Demonstrating Malicious USB Devices: Keyloggers and Hidden Webcams

Adam Savage’s Tested

Introduction to Malicious Hardware [0:00] [Image 0]

• Adam Savage and the ThreatLocker team explore malicious devices hidden in plain sight.
  • They highlight how innocent-looking hardware can be compromised to steal data or spy on users.
  • This follows a previous discussion on the threat vector of USB drives.

The O.M.G. Cable: A Malicious Charging Cable [0:44] [Image 4]

• Description and Hidden Capabilities:
  • The O.M.G. cable appears to be a standard phone charging cable [0:46] [Image 5].
  • It contains a Wi-Fi antenna and a keyboard built into the cable itself [1:02] [Image 7].
• Functionality and Security Risks:
  • The cable can perform almost any action on a connected computer as if a user were physically present.
  • It can remotely capture keystrokes and access cameras.
  • The cable functions normally as a charger, making it indistinguishable from a legitimate one.
  • This poses a significant threat if a legitimate cable is swapped with a malicious one.
• Personal Security Practice:
  • Adam Savage shares his practice of only using his own charging cable, recognizing the risk.

Malicious USB Keyboard Demonstration [1:54] [Image 2]

• Description and Capabilities:
  • A standard-looking USB keyboard is introduced [1:54] [Image 1].
  • It has a wireless antenna built into its cable, allowing remote access.
  • When plugged into a computer, it can log all keystrokes.
• Remote Keylogging Demonstration [3:47]
  • A "hacker PC" connects to the malicious keyboard via Wi-Fi.
  • As text is typed on the target PC's notepad, the keystrokes are displayed in real-time on the hacker's web interface [3:57] [Image 12].
• Business Implications:
  • This demonstrates a major risk for IT departments who typically restrict employees from bringing in personal hardware.
  • A sophisticated attacker might intercept a delivery and replace a new keyboard with a compromised one.

Cybersecurity: The Zero Trust Approach [4:07] [Image 13]

• Fundamental Principle:
  • Security must assume that the user will inevitably be compromised (e.g., provide a password, plug in a malicious device).
  • Therefore, the focus shifts to limiting what a compromised entity can do.
• Layered Security and Validations:
  • It's crucial to validate both the computer and the phone for multi-factor authentication.
  • Knowing a password alone should not be enough to gain access.
  • Businesses should implement checks and balances, validating all updates and reviewing code changes with multiple departments.
• Eliminating Unnecessary Privileges:
  • Systems should be configured to prevent unexpected behavior (e.g., PowerShell reaching out to the internet).
  • The goal is to remove the "human element" as much as possible by eliminating unnecessary choices and access.

Remote Webcam Access via Compromised Cable [7:00] [Image 19]

• Demonstration Setup:
  • The malicious keyboard is replaced with a webcam connected to the laptop via a malicious USB cable [8:14] [Image 23].
• Remote Activation and Recording [8:14]
  • The hacker remotely sends a payload to activate the webcam [8:09] [Image 21].
  • The webcam records video without any indicator light, making it covert.
  • The recorded video (showing Adam Savage) is uploaded every 10 seconds to a Google storage bucket, accessible by the hacker [8:26] [Image 24].
• Vulnerability in Specific Environments:
  • This type of attack is particularly effective in places like hospitals, where computers are often left unattended and contain sensitive patient data, increasing the likelihood of ransom payments.

The Growing Threat of Cybercrime [10:04] [Image 30]

• Escalating Costs and Targets:
  • Cybercrime costs are estimated at 1.5 trillion dollars and are continuously rising.
  • Smaller companies, like a tire repair shop, are increasingly targeted with ransomware because they often lack robust security and are perceived as more likely to pay.
• Attacker Tactics:
  • Hackers research target companies to find out their financial information, including cyber insurance policies, to determine appropriate ransom demands.
• Individual Vulnerability:
  • Individuals often have little control over how businesses (car dealerships, hospitals) process and store their personal data.
  • It is advisable for individuals to lock their credit reports and be aware that their personal information is likely already compromised in some way.
• Internal Threats:
  • Even with regular training, employees can still fall victim to phishing attacks.
  • Security measures must account for internal human error, limiting access to only what is strictly necessary.