Slashdot Mirror
Raspberry Pi As Hardware Backdoor
An anonymous reader writes "NCC Group has released a new whitepaper at the Blackhat Europe conference on using a Raspberry PI as a hardware-based backdoor (PDF) in laptop docking stations. From the paper: 'The IT department is typically more concerned about someone stealing your laptop, so they'll ask you to secure your laptop with a Kensington-style lock, but not necessarily to secure the dock. This paper details how attackers can exploit the privileged position that laptop docking stations have within an environment. It will also describe the construction of a remotely controllable, covert hardware implant, but most importantly it will discuss some of the techniques that can be employed to detect such devices and mitigate the risks that they pose.'"
If you have physical access, you can do bad things. Is this really news or simply fear mongering?
Forget raspberry pi, the real danger is your printer. Printers can have their firmware upgraded by printing a special PDF file. They are networked devices. Once hacked, they can carry out attacks, act as backdoors, or even send a copy of everything printed to an attacker.
Why use a R pi when you can get linux boxes the size of Ethernet jacks? Because the R Pi is "cool"?
No sir I dont like it.
The voltage divider shown couldn't deliver any significant current (less than 1 milliamp). The Pi is rated for about 1 Amp. Somebody is proud of their voltage divider equation but doesn't understand it. Unimpressed!
Why to bring an obvious "strange device" at the eyes of the unsuspecting to connect to a company laptop if you can bring a cellphone for doing the same task? (if current cellphones are too braindead/locked for that, an N900 should be more than enough).
If you don't care about being subtle, just rebooting with a bootable pendrive or disarming the notebook to extract the HD should do the word, but a cellphone is something that could not raise suspicion, you can always say that is for recharging the battery (and again, with an N900, will make even more sense)
It is about people hacking the docking station for laptops...
If the victim is very important to the organisation which conducts hacking, a custom made PCB might be implant into the docking station... There is no need to use Raspberry Pi, which would make the whole thing very amateur.
The problem is just that programming a Raspberry Pi is very easy, while programming a printer is pretty hard.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Hehehehe, fascinating!
In addition, these people do not know that a voltage divider is entirely unsuitable for powering anything with variable current consumption. The easy solution would be to use a switching-mode 5V 1A regulator module like the Traco Power TSR 1-2450. My guess is they never powered the Raspberry Pi from the 19V input. These people seem to understand digital electronics to some degree, but gave no clue about analog electronics.
The demo is nice nonetheless.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Given the overall level of detail, the stupidity in this chapter "Power considerations" kind of amazed me. Calculations look correct btw, result just doesn't hold up when you draw up to 1A.
Probably the person(s) who figured out most of the info, person writing this chapter, and person putting everything together, must be different people. Otherwise this chapter would surely have been re-written.
Sounds plausible to me. I also guess this was finished in some haste to get it to the conference in time. For example, the video-grabbing is not implemented, while I see no fundamental problem with that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I was going to suggest a simple 7805, but the TSR-2450 would be much better heat-wise.
Damn, power supplies are getting small. That thing is 11 x 10 x 7 mm!
I'm guessing that wasn't on their radar screen...
The problem is just that programming a Raspberry Pi is very easy, while programming a printer is pretty hard.
But all it takes is one very smart programmer to do that programming, then the exploit code can be distributed or sold to whoever wants to launch an attack.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
A 7805 would work, but generate a lot of heat and require a relatively large heat-sink. The TSR-2450 is pretty amazing, also because it is probably cheaper than the 7805 when you take the cost of the heat-sink and mounting materials into account.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Once it is distributed or sold, it becomes almost worthless. The thing with these attacks is that you need to stay undiscovered for longer times in order for the information you gather to stay valuable. This is not something that is worthwhile doing with bought attack code. People that buy their attack code typically earn very little money from their attacks.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
All doable and valid. This does not devalue the idea to go into a docking station, and the docking station has some unique advantages,like access to keyboard and video output that a pure network hardware Trojan does not have.
Not, the demonstration is not any kind of breakthrough, but a nice piece of hardware hacking (if not done too competently here, see e.g. the missing actually working video-grabbing and the botched power supply issue).
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The problem is just that programming a Raspberry Pi is very easy, while programming a printer is pretty hard.
Remember the old HP printer message April Fools' gag: http://kovaya.com/miscellany/2007/10/insert-coin.html . . . ?
How about modifying that so the victims are instructed to enter their userids and passwords . . . ?
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Yes, very common in companies. Actually, I wouldn't buy laptops that lack them for the company I work for.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
I've had two comments pointing out the truth about the Raspberry Pi modded down. It's a fact that it has flaky USB, and it's a fact that the ethernet is attached to it. Therefore it's a fact that it has poorly-implemented Ethernet. You can argue or abuse moderation all day and it won't change the fact that the Raspberry Pi is a poor choice for a sniffer by any critera. The single most important factor in a sniffer is working networking, which the Pi lacks.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It was discovered that these adapter cables contain a microcomputer in them. Why not put your backdoor in the cable itself.
Is it possibly easier to add custom hardware to the Raspberrry Pi? I mean they're both Linux boxes, but one of them is designed to be extended.
You could add an FM transceiver for remote operations without communicating over LAN/WAN?
It's funny, everywhere I've worked that had docks I realized it could be an attack vector. Glad that someone else realizes it too. However the solutions/defenses they provide aren't likely to happen in most I.T. groups. Really? Infrared cameras? RF sniffers?
With 20V at 1A a 7805 would stoke away 15W - that's a big heat sink
Custom electronics and digital signage for your business: www.evcircuits.com
You would use something modern like a 7805SR instead of a voltage divider or an old school 7805 that needs a huge heat-sink.
http://www.murata-ps.com/data/meters/dms-78xxsr.pdf
In GOD we trust, all others we monitor.