Security researcher Travis Goodspeed has detailed a device which emulates USB device firmware update (DFU) mode to help reverse engineer firmware and deliver exploits.
Speaking at the BreakPoint conference in Melbourne last week, Goodspeed also revealed plans for a mass storage device capable of evading forensic analysis.
He detailed how the FaceDancer device could be used to intercept USB firmware — its primary use during Goodspeed's work.
“By emulating the USB device firmware update protocol I can pretend to be any version of the device and then catch the update as it is installed,” Goodspeed said.
 |
“If you have the real hardware, you have one shot in which to sniff [firmware updates] because it will only send firmware across if it’s out of date.”
FaceDancer extended GoodSpeed's GoodFET framework to allow for fast prototyping and fuzzing of USB device drivers.
It also revealed a host of “ugly” bugs within USB protocols which were caused because USB protocols were never designed to withstand attacks.
“When you start interacting with these devices you [see] absurd design decisions because nothing malicious was ever meant to touch the USB," he said.
"These networks are everywhere: SCSI for Ethernet, Firewire, USB and SD card. All of these are great ways to attack the kernel."
Goodspeed told delegates that looking at USB protocols provides access to an overlooked attack surface which is "a great way of finding mountains of zero-day [flaws]".
One side of FaceDancer allows a USB emulator to be written on a PC using Python and be connected via the opposite side to a target machine which would 'see' the USB device.
That it is written on a PC rather than on a virtualised machine or as a standalone device like previous efforts grants the user more RAM and code storage along with logging.
Goodspeed will also in December release a mass storage emulator which actively detects when it is being forensically analysed “and then fights back”.
“If you ever see a file being read before the metadata describing that data, then you’re being forensically analysed”.
FaceDancer could be purchased online but buyers are warned that Customs has a habit of seizing some shipments.
