Hacking with Hardware - URFUKED
Monta Elkins details "If do right, no can defence" -Miyagi Do you check every USB plug on your computer before you log-in.
Summary
Architecture and Background
"If do right, no can defence" -Miyagi Do you check every USB plug on your computer before you log-in? Didn't think so...
Vulnerability Analysis
URFUKED is used to take over the user's keyboard input and quickly execute preprogrammed attacks with the user's privileges. Plug in the USB receiver into the victim's computer.
Exploitation and Demonstrations
Then attack immediately or if necessary wait for the user to login- then trigger the attack remotely with an RF transmitter. Walk by and talk to the victim, and while he's turned away from the display, press the button on the transmitter to trigger the attack- it'll be done by the time he turns back around.
Remediation and Defensive Strategies
Or trigger it from across the room. It happens too fast to stop even if the user is watching when it happens. Learn how to build the device cheaply; program it using the opensource Arduino development environment.Learn how to use it and modify it for specific attacks. For copies of the slides and additional materials please see the DEF CON 18 Archive here:
Related talks
Main Stage·19 min
m010ch
An analysis of physical security flaws and key duplication vulnerabilities in municipal Knox Box rapid entry systems.
Main Stage·45 min
Brandon Wiley
Brandon Wiley details defeating Internet Censorship with Dust, the Polymorphic Protocol Engine BRANDON WILEY RESEARCHER, STEP THREE: PROFIT.
Main Stage·45 min
Brendan O'Connor
Brendan O'Connor details stalking a City for Fun and Frivolity BRENDAN O'CONNOR Tired of the government being the only entity around that can keep tabs on a whole city at once.