Tag Archives: social engineering

Security Researcher Creates Remote WiFi USB Charging Cable

Early last week; a security researcher has demonstrated a new means of social engineering which could be used to compromise the security of a computer network:

TL DR: This cable poses a threat from a social engineering perspective. Should these cables become widespread: I would recommend being more careful of the cables you use to charge devices and consider using power outlets for charging.

What kind of threat does this pose?
The researcher created a custom USB cable that looks just like a standard cable. This cable could obviously be used to charge a smartphone. This cable however contains a custom printed circuit board (PCB) that allows an attacker to send commands to it via WiFi. The cable “appears” and acts as a keyboard and mouse when connected to a system and allows the attacker to control as if they had physical access to it and allows the opening of a reverse shell to execute commands:

The researcher demonstrated how the “mouse” feature of the cable could be used to prevent a system from locking after the real user has left the system by continually moving the mouse; just as a real person would.

Worse than this the cable has the potential to conduct WiFi deuthentication (de-auth) attacks which will disconnect devices in the vicinity from the WiFi networks they have connected with. This would constitute a denial of service attack and the inconvenience of having to keep re-connecting your wireless devices to the WiFi network again. Whether such an attack could be used to sniff/capture WiFi authentication credentials or to be used to exploit the KRACK vulnerability is not clear:

How could an adversary use this cable in a practical way?
The adversary simply need to wait for you to plug this cable into one of your systems. They don’t need to be nearby in order for them to access the system the cable is connected to (since the cable appears to be accessible over the internet connection in your office). Consider if an adversary left some of these cables on the desks in your organisation. How many people connect the cables to their systems to charge their phone? This would be even more common in older offices were USB charging ports aren’t readily available.

An adversary could also send some cables to your office via postal mail while pretending they came from the marketing department or another office of the same organisation. Cables aren’t considered malicious (like an unknown USB thumb drive should be) and will be used by those who receive them. Employees might also take them home or give these “free” cables to friends and family.

How can I protect myself from this type of threat?
This is not an easy question to answer. While you can educate your employees to not use cables that arrive in the postal mail (or even from your marketing department); what is to prevent them from doing so? Do you then treat every cable as a possible threat? You would need to place your office in a Faraday cage to truly mitigate this! Should you split every cable open to check if it has a WiFi PCB added to it (even if you did; could you tell what you are looking at)?

Given how common and widespread they are; is that even possible? You could ask that charging cables are only connected to power (electrical) outlets (requiring employees to bring the charging adapters for their devices (which almost nobody does)) or ask them to use portable battery packs. But again; what is to stop an employee from not doing this especially if they are travelling and need to charge their mobile devices? It’s already difficult to educate your employees about the dangers of BadUSB or juice-jacking (my previous post on that topic) but this is even harder to defend against:

It’s very likely that this cable would have a MAC address and while you can use MAC address authentication to protect your network; that can be bypassed. An adversary can spoof a MAC address (to use a legitimate MAC address from your own network). So, if you deny that MAC access to your network you could block the legitimate device too.

Note: The adversary would need to use some form of software to spoof the MAC address. The cable may not currently accommodate that capability. I assume the adversary can’t manufacture the silicon needed for a WiFi adapter and doesn’t have the ability to “burn” a MAC address of their choice into it.

It’s important to remember this cable is only a proof of concept at this time but the researcher does plan to sell them. They could be used by pen testers in much the same way as Wi-Fi Pineapples or RubberDuckies currently are. Given that the cable looks exactly like a standard USB smartphone charger (for an Apple device); from the photos included you can’t tell the difference between a genuine cable and this pen testing cable.

Can an upcoming standard for USB help with this issue?
Possibly.

Unfortunately, while the new USB Type-C Authentication Program appears to be more of a Digital Rights Management (DRM) feature that may raise charger and cable prices and potentially creating vendor lock-in. While it would help with detecting a malicious cable or a cable that was tampered with; it remains to be seen if the standard in reality increases security. It’s also unclear how the cables will authenticate since we have seen digital signatures being stolen in the past to bypass this form of authentication:

Thank you.

December 2018: Further Zero Day Vulnerabilities Disclosed

=======================
Update: 6th February 2019
=======================
In mid-January; the security firm 0patch issued a micropatch for what I refer to as vulnerability 4 (discussed below). As before the patch can be applied and will protect your devices until Microsoft can issue a finalised update via the regular channels.

The patch is only available for Windows 10 Version 1803. 0patch have requested that you contact them if you wish to obtain a patch for another version of Windows 10. They have published a YouTube video of the patch preventing the proof of concept code from working as the attacker intended.

Approximately a week after this micropatch was issued; another micropatch was made available; this time for what I refer to as vulnerability 3 (discussed below). That patch is available for Windows 10 Version 1803 64 bit and Windows 7 bit. As before 0patch have requested that you contact them if you wish to obtain a patch for another version of Windows. Another YouTube video is available demonstrating the micropatch preventing the proof of concept code from reading any file on the system as the attacker intended. It does this by changing the permissions on the temporary MSI file created by Windows Installer. The micropatch was more complex than originally thought to create. 0patch wanted to issue their patch before the Holiday period in December but were unable to do so since it required more thorough testing before being made available but there was not enough time left for that testing.

The micropatch does not require a reboot. As before the patch does not need to be uninstalled once you later install the update from Microsoft.

At this time, it is assumed that Microsoft will issue a patch for these vulnerabilities in February but they may be more complex (similar to the previous JET vulnerability) and require further time to refine the fixes.

Thank you.

=======================
Original Post:
=======================
In the 3rd week of December; a security researcher using the name SandboxEscaper (who we have discussed twice before on this blog) announced a 3rd zero-day (defined) vulnerability followed by a 4th on the 30th of December.

For the 3rd vulnerability: Windows 7 and Windows 10 are confirmed as impacted. Windows 8.1 may also be vulnerable. For the 4th vulnerability; Windows 10 Version 1803 (Build 17134) has been confirmed as impacted (it’s unknown if newer builds of Window 10 or if Windows 7/8.1 are vulnerable).

How severe are these vulnerabilities and what is their impact?
I’ll break these into 2 sections:

=======================
Vulnerability 3:
Arbitrary file read issue: Uses MsiAdvertiseProduct:
=======================
From the limited information available this vulnerability does not appear to be remotely exploitable. The attacker would already need to have compromised an account on your Windows system in order to run the necessary proof of concept code. This vulnerability should be considered medium but not critical severity. When exploited it can allow an attacker to read/copy any files they choose using the permissions from the Windows Installer Service namely LocalSystem privileges (the highest level of privilege)(defined). The vulnerability makes use of a time to check to time to use (TOCTOU) race condition type.

In the same manner as the previous vulnerabilities it may be leveraged in the wild before it is patched by Microsoft; this is my reason for advising exercising caution with email and clicking unexpected links (within emails, links within IM clients or social networks). Security researcher Will Dormann found this exploit inconsistent when used. Meanwhile Acros Security CEO Mitja Kolsek stated It was very likely a micropatch for this exploit would be available before the holiday period.

=======================
Vulnerability 4:
Arbitrary file overwrite issue: Proof of concept overwrites pci.sys
=======================
As above; this vulnerability does not appear to be remotely exploitable. The attacker would already need to have compromised an account on your Windows system in order to run the necessary proof of concept code. This vulnerability should be considered medium but not critical severity. When exploited it can allow an attacker to overwrite pci.sys with information about software and hardware problems, collected through the Windows Error Reporting (WER) but the attacker can also influence what data is used to overwrite the original file. The vulnerability again makes use of a race condition which means that the exploit doesn’t always provide the attacker with the intended result. This is especially true for systems with a single CPU core.

However; the choice of pci.sys for the proof of concept was an example; any file could be used (confirmed by Will Dormann).

How can I protect my organization/myself from these vulnerabilities?
The same advice issued for the first two zero day disclosures again applies here. This US-CERT advisory also provides advice for safely handling emails.

If you wish to deploy the micropatch from the firm 0patch; please test how well it works in your environment thoroughly BEFORE deployment in your production environment.

It can be obtained by installing and registering 0patch Agent from https://0patch.com Such micropatches usually install and need no further action when Microsoft officially patches the vulnerability since the micropatch is only active when a vulnerable version of the affected file is used; once patched the micropatch has no further effect (it is then unnecessary).

Thank you.

PortSmash Vulnerability: What you need to know

Security researchers have released details of a new side channel attack known as “PortSmash” that can be used to steal information from processes running inside a computer systems CPU (defined)) when Intel Hyperthreading (HT)(defined here and here) is enabled. Their proof of concept allowed them to steal a private decryption from a thread running in the same core as their exploit. This thread belonged to an OpenSSL process.

How severe is this vulnerability?
It has been designated as CVE-2018-5407 and assigned a base score of 4.8 (medium severity) on the CVSS v3 scale (defined) with a high attack complexity and with only low privileges required. The attack cannot be exploited remotely. An attacker must have been able to compromise your system via another means most likely a phishing email (social engineering)(phishing: defined; social engineering: defined), accidentally clicking a malicious link or a drive by download (defined). The attacker will also still need to have their code running within the same core as the data/code they wish to obtain. Similar to Spectre; multi-tenant cloud environments are more at risk.

Red Hat’s security advisory states “In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process”. PortSmash is fundamentally different from Meltdown and Spectre vulnerabilities; it does not rely on speculative execution.

Collin Percival, a Computer Scientist summed up the attack as follows:

“I’ve been getting a few questions about the recent “PortSmash” vulnerability announcement. Short answer: This is not something you need to worry about. If your code is vulnerable to it, you were already vulnerable to other (easier) attacks.

He advises that users don’t need to worry about it and states: “the defence against microarchitectural side channel attacks from 2005: Make sure that the cryptographic key you’re using does not affect the sequence of instructions or memory accesses performed by your code”.

How does this vulnerability work?
When a thread (defined) is carrying out some work it has its own instructions (what to do) and data (the objects to work on) but it will share some of its hardware resources with another process operating on a collocated thread.

The attackers can obtain information about the decryption key by analysing how fast the (process) thread within the CPU is operating with particular assembly language (defined) instructions and uses that information to work backwards (reverse engineering) on what possible data was used as the input to achieve this data now being processed. In this case the data is a private decryption key (defined).

Explained another way: This attack uses instruction timing (how long it takes to process) based on port contention. Each core of a CPU has physical regions known as ports which carry out the necessary calculations. If two or more threads are processing at the same they may have to wait on each other to use those regions of the CPU.

PortSmash seeks to monopolise a port which is being shared with a thread with information the attack wishes to obtain. They can measure the time taken between instructions of the attackers thread and the legitimate thread (thus determining how long the legitimate thread spend processing). This will help to obtain the data being processed over a long period of time

PortSmash is a side channel attack meaning that the attacker doesn’t immediately find out the protected/secret value immediately; instead the attack seeks out information from the other thread running within the CPU for information on the secret value being processed.

The proof of concept code targeted OpenSSL but is not limited to just that software. OpenSSL was targeted due to the researcher’s familiarity with the OpenSSL code.

What CPUs are affected by this vulnerability?
The researchers verified that this vulnerability is present on Intel Skylake CPUs (6th generation Core models e.g. i7 6700K). However any Intel CPU which implements HT is likely to have this vulnerability. Intel’s Nehalem architecture first introduced HT in 2008. The researchers believe AMD Ryzen CPUs may be affected but did not confirm this.

How can I protect myself from this vulnerability?
OpenSSL have added a fix to version 1.1.1 and older versions greater than version 1.1.0i (Source)

However the only true means of mitigating this vulnerability for all software is to disable Intel’s HT. The operating system distribution OpenBSD has done so since June this year. Similarly Intel within their new 9th generation Core CPUs disabled HT to enable hardware protections against the Meltdown, Spectre and L1 Terminal Fault vulnerabilities. They did so to their gaming focused CPUs since many games don’t leverage HT and thus don’t suffer a performance penalty from not using it. It doesn’t appear that HT was removed for security concerns since the Core i9 9900K still features it.

Since corporate organizations may have invested in software that uses HT; they should only consider turning it off if continuing to use it places them at a high risk of exploitation and would place them outside of what they consider an acceptable risk. They will then need to consider the performance/security trade-off of doing so.

If you use Intel HT I would recommend testing your own software with this feature turned off to tell if it has too much of a performance penalty for your particular use cases. From researching this it is not a straightforward answer of turning it off and definitely not experiencing any slowdown; it may or may not happen depending on how you use your system and the software you use.

I have provided links to definitions of HT above and some references below which may assist you in making a decision to disable or leave it enabled. That research also pointed out that if you wish to disable HT; please do so from the BIOS (defined) of your computing system since it will have a blanket disablement across all software and your operating system. A software disablement can work but disabling via the BIOS leaves less room for error. Please refer to your system manufacturer or motherboard user guide for the steps to enter the BIOS of the system and disable this feature.

As more details of this vulnerability emerge I will consider disabling this feature on my water cooled Intel Core i9 7980XE CPU. Windows detects it with 36 logical cores; with HT disabled it will “drop” to 18 physical cores. I’ll need to evaluate the performance impact (if any) for my particular use cases. Given the attacker will need to already have compromised my system and the attack is of high complexity; it’s less likely I will need to disable HT. My existing security controls are more than enough to mitigate this risk; but your system, configuration and risk appetite may be different.

Thank you.

==============

References:

Why You Disable Hyper-Threading or NOT, and How to Know the Difference

https://bitsum.com/tips-and-tweaks/why-you-should-not-disable-hyper-threading-or-why-you-should/

Nehalem – Everything You Need to Know about Intel’s New Architecture

Source: https://www.anandtech.com/show/2594/8

 

Performance-impact of Hyper-Threading:

https://superuser.com/questions/1166529/performance-impact-of-hyper-threading

 

Is Hyper-Threading a Fundamental Security Risk?

https://www.extremetech.com/computing/276138-is-hyper-threading-a-fundamental-security-risk

Why does disabling hyperthreading supposedly give better gaming performance? (This is again a gaming focused discussion but would be relevant for software that does not use HT):

https://www.reddit.com/r/pcgaming/comments/2hti6m/why_does_disabling_hyperthreading_supposedly_give/

 

Why on earth would you disable Hyperthreading? (This is a more gaming focused discussion but would be relevant for software that does not use HT. Please ignore the advert spam posts for software named CPUCores, it’s confirmedsnake oil”):

https://steamcommunity.com/app/384300/discussions/0/530646080862961117/

==============