Slashdot Mirror
Raspberry Pi As Hardware Backdoor
An anonymous reader writes "NCC Group has released a new whitepaper at the Blackhat Europe conference on using a Raspberry PI as a hardware-based backdoor (PDF) in laptop docking stations. From the paper: 'The IT department is typically more concerned about someone stealing your laptop, so they'll ask you to secure your laptop with a Kensington-style lock, but not necessarily to secure the dock. This paper details how attackers can exploit the privileged position that laptop docking stations have within an environment. It will also describe the construction of a remotely controllable, covert hardware implant, but most importantly it will discuss some of the techniques that can be employed to detect such devices and mitigate the risks that they pose.'"
If you have physical access, you can do bad things. Is this really news or simply fear mongering?
Forget raspberry pi, the real danger is your printer. Printers can have their firmware upgraded by printing a special PDF file. They are networked devices. Once hacked, they can carry out attacks, act as backdoors, or even send a copy of everything printed to an attacker.
Why use a R pi when you can get linux boxes the size of Ethernet jacks? Because the R Pi is "cool"?
No sir I dont like it.
The voltage divider shown couldn't deliver any significant current (less than 1 milliamp). The Pi is rated for about 1 Amp. Somebody is proud of their voltage divider equation but doesn't understand it. Unimpressed!
Why to bring an obvious "strange device" at the eyes of the unsuspecting to connect to a company laptop if you can bring a cellphone for doing the same task? (if current cellphones are too braindead/locked for that, an N900 should be more than enough).
If you don't care about being subtle, just rebooting with a bootable pendrive or disarming the notebook to extract the HD should do the word, but a cellphone is something that could not raise suspicion, you can always say that is for recharging the battery (and again, with an N900, will make even more sense)
It is about people hacking the docking station for laptops...
If the victim is very important to the organisation which conducts hacking, a custom made PCB might be implant into the docking station... There is no need to use Raspberry Pi, which would make the whole thing very amateur.
The problem is just that programming a Raspberry Pi is very easy, while programming a printer is pretty hard.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Hehehehe, fascinating!
In addition, these people do not know that a voltage divider is entirely unsuitable for powering anything with variable current consumption. The easy solution would be to use a switching-mode 5V 1A regulator module like the Traco Power TSR 1-2450. My guess is they never powered the Raspberry Pi from the 19V input. These people seem to understand digital electronics to some degree, but gave no clue about analog electronics.
The demo is nice nonetheless.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
we were doing this with the precursor to the Pi the "sheevaplug" over 4 years ago... doing it with a pi is not innovative or new in any way.
Do not look at laser with remaining good eye.
Given the overall level of detail, the stupidity in this chapter "Power considerations" kind of amazed me. Calculations look correct btw, result just doesn't hold up when you draw up to 1A.
Probably the person(s) who figured out most of the info, person writing this chapter, and person putting everything together, must be different people. Otherwise this chapter would surely have been re-written.
Sounds plausible to me. I also guess this was finished in some haste to get it to the conference in time. For example, the video-grabbing is not implemented, while I see no fundamental problem with that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I was going to suggest a simple 7805, but the TSR-2450 would be much better heat-wise.
Damn, power supplies are getting small. That thing is 11 x 10 x 7 mm!
I'm guessing that wasn't on their radar screen...
The problem is just that programming a Raspberry Pi is very easy, while programming a printer is pretty hard.
But all it takes is one very smart programmer to do that programming, then the exploit code can be distributed or sold to whoever wants to launch an attack.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Or you could aim for the middle. One of the classics is to build a micro computer into the shell of a ups and route both the printer's power and the network through it. The device plays man in the middle under the guise of a printer and looks like a piece of dumb hardware. Others have even gone as far as embedding the computer in the printer itself. (reminds me of a video on how to embed a key logger into a keyboard)
A 7805 would work, but generate a lot of heat and require a relatively large heat-sink. The TSR-2450 is pretty amazing, also because it is probably cheaper than the 7805 when you take the cost of the heat-sink and mounting materials into account.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Once it is distributed or sold, it becomes almost worthless. The thing with these attacks is that you need to stay undiscovered for longer times in order for the information you gather to stay valuable. This is not something that is worthwhile doing with bought attack code. People that buy their attack code typically earn very little money from their attacks.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
All doable and valid. This does not devalue the idea to go into a docking station, and the docking station has some unique advantages,like access to keyboard and video output that a pure network hardware Trojan does not have.
Not, the demonstration is not any kind of breakthrough, but a nice piece of hardware hacking (if not done too competently here, see e.g. the missing actually working video-grabbing and the botched power supply issue).
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
There are a lot of specific printer driver systems shared on different printer servers on common hardeware/software exposed to the internet . Not so many RasPi. Though sensible folk don't do that (they VPN/SSL). Which brings you back to physical or at least authorised access and I can ferret out the idiot allowing access.
Or try the classic LM2576
Using a simple voltage divider with Vin = 19.5V is not a good idea
why they didn't use a 7805?
The problem is just that programming a Raspberry Pi is very easy, while programming a printer is pretty hard.
Remember the old HP printer message April Fools' gag: http://kovaya.com/miscellany/2007/10/insert-coin.html . . . ?
How about modifying that so the victims are instructed to enter their userids and passwords . . . ?
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
People still create, sell, buy and use laptop docking stations and the laptops that use them?
Once hacked, they can carry out attacks, act as backdoors, or even send a copy of everything printed to an attacker.
So you're saying I can piss of a printer hacker by printing the endless supplies of crap I read on the internet? Time to kill a tree, baby ;-)
I've had two comments pointing out the truth about the Raspberry Pi modded down. It's a fact that it has flaky USB, and it's a fact that the ethernet is attached to it. Therefore it's a fact that it has poorly-implemented Ethernet. You can argue or abuse moderation all day and it won't change the fact that the Raspberry Pi is a poor choice for a sniffer by any critera. The single most important factor in a sniffer is working networking, which the Pi lacks.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It was discovered that these adapter cables contain a microcomputer in them. Why not put your backdoor in the cable itself.
Is it possibly easier to add custom hardware to the Raspberrry Pi? I mean they're both Linux boxes, but one of them is designed to be extended.
You could add an FM transceiver for remote operations without communicating over LAN/WAN?
It's funny, everywhere I've worked that had docks I realized it could be an attack vector. Glad that someone else realizes it too. However the solutions/defenses they provide aren't likely to happen in most I.T. groups. Really? Infrared cameras? RF sniffers?
A configurable, highly modifyable embedded microcontroller can be attached to other hardware to make that hardware configurable and highly modifyable! Imagine that! Its almost like that's what embedded microcontrollers were designed to do!
Ok, its true, I have a radio controlled clock, that syncs via shortwave and binary coded decimal to atomic clocks, and with a Raspberry PI attached, I could turn this into a cheap* stratum 1 NTP server. *($50 for Raspberry Pi, $20 for clock, so $70 for cheap stratum 1 NTP time server, which is less than the typical $550-$950 these units normally cost). There are a million other things you can do like this, and hack-a-day shows you how.
We depend on our vendors to ensure there are no embedded hardware based backdoors in equipment we purchase. From what our feds, manufacturers, and spooks have found, we import LOTS of electronics, mainly from fabs in China with 'additional unknown use circuitry' on the mask that has been reverse engineered to determine a fair amount of the additional circuitry are hardware based backdoors. ... I am more concerned about the 'additional circuits' in routers, processors, and storage controllers than in printers. Not that the printers aren't a problem too.