Slashdot Mirror

← Back to Stories (view on slashdot.org)

Raspberry Pi As Hardware Backdoor

Posted by timothy on from the where-you-can-stick-it dept.

An anonymous reader writes "NCC Group has released a new whitepaper at the Blackhat Europe conference on using a Raspberry PI as a hardware-based backdoor (PDF) in laptop docking stations. From the paper: 'The IT department is typically more concerned about someone stealing your laptop, so they'll ask you to secure your laptop with a Kensington-style lock, but not necessarily to secure the dock. This paper details how attackers can exploit the privileged position that laptop docking stations have within an environment. It will also describe the construction of a remotely controllable, covert hardware implant, but most importantly it will discuss some of the techniques that can be employed to detect such devices and mitigate the risks that they pose.'"

12 of 76 comments (clear)

  1. Surprise!!! by bferrell · · Score: 5, Insightful

    If you have physical access, you can do bad things. Is this really news or simply fear mongering?

    1. Re:Surprise!!! by dreamchaser · · Score: 3, Insightful

      You hit the nail on the head. It's just fear mongering and there is nothing new to see here.

    2. Re:Surprise!!! by blackicye · · Score: 3, Insightful

      This is similar to dropping a Sega Dreamcast into a network as an inexpensive hardware backdoor.

      If your company has been physically compromised you probably need to start sweeping for bugs and bringing in the bomb sniffer dogs as well ;)

    3. Re:Surprise!!! by Garridan · · Score: 4, Interesting

      Naw, the paper is a good read. Fun pictures, funnier security recommendations. I'd love to see the IT guy who goes around weighing people's docking stations. Poor sap would end up taking night shifts just to avoid the teasing.

    4. Re:Surprise!!! by gweihir · · Score: 4, Informative

      It is just a nice demonstration of something that has been known for a long time. As such, the _demonstration_ is news, but not the possibility itself.

      I must say however, that the motto "freedom from doubt" on the paper is pure snake-oil, as IT security cannot achieve that and anybody that claims this is a liar. What IT security can to is reduce risks and make it harder for an attacker to get in. When the attacker has to spend more than the protected information is worth, you could say that you have "perfect security" or "freedom form doubt", but that does not happen in practice. The problem is that you cannot estimate the worth if your secret data to the attacker reliably. For example, your attackers may be fanatics (maybe even in the form of a fanatics-run nation state) and hence may be completely irrational and attribute value to the secret data or the successful break-in itself that is far beyond any rational estimates.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  2. Raspberry pi nothing, printers are the real danger by Dwedit · · Score: 5, Insightful

    Forget raspberry pi, the real danger is your printer. Printers can have their firmware upgraded by printing a special PDF file. They are networked devices. Once hacked, they can carry out attacks, act as backdoors, or even send a copy of everything printed to an attacker.

  3. someting so huge by silas_moeckel · · Score: 4, Insightful

    Why use a R pi when you can get linux boxes the size of Ethernet jacks? Because the R Pi is "cool"?

    --
    No sir I dont like it.
  4. article wrong on voltage divider for power source by Anonymous Coward · · Score: 3, Interesting

    The voltage divider shown couldn't deliver any significant current (less than 1 milliamp). The Pi is rated for about 1 Amp. Somebody is proud of their voltage divider equation but doesn't understand it. Unimpressed!

  5. This article is not about Raspberry Pi... by fufufang · · Score: 3, Interesting

    It is about people hacking the docking station for laptops...

    If the victim is very important to the organisation which conducts hacking, a custom made PCB might be implant into the docking station... There is no need to use Raspberry Pi, which would make the whole thing very amateur.

    1. Re:This article is not about Raspberry Pi... by Anonymous Coward · · Score: 5, Interesting

      One approach we've seen on attacks on us, i.e. drives people find in the parking lot, is that the device appears as a composite device. Part of it shows up as an almost empty USB drive with a couple of innocuous Word documents, as long as you don't show hidden files and directories. However, the second and third parts are HID, when idle for too long, the new keyboard will try to do windows key+R -> "iexplore malwaresite". They also do other attacks using that means of access of a combination USB drive, keyboard and mouse.

  6. Re:article wrong on voltage divider for power sour by gweihir · · Score: 5, Informative

    Hehehehe, fascinating!

    In addition, these people do not know that a voltage divider is entirely unsuitable for powering anything with variable current consumption. The easy solution would be to use a switching-mode 5V 1A regulator module like the Traco Power TSR 1-2450. My guess is they never powered the Raspberry Pi from the 19V input. These people seem to understand digital electronics to some degree, but gave no clue about analog electronics.

    The demo is nice nonetheless.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  7. Re:article wrong on voltage divider for power sour by Alwin+Henseler · · Score: 3, Informative

    Given the overall level of detail, the stupidity in this chapter "Power considerations" kind of amazed me. Calculations look correct btw, result just doesn't hold up when you draw up to 1A.

    Probably the person(s) who figured out most of the info, person writing this chapter, and person putting everything together, must be different people. Otherwise this chapter would surely have been re-written.