Exploiting Smart-Phone USB Connectivity For Fun and Profit: Angelos Stavrou & Zhaohui Wang!
Exploiting Smart-Phone USB Connectivity For Fun and Profit: Angelos Stavrou & Zhaohui Wang!
Exploiting Smart-Phone USB Connectivity For Fun and Profit: Angelos Stavrou & Zhaohui Wang!
Phone-‐to-‐Computer A2ack
Computer-‐to-‐Phone A2ack
Phone-‐to-‐Phone A2ack
Multi-purpose Usage!
Charging the Device Battery!
Data & Media Transfer!
Control external Devices (new capability)!
!
USB-borne Threats only focused on Auto-Mounting !
USB-borne Threats are much more complex… !
USB
Storage
is
just
the
Lp
of
the
iceberg
and
it
is
usually
locked-‐down
and
scanned
by
anL-‐virus
and
other
defenses
USB
Human
Interface
Devices
(HIDs)
are
one
class
of
devices
that
are
*much*
more
appealing
Keyboard/Mouse/???
on
your
Android
Phone
JoysLc(!)
Phone-to-Computer Attacks!
• Program the Phone with USB Gadget API for Linux
• Pretend to be a USB Human Interface Driver,
Dell USB keyboard, VendorID=413C,ProductID=2105!
Touchpad or Mouse!
Kernel manipulation!
Rootkits!
Data Exfiltration!
Operating System
USB Gadget
Observations
Single adb/umass
interface bus reset
USB Background: Hierarchical Topology!
USB: Series of Events (Overview)!
Interrupt notifying the host that a
device connected
G et D
e
Descr vice
iptor
, The
The host send Get Device
d , V e ndorID l peripheral
Descriptor setup request Spee tID, Seria identifies
c
Produ nufacture itself
a
No., M
G et C The peripheral
The host setup kernel data onfigu supply the
ration
structures of the device configuration, can
descriptor SB be dynamically
-s to ra ge , U changed in smart
Mass her etc.
et gadget
G e t In
te
The host continues enumerate all Descr rface The peripheral
iptor
the interfaces specify interface
, information
fa c e Class
nte r ol
USB I ass, Protoc
Subc l
The host sets up endpoints for
every interface
G et D
e
Descr vice
iptor
The
peripheral
identifies
itself
G et D
e
Descr vice
iptor
, The
The host send Get Device
d , V e ndorID l peripheral
Descriptor setup request Spee tID, Seria identifies
c
Produ nufacture itself
a
No., M
G et D
e
Descr vice
iptor
, The
The host send Get Device
d , V e ndorID l peripheral
Descriptor setup request Spee tID, Seria identifies
c
Produ nufacture itself
a
No., M
G et C The peripheral
onfigu supply the
ration
configuration, can
be dynamically
changed in smart
gadget
G et D
e
Descr vice
iptor
, The
The host send Get Device
d , V e ndorID l peripheral
Descriptor setup request Spee tID, Seria identifies
c
Produ nufacture itself
a
No., M
G et C The peripheral
The host setup kernel data onfigu supply the
ration
structures of the device configuration, can
descriptor SB be dynamically
-s to rage, U changed in smart
Mass her etc.
et gadget
G et D
e
Descr vice
iptor
, The
The host send Get Device
d , V e ndorID l peripheral
Descriptor setup request Spee tID, Seria identifies
c
Produ nufacture itself
a
No., M
G et C The peripheral
The host setup kernel data onfigu supply the
ration
structures of the device configuration, can
descriptor SB be dynamically
-s to rage, U changed in smart
Mass her etc.
et gadget
Get In
te
Descr rface The peripheral
iptor
specify interface
information
G et D
e
Descr vice
iptor
, The
The host send Get Device
d , V e ndorID l peripheral
Descriptor setup request Spee tID, Seria identifies
c
Produ nufacture itself
a
No., M
G et C The peripheral
The host setup kernel data onfigu supply the
ration
structures of the device configuration, can
descriptor SB be dynamically
-s to rage, U changed in smart
Mass her etc.
et gadget
Get In
te
The host continues enumerate all Descr rface The peripheral
iptor
the interfaces specify interface
, information
fa c e Class
nte r ol
USB I ass, Protoc
Subc l
G et D
e
Descr vice
iptor
, The
The host send Get Device
d , V e ndorID l peripheral
Descriptor setup request Spee tID, Seria identifies
c
Produ nufacture itself
a
No., M
G et C The peripheral
The host setup kernel data onfigu supply the
ration
structures of the device configuration, can
descriptor SB be dynamically
-s to rage, U changed in smart
Mass her etc.
et gadget
Get In
te
The host continues enumerate all Descr rface The peripheral
iptor
the interfaces specify interface
, information
fa c e Class
nte r ol
USB I ass, Protoc
Subc l
The host sets up endpoints for
every interface
G et D
e
Descr vice
iptor
, The
The host send Get Device
d , V e ndorID l peripheral
Descriptor setup request Spee tID, Seria identifies
c
Produ nufacture itself
a
No., M
G et C The peripheral
The host setup kernel data onfigu supply the
ration
structures of the device configuration, can
descriptor SB be dynamically
-s to ra ge , U changed in smart
Mass her etc.
et gadget
G e t In
te
The host continues enumerate all Descr rface The peripheral
iptor
the interfaces specify interface
, information
fa c e Class
nte r ol
USB I ass, Protoc
Subc l
The host sets up endpoints for
every interface
Device!
Configuration!
Interface!
Endpoint!
Data Exfiltration!