5 ms·

BadBarcode: Start a shell by scanning a boarding pass

15 points by ProZsolt 11y ago

ProZsolt 11y ago
Demo: https://twitter.com/tombkeeper/status/664723564717715456 https://twitter.com/tombkeeper/status/664723564717715456
dang 11y ago
We changed the URL from http://www.slideshare.net/PacSecJP/hyperchem-ma-badbarcode-en1109nocommentfinal http://www.slideshare.net/PacSecJP/hyperchem-ma-badbarcode-e... which appears not to render correctly.
slaesche 11y ago
What is special about this?
- voltagex_ 11y ago
  >“General speaking, we can make [a barcode scanner] to 'type' any keys to the host system, not only the 0-9 and a-z,” Yu said. He claims this lets someone create a boarding pass to “execute any command on computer.” At a guess, they encoded Win+R cmd <enter> into a barcode. It's a neat trick with big potential.
  - slaesche 11y ago
    I'm still confused. This seems completely trivial.
    - downer70 11y ago
      The point being that it assuredly is trivial, but also potentially a gaping hole left open across a wide array of software. In these sorts of situations, as with the Y2K bug, the problem is more often the product of social circumstances than technical circumstances. Nonetheless, this doesn't prevent technical adversaries from preying upon the flaw, and taking advantage of social patterns of behavior, such as the casual tendency to presume barcodes are intrinsically safe.
- brent_maxwell 11y ago
  Agreed. I used to work in a library, and was able to do something similar with our scanners. The only thing "new" might be the recognition of being able to pass "alt-?" key combos through PDF-417 barcodes, which are becoming more and more ubiquitous, while the scanners still just pretend to be keyboards.
paulasmuth 11y ago
Am is missing something or is the presented "attack" really trivial? They use a barcode scanner connected as a virtual keyboard to directly enter keystrokes into the windows shell - I imagine the barcode simply reads "CTRL, T, S, O, M, E, C, O, M, M, A, N, D". It's not surprising that it works to me -- I think it's the intended behaviour. The article suggests the fact that barcodes can contain arbitrary (non-printable) ascii characters is the discovery of a new vulnerability which can be used to attack a large number of real-world POS/airport check-in systems, but doesn't give a single example or proof for that. This seems like complete speculation on the presence of input handling bugs in systems connected to barcode scanners presented as a fact.
- voltagex_ 11y ago
  How do you know that FooBar (TM) Barcode Scanner isn't presenting as a HID to the underlying system? The keyboard's not accessible so the kiosk mode probably isn't protected against alt-F4, ctrl-alt-delete etc.
  - paulasmuth 11y ago
    I could only speculate how specific applications (e.g. at airports) are built. However, if some specific vendor was susceptible to this attack, it would just be a stupid, obvious and easily fixable input handling bug in their product. But the linked article doesn't even demonstrate such an attack against an actual application ("BadBarcode is not a vulnerability of a certain product"). Just a trivial "demo" where they use a virtual keyboard device to enter commands directly into a windows shell and then get excited that it works...
    - voltagex_ 11y ago
      Well yes, but it's a new application of a HID attack, and it's nicely wrapped up for the media/public (who just got done watching CSI Cyber and Mr Robot) Also, just because it's trivial doesn't mean it'll get patched quickly (wasn't it France's airports that were still running Windows 3.11?) or even be acknowledged by the vendor. I'd try this on my local self-serve supermarket checkout if I were feeling brave...
ProZsolt 11y ago
Defcon presentation about barcodes: https://www.youtube.com/watch?v=qT_gwl1drhc https://www.youtube.com/watch?v=qT_gwl1drhc

15 points by ProZsolt 11y ago

Demo: https://twitter.com/tombkeeper/status/664723564717715456 https://twitter.com/tombkeeper/status/664723564717715456

dang 11y ago

We changed the URL from http://www.slideshare.net/PacSecJP/hyperchem-ma-badbarcode-en1109nocommentfinal http://www.slideshare.net/PacSecJP/hyperchem-ma-badbarcode-e... which appears not to render correctly.

slaesche 11y ago

What is special about this?

voltagex_ 11y ago
>“General speaking, we can make [a barcode scanner] to 'type' any keys to the host system, not only the 0-9 and a-z,” Yu said. He claims this lets someone create a boarding pass to “execute any command on computer.” At a guess, they encoded Win+R cmd <enter> into a barcode. It's a neat trick with big potential.
- slaesche 11y ago
  I'm still confused. This seems completely trivial.
  - downer70 11y ago
    The point being that it assuredly is trivial, but also potentially a gaping hole left open across a wide array of software. In these sorts of situations, as with the Y2K bug, the problem is more often the product of social circumstances than technical circumstances. Nonetheless, this doesn't prevent technical adversaries from preying upon the flaw, and taking advantage of social patterns of behavior, such as the casual tendency to presume barcodes are intrinsically safe.
brent_maxwell 11y ago
Agreed. I used to work in a library, and was able to do something similar with our scanners. The only thing "new" might be the recognition of being able to pass "alt-?" key combos through PDF-417 barcodes, which are becoming more and more ubiquitous, while the scanners still just pretend to be keyboards.

paulasmuth 11y ago

Am is missing something or is the presented "attack" really trivial? They use a barcode scanner connected as a virtual keyboard to directly enter keystrokes into the windows shell - I imagine the barcode simply reads "CTRL, T, S, O, M, E, C, O, M, M, A, N, D". It's not surprising that it works to me -- I think it's the intended behaviour. The article suggests the fact that barcodes can contain arbitrary (non-printable) ascii characters is the discovery of a new vulnerability which can be used to attack a large number of real-world POS/airport check-in systems, but doesn't give a single example or proof for that. This seems like complete speculation on the presence of input handling bugs in systems connected to barcode scanners presented as a fact.

voltagex_ 11y ago
How do you know that FooBar (TM) Barcode Scanner isn't presenting as a HID to the underlying system? The keyboard's not accessible so the kiosk mode probably isn't protected against alt-F4, ctrl-alt-delete etc.
- paulasmuth 11y ago
  I could only speculate how specific applications (e.g. at airports) are built. However, if some specific vendor was susceptible to this attack, it would just be a stupid, obvious and easily fixable input handling bug in their product. But the linked article doesn't even demonstrate such an attack against an actual application ("BadBarcode is not a vulnerability of a certain product"). Just a trivial "demo" where they use a virtual keyboard device to enter commands directly into a windows shell and then get excited that it works...
  - voltagex_ 11y ago
    Well yes, but it's a new application of a HID attack, and it's nicely wrapped up for the media/public (who just got done watching CSI Cyber and Mr Robot) Also, just because it's trivial doesn't mean it'll get patched quickly (wasn't it France's airports that were still running Windows 3.11?) or even be acknowledged by the vendor. I'd try this on my local self-serve supermarket checkout if I were feeling brave...

ProZsolt 11y ago

Defcon presentation about barcodes: https://www.youtube.com/watch?v=qT_gwl1drhc https://www.youtube.com/watch?v=qT_gwl1drhc