4 ms·

"Among them was the apparent assumption that a computer mouse can carry a virus." Hypothetically, this is true -- if you disassemble the right kind of mouse, p

by cbhl 13y ago

"Among them was the apparent assumption that a computer mouse can carry a virus." Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. But surely you could simply test the hardware with a known good installation (say, off a Live CD) to figure out if that was the case?

mindcrime 13y ago
Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. It's not hypothetical. A friend of mine has created an USB based pen-test tool based on this very idea. The early prototype idea was to open up a mouse, splice a USB hub into the USB connection, then attach an "Arduino like" Teensy[1] to it such that, when the mouse was connected, in addition to the mouse being detected and registered by the host machine, it would also detect and install a new keyboard. The Teensy could then dump it's payload as anything that could be typed on a physical keyboard (subject to the memory limitations of the board). He's now doing a Kickstarter campaign to manufacture and sell the things, which he calls The Glitch[2]. You can see pictures on the Kickstarter page, of the Glitch embedded in a generic mouse. [1]: http://www.pjrc.com/teensy/ http://www.pjrc.com/teensy/ [2]: http://www.kickstarter.com/projects/1186217328/the-glitch http://www.kickstarter.com/projects/1186217328/the-glitch
- dmix 13y ago
  Fascinating. How hard would this part be? > But surely you could simply test the hardware Scanning system devices would reveal it pretty quickly if it's just an additional USB device.
  - mindcrime 13y ago
    Yes, if you took the time to connect each mouse to a machine and see what devices it detects, it would be readily apparent that a mouse loaded with a Glitch was doing something funny. And, as far as that goes, a really observant user might notice something weird going on when it's first connected. But most users aren't terribly observant, or at least that's the assumption.
    - mcpherrinm 13y ago
      A slightly cleverer device could get even better. If it only enumerated as the "evil" device (whatever it is) after several minutes or even hours after some amount of activity followed by inactivity, then it would be quite likely the user isn't at their PC to notice any messages from their operating system, suspicious behaviour, or other warning signs. Someone attempting to scan hundreds of mice for malicious ones would have an even worse time: Because it waits until the user appears to be using the mouse, simply plugging them into a test computer won't immediately reveal the evil. This can be taken further, including fingerprinting the host operating system, time of day, or any other number of factors.
    - rmc 13y ago
      Even that's not guaranteed. You could just have the mouse wait 1 hr before doing nasty-keyboard-mode. Or only go into nasty-keyboard-mode after certain amount of button presses etc. It's an arms race.
- rdl 13y ago
  I don't think you actually need to do the keyboard thing. You should be able to use "accessibility" features to bring up a soft keyboard (or just cut and paste from known things) to run the entire attack as a normal-appearing HID mouse, which just happens to be evil. No need to reconnect via a hub; you could do the whole thing within a mouse controller. Bonus points if you can manage to fit all the logic in the same processor/memory the thing includes by default, or something which looks like the same physical package and thus passes a non-destructive open-device analysis. (which is kind of terrifying if you think about it; almost no one checks the provenance of "dumb" devices like mice. Keyboards sometimes get a tiny bit more scrutiny due to hardware keyloggers inside inline, but that's about it.) The ultimate solution is a trusted supply chain and equipment which is tamper-evident, non-counterfeitable, and which can securely attest to intactness and provenance; x9.9 pinpads and hsms. But no one does that for general purpose hardware.
  - akira2501 13y ago
    Except the mouse doesn't know exactly where it is on the screen, or how it's concept of CPI (counts per inch) relates to pixels on the screen.
    - rdl 13y ago
      That's a pain, but I think I could work around it by observing the human's use of the mouse for a while; there are some known actions (let's restrict to Windows), like clicking on start menu and some other stuff. By watching and calibrating, you could get a good idea what to do. You also might know a lot about the target environment; maybe they have totally standardized configurations including mouse speed, display size, etc. The environment I'm thinking about is something like a SCADA control system for, say, a centrifuge cascade :)
- sebastianmck 13y ago
  Sounds like http://hakshop.myshopify.com/products/usb-rubber-ducky http://hakshop.myshopify.com/products/usb-rubber-ducky
patio11 13y ago
Some mice have user-upgradeable firmware. If you plug one of them into a system and the adversary roots the system, you should assume any other system you plug that mouse into is rooted. Given the prevailing prices for mice and for computer vulnerability researchers, I'd thing buying a new mouse is orders of magnitude cheaper than verifying that a suspect mouse does not contain a threat.
cnvogel 13y ago
For the simple case (wire up an additional USB hub and a USB-flash-drive into the mouse body) that's easily done (under Linux, lsusb would suffice). But if you allow arbitrarily complex logic to be present which only activates additional functionality on the presence of an arbitrarily complex trigger, you can no longer proove the existence of this additional logic. As an example: Maybe my microcontroller passively watches the mouse, and only activates the payload (routes the mouse signals through the USB hub and activates the flash-drive) after a complex sequence of mouse-moves and clicks have been performed? The trigger might be to monkey-train the unsuspecting user with a specifically crafted flash-game on a frequently visited website.

by cbhl 13y ago

mindcrime 13y ago

Hypothetically, this is true -- if you disassemble the right kind of mouse, put in a USB hub and a USB flash drive with malware. It's not hypothetical. A friend of mine has created an USB based pen-test tool based on this very idea. The early prototype idea was to open up a mouse, splice a USB hub into the USB connection, then attach an "Arduino like" Teensy[1] to it such that, when the mouse was connected, in addition to the mouse being detected and registered by the host machine, it would also detect and install a new keyboard. The Teensy could then dump it's payload as anything that could be typed on a physical keyboard (subject to the memory limitations of the board). He's now doing a Kickstarter campaign to manufacture and sell the things, which he calls The Glitch[2]. You can see pictures on the Kickstarter page, of the Glitch embedded in a generic mouse. [1]: http://www.pjrc.com/teensy/ http://www.pjrc.com/teensy/ [2]: http://www.kickstarter.com/projects/1186217328/the-glitch http://www.kickstarter.com/projects/1186217328/the-glitch

dmix 13y ago
Fascinating. How hard would this part be? > But surely you could simply test the hardware Scanning system devices would reveal it pretty quickly if it's just an additional USB device.
- mindcrime 13y ago
  Yes, if you took the time to connect each mouse to a machine and see what devices it detects, it would be readily apparent that a mouse loaded with a Glitch was doing something funny. And, as far as that goes, a really observant user might notice something weird going on when it's first connected. But most users aren't terribly observant, or at least that's the assumption.
  - mcpherrinm 13y ago
    A slightly cleverer device could get even better. If it only enumerated as the "evil" device (whatever it is) after several minutes or even hours after some amount of activity followed by inactivity, then it would be quite likely the user isn't at their PC to notice any messages from their operating system, suspicious behaviour, or other warning signs. Someone attempting to scan hundreds of mice for malicious ones would have an even worse time: Because it waits until the user appears to be using the mouse, simply plugging them into a test computer won't immediately reveal the evil. This can be taken further, including fingerprinting the host operating system, time of day, or any other number of factors.
  - rmc 13y ago
    Even that's not guaranteed. You could just have the mouse wait 1 hr before doing nasty-keyboard-mode. Or only go into nasty-keyboard-mode after certain amount of button presses etc. It's an arms race.
rdl 13y ago
I don't think you actually need to do the keyboard thing. You should be able to use "accessibility" features to bring up a soft keyboard (or just cut and paste from known things) to run the entire attack as a normal-appearing HID mouse, which just happens to be evil. No need to reconnect via a hub; you could do the whole thing within a mouse controller. Bonus points if you can manage to fit all the logic in the same processor/memory the thing includes by default, or something which looks like the same physical package and thus passes a non-destructive open-device analysis. (which is kind of terrifying if you think about it; almost no one checks the provenance of "dumb" devices like mice. Keyboards sometimes get a tiny bit more scrutiny due to hardware keyloggers inside inline, but that's about it.) The ultimate solution is a trusted supply chain and equipment which is tamper-evident, non-counterfeitable, and which can securely attest to intactness and provenance; x9.9 pinpads and hsms. But no one does that for general purpose hardware.
- akira2501 13y ago
  Except the mouse doesn't know exactly where it is on the screen, or how it's concept of CPI (counts per inch) relates to pixels on the screen.
  - rdl 13y ago
    That's a pain, but I think I could work around it by observing the human's use of the mouse for a while; there are some known actions (let's restrict to Windows), like clicking on start menu and some other stuff. By watching and calibrating, you could get a good idea what to do. You also might know a lot about the target environment; maybe they have totally standardized configurations including mouse speed, display size, etc. The environment I'm thinking about is something like a SCADA control system for, say, a centrifuge cascade :)
sebastianmck 13y ago
Sounds like http://hakshop.myshopify.com/products/usb-rubber-ducky http://hakshop.myshopify.com/products/usb-rubber-ducky

patio11 13y ago

Some mice have user-upgradeable firmware. If you plug one of them into a system and the adversary roots the system, you should assume any other system you plug that mouse into is rooted. Given the prevailing prices for mice and for computer vulnerability researchers, I'd thing buying a new mouse is orders of magnitude cheaper than verifying that a suspect mouse does not contain a threat.

cnvogel 13y ago

For the simple case (wire up an additional USB hub and a USB-flash-drive into the mouse body) that's easily done (under Linux, lsusb would suffice). But if you allow arbitrarily complex logic to be present which only activates additional functionality on the presence of an arbitrarily complex trigger, you can no longer proove the existence of this additional logic. As an example: Maybe my microcontroller passively watches the mouse, and only activates the payload (routes the mouse signals through the USB hub and activates the flash-drive) after a complex sequence of mouse-moves and clicks have been performed? The trigger might be to monkey-train the unsuspecting user with a specifically crafted flash-game on a frequently visited website.