Connection Client\ RemoteFX USB Device Redirection C:\> gpupdate /force
Slide 22: Enable RemoteFX on the client
Enable RemoteFX on the client
Slide 23: Remote FX USB redirection attack
Remote FX USB redirection attack
Slide 24: Remote FX USB redirection attack
Remote FX USB redirection attack
Slide 25: Remote FX USB redirection attack
Remote FX USB redirection attack
Slide 26: Remote FX USB redirection attack
Remote FX USB redirection attack
Slide 27: Remote FX USB redirection attack
Remote FX USB redirection attack
Slide 28: Demo: usbaudio.sys bug via RDP
Demo: usbaudio.sys bug via RDP Image: us.cdn4.123rf.com
Slide 29: The implications for future USB bugs
The implications for future USB bugs • Windows USB bugs no longer need local physical access • Remote exposure of the Windows kernel has been increased • What were local DoS bugs can now remotely “blue-screen” a server • May apply to other (non-Windows) remoting technologies Image: montanaacquisitio
Slide 30: How can you reduce the risks?
How can you reduce the risks? • If RemoteFX is not required on the server, turn it off • If RemoteFX is required specify GUIDs of authorised USB devices • Do not enable RemoteFX USB remoting on clients • Minimise the use of USB “High-level” remoting via RDP • Be more cautious of “local” vulnerabilit
Slide 31: Conclusions and further research
Conclusions and further research • Physical access is no longer a requirement to trigger Windows USB bugs • RemoteFX USB remoting has exposed more of the Windows kernel to attackers • Need to investigate other remoting technologies e.g. Citrix • The Internet of Things is full of USB possibilities
Slide 32: Questions?
Questions? Andy Davis, Research Director NCC Group andy.davis ‘at’ nccgroup ‘dot’ com
Slide 33: UK Offices North American Offices Australian Offices
UK Offices North American Offices Australian Offices Manchester - Head Office San Francisco Sydney Cheltenham Atlanta Edinburgh New York Leatherhead Seattle London Thame European Offices Amsterdam - Netherlands Munich – Germany Zurich - Switzerland