TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

USBdriveby – Exploiting USB in Style

100 pointsby jonathanmarvensover 10 years ago

11 comments

lsiebertover 10 years ago
I recently got a teensy 2.0 for rooting my chromecast, (which it does, roughly by appearing to chain 32 usb hubs, better description at <a href="https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt2.html" rel="nofollow">https:&#x2F;&#x2F;fail0verflow.com&#x2F;blog&#x2F;2014&#x2F;hubcap-chromecast-root-pt...</a> )<p>They are nifty little dev boards, as you can pretend to be a variety of different devices, but the real benefit in my mind is the ease at which you can use the solder pads to build a device and connect it to usb. YOu can dump roms.<p>The teensy 3.0 is a 32 bit arm processor and has extra ram and flash memory, which is certainly an improvement over the 8 bit avr processor... that said the teensy 2.0 or 2.0++ might be better if you have arduino experience. Both are great boards to play around with, and I expect lots more exploits based around pretending to be various usb devices.
e12eover 10 years ago
&gt; &quot;In OS X, if you attempt to adjust DNS servers via networksetup -setdnsservers, it asks for a password. (...) However, if you can go into the Network settings and manually click some buttons that the system prevents you from clicking with the keyboard, you can adjust settings without a password.&quot;<p>Interesting hack, somewhat relieved to see that a) it&#x27;s for OS X, and b) it just leverages a poor design&#x2F;trade-off between security and convenience on that platform.<p>I suppose this kind of stuff is a good reason to disable sudo-session caching (or whatever it&#x27;s called) and demand an OTP for elevating privileges [on Linux].<p>Looks like windows supports OTP, but only with a dedicated server handling the authentication -- does anyone know if there&#x27;s an easy way to demand OTP for UAC elevation to local admin on a stand-alone windows 8.1 workstation?<p>[edit: for Linux&#x2F;freeBSD the libpam-oath package&#x2F;toolkit can be used to enable TOTP (Time Based One-time Passwords) that are compatible with Google Authenticator -- there are a lot of tutorials on how to use it with openssh (and with the new ability to demand a set of authentication methods, how to demand eg: both ssh-key and a TOTP). With a little familiarity with pam, it&#x27;s easy to set up for demanding OTP for sudo. AFAIK OS X also supports pam -- but if the gui allows the system to be backdoored, there&#x27;s not much point...]
评论 #8767038 未加载
评论 #8767270 未加载
Morphlingover 10 years ago
This isn&#x27;t really a new concept, but previously I&#x27;ve seen this attack used from USB memory sticks which modified firmware. The idea being that you could use them as sort of dead drop and the target would still be able to see that it&#x27;s fully functional storage device and it would still act like HID (e.g. keyboard) and execute the commands.<p>But since Teensy is a different beast, maybe there could be some new neat things you could do with it.
wyagerover 10 years ago
I have a Teensy firmware sitting around somewhere that immediately BSODs any Windows 7 machine. It&#x27;s a good trick for nerd parties.
评论 #8771393 未加载
评论 #8766558 未加载
thomasfromcdnjsover 10 years ago
Stop hacking things Samy!
davenonymousover 10 years ago
Can you actually move the mouse cursor pixel perfect using this? I would assume different mice, mouse acceleration and&#x2F;or sensitivity settings would result in the mouse cursor being not over the button.
评论 #8767861 未加载
freshfeyover 10 years ago
A bit off topic but how does one learn the skills that Samy repeatedly uses to build&#x2F;hack things like this? Any guide you could recommend?
totonyover 10 years ago
This exploit is mitigated by the fact that the keyboard&#x2F;mouse normally only have user permission (not admin)
评论 #8766436 未加载
评论 #8766272 未加载
bnewyorkover 10 years ago
New so interesting.
bnewyorkover 10 years ago
bobevans783@gmail.com any news letters.
billpgover 10 years ago
My hero!