Although embedded hardware hacking seems to be an out-of-date technique, it is still dangerous and effective. I created a project called “IRON-HID” – a platform for security validation that can create various types of USB devices such as HID (Human Interface Device) type, mass-storage type, and vendor-specific type. The IRON-HID contains installable software that enables you to gain full control of the target machine. You can then perform whatever actions you want on the target device via an Android smartphone application (IRON-HID Commander application).
I designed the IRON-HID platform for pen-testing using open-source hardware. IRON-HID has many functions including:
– Small form-factor and communicates with an Android application.
– Emulate a CD-ROM, so it can install a trojan without a network connection
– Hook into a user’s keyboard event and send keystrokes to the attacker
– Perform screen captures of the target device
– Receive input from pen-tester via the Android application and send it to the target machine
I created “PowerShock” to show the potential uses of the “IRON-HID” platform. PowerShock looks like a portable charger and works as you would expect. You can charge your smartphone with it and recharge it with PC. However, when you plug it to your Android smartphone or PC, PowerShock will crack your device password or send important information from your PC to an attacker. I will also show other examples of installing IRON-HID into existing hardware such as USB card readers (ReaderShock) and keyboards (KeyboardShock).
