HEELERB is a commercial name for a USB device that kills the computer you connected,
and it sends two hundred most through the data lines and it completely burns
the computers. Welcome, Everyone's the Industrial Security Podcast. My name is Nate
Nelson. I'm here with Andrew Ginter, the vice president of Industrial Security at
Waterfall Security Solutions, who's going to introduce the subjects and guest of our show
today. Andrew, how are you? I'm very well, Thank you,
Nate. Our guest today is Mario Prieto Santez. He is a solution architect
at off USB, and we're going to be looking at USB firmware attacks and
what we can do about them. These are not just you know, open
the USB drive and click on a malicious file. Oops, they got us.
These are attacks where the USB device itself is attacking us. Okay,
then let's get into it. Here's your interview with Mario. Hello Mario,
and thank you for joining us. Before we get started, can you tell
us a few words about yourself and about the good work that you're doing at
all USB. Hello Andrew, thank you for invite me. I'm Mario for
a OLDCHB. I'm appreciache engineer and I worked three years ago for OUTDSB.
I started computer science engineer and also higher technician on micro computer systems and networks
which we are focus on the cybersecurity systems to provide protect our cients. He
now on now to be we contact the clients to prevent the company to be
attacked with some different kinds of malware attacks or also hardware attacks. Thanks for
that. And you know you've used the word USB a couple of times.
I've used it a couple of times. We all, you know, vaguely
know what the USB is, especially a USB thumb drive. But we're here
talking about attacks. Why is the USB a problem? How can you attack
anybody across the USB? What? What sort of the spectrum? What's possible
bad you know, badness wise on the USB? For example, the FBI
told us to prevent us to connect something to the USB charging ports on the
airport, for example, because we can get infect our phone or our iPad
or our whatever. For example, we we can get infect connecting something to
your computer storage device apparently storage device. You connect to your computer and you
get infected, or for example, you get your device killed by by the
device. There are many many ways to to to attack your system. For
example, that killer us B is a commercial name for a use B device
that kills the computer you connected, and it sent two hundred balls through the
data lines and it completely completely burns the computer. So there are many many
ways to get infected with the electrical three, the software three, or for
example, the hardware three that start injecting code in your machine. So there
are several ways to attack your system with the USB devices. So that's interesting.
I've I've heard the word killer USB before. I thought. I thought
killer USB with software, some kind of software hack. You're telling me it's
hardware. Yeah, the killer used is a hardware device that have electrical components
built inside the apparently normal USB. So when you connect to computer, the
killer is we charged dot electrical components and then send two hundred and twenty boats
through the data lines or maybe just sixty boats through the data lines, so
it completely burns the computer. It seems like a lightning strict to your computer
that burns the power supply, but in reality is a USB that kills the
motorboard and it's used to the first lot of security and companies. You know,
I had some notion already that USBs could be dangerous. You know the
classic you leave a USB in the parking lot, someone picks it up,
brings it into their nuclear facility and it has stuck in it on it situation.
But this thing where it delivers like voltage to kill a computer is I've
never heard of anything in that ballpark. Yeah, I had surprising, you
know, I thought I understood attack techniques, but this one is new to
me. So I did some reading afterwards, and yeah, the apparently the
way it works is the device has capacitors in the USB drive. You plug
it in and it starts drawing power. I mean, USB devices can do
that. You can draw power from these interfaces, draws the power, charges
the capacitors, and then discharges the capacitors at two hundred volts and fries your
motherboard. So, and you know, these devices are commercially available, you
can buy them. They're not apparently illegal. Using them is illegal, but
the device themselves isn't illegal. In theory. Their devices that manufacturers can use
to test their motherboards and harden their motherboards. You know, in practice,
I don't know any pentester who does this. I mean, why would you
go and burn out a dozen of your client's computers. How can you do
that with with you know, without consequences? But you know, the reading
I've done online does include a caveat It says basically, don't do this at
home, kids. So has this kind of thing ever actually been pulled off
by anybody? Apparently, you know, one student did use a device like
this, burned out sixty six to zero computers at their school, videoed themselves
doing this, and went to jail for a year. Well that's nasty.
I mean I really didn't know that, Thank you. I had heard of
the charging port scenario. You know, I dimly understand what's happened in there,
but you know you're the expert on it. Can you tell us what's
happening under the hood in the airport when one of these charging ports is compromised.
The FBI told us we should not connect anything to the charging ports because
the bad guys can change the filmwork of the of the charging port. The
charging port is built with a chip set or a component that its name is
a BMS. Is that a component that controls the electricity that needs to be
sent to the device, so they can change the behavior of that chip set
to In fact, whatever is connected or for example, do you know bad
USB is is a commercial name of apparently starts device, but in reality is
a chipset that sends data to the computer. It acts like a keyboard,
but it physically is a part. It's like a normal USB. So when
you connected that but the USB to your computer, you get infected by some
script injected by uh but UH a cyber criminal. So I've heard of bad
us B before. I thought, you know, you said you could buy
it. I thought bad USB was was open source, was sort of a
demonstration of you know, for the for the penetration testers, the demonstration of
what's what's available for what's possible attack wise. Yeah, but the USB is
uh is open source. You can build your own, but you also can
buy it like started kid with some threads, some scripts that are already injected
on the one you buy from the network. So there's a lot of scripts
already on for example, githab that you just need to follow a few steps
to configure your USB in order to get for example, passwords or inject backdoor
for the system or wherever. There are already published on GitHub, so you
just need to download it. So bad USB, I mean, can you
take us a little bit deeper. What is bad USB? How does it
work? Okay, So when you can get a thundrack, a normal thundrap,
you see a normal screen with the explorer of what's inside, what is
store stored on that thundrap. But when you connect bad USB, do you
only see for example, in Windows, in Windows system, you only see
the console, the console of the system that is injecting something. But just
a few seconds, less than one second, maybe that injects something and that
is living on your on your system is a backdoor or a software that the
service that is running in your computer. You only see a black screen for
a little a little seconds, one second maybe, uh, And when it's
closed, nothing's happened. Nothing's happening, and you only see a thundraid connected,
but you don't know what is happening. There are a lot of sophisticated
but ESV with for example an electrical component then even a first connection so explorer
with the software inside. But when you connect later in the second connection,
it sends the payload, it sends the descript injected on the on the computer.
So there are sophisticate sophisticated the kinds of bad use piece not sure if
I missed some crucial bit of detail there, But it sounds like what Mario's
describing is more along the lines of the kinds of USB attacks that I'm already
aware of. Yeah, I mean the classic attack is one where there's a
nasty in the data of the USB drive. So I mean that was stucksnet.
The structure of the you know, the file system entries in the USB
drive itself confused the Windows explore exploit de volvability, and off you went.
The more conventional one is, you know, forget that kind of sophistication,
just put a nasty you know, hackers r us dot X on the USB
and trick someone into double clicking it. Yes, I know it says hackers
are us, but that's why you have to click click it now, click
there, You're done. It's over. You know, that's the contents,
that's you know, there's there's gigabytes, tens of gigabytes of space on these
devices. If you fill it with malware and you trick someone or trick the
computer into executing it, it's all over. This is a different attack.
This is where you know, every one of these USBs has a tiny little
CPU in it. People imagine it's a device. It's not a device,
it's a computer. There's a CPU in the USB device. It has its
own software. That little CPU is executing its own software that's called the firmware,
and normally the software, you know, you connect to the computer that
the computer inside the USB fires up and says, hey, I'm here,
I'm a uh, you know, a storage device. What do you want
me to do? And the computer says, well, you know, show
me what's in your you know what, what files you got, and and
it goes back and forth that way. There's a conversation between the computer and
the USB and in your computer. What's happening here is you connect it up
and it says, hey, I'm a storage device. And that conversation starts,
and the USB says, by the way, I'm also a keyboard,
and it starts typing as if it were an external keyboard on your computer.
And it brings up a command window and starts typing into that window. For
a second or two, you might catch it, you might be glancing away,
you might not. The window closes, and it has injected a nasty
into your computer as if it had typed it from the keyboard. That seems
so remarkable to me. Is there no easy way for a computer to catch
that kind of attack before it happens. Well, this is what we're talking
about. We're describing the problem here, but we're going to see the solution
in a minute. This is what ath USB does. Yeah, okay,
So basically though, the lesson is that, besides it's the contents the files
on USB drive, it's the device itself too that you have to worry about
trust with. So maybe you don't accept a USB on those grounds from anyone
besides like a very trusted source. Yeah, it's it's worse than that.
Actually, you know, there's there's stories out there. You know, pen
testers have published scenarios saying you've got to be aware of this because we just
did it to our client. The scenario was, you know, the pen
testers were tasked with getting into a heavily defended client and they looked around and
said, you know, we just can't get in through these people's network.
It's it's locked up tight. So what they did was one of these you
know USB things. They went out and purchased a very expensive mouse, a
very nice mouse, carefully took the packaging apart, carefully took the mouse apart,
inserted a USB drive into the mouse, connected it all up to the
house's USB, put it all back together, shrink wrap the whole thing,
and sent it to you know, one of the victims in this the company
they were testing because they've done some social media research. They figured out this
person just came back from an expensive conference and said, thank you for attending
the conference. Here's a thank you gift, you know, complete with the
conference logo, very official looking. This person says, lovely, opens it
up. Oh, this is nice. This is a two hundred dollar mouse
from my three thousand dollar conference. Thank you, plugs it in, starts
using it. Twelve hours later in the dead to night. It says,
yes, I'm a mouse, I'm also a USB drive, And you know,
the window pops up and the mouse starts moving, double clicks on the
contents, and now the computer's compromise. So it's not just USB drives that
are at issue here. If you're given a gift of any USB device,
be deeply, deeply suspicious of it. So this is all nasty, but
you know, this is the Industrial Security podcast. Can you talk about the
industrial environment? I mean, I see USBs everywhere I mean, what what
should industrial users be worried about? What should they be thinking about? Here?
The best way to prevent an attack with use the devices is just don't
use in them. Don't use them. So in ot environments, in industrial
environments, uh, they cannot do that. They are they need to use
use the devices because they have legacy devices where they cannot carry their update or
whatever. So they need to use use the devices. They are forced to
use USB devices on all the environments. You know, I kind of expected
that I see people using USBs and industrial sites. I assume it's because they
have to, you know, because they're aware of these problems. The what
what's the solution? I mean, if you have to use a USB to
load a new I don't know letter logic program into a PLC, how do
you avoid this kind of of exposure. You need something that checks everything that
is started on the device. You need something that when you came with thundra,
you connected to that device, to that system, and the it's it
says, if it's fair enough to the company, if you can go inside
with that thundrick. How do we all this problem? I mean, I
see people using USB's at industrial sites because presumably they have to they have to
load a PLC ladder logic program into the device, and then you know the
the USB is the only way to do it. How do they do?
How do you address this problem? So the only way you can get protect
through to these attacks is three checking three kinds of three the electrical one,
the hardware one, and the software attack. You need to check the behavior
of the thund drive in order to detect these three kinds of three. If
you can get that, your protect of every kind of attack with the USB
protocols. Okay, So, so there's three things that we have to protect
against. We have to protect against the the you know, the high voltage
electrical nasty. We have to do something about the hardware. Can you can
you tell us? You know what what you guys do this? What do
you guys do when you say the words electrical, hardware and software? When
you do this, what does it mean? What do you guys actually do
with your product? Okay? So we develop a device, a hardware device,
physical device which the text the behavior of wherever is connected to our device.
So if you connect a killer US via electrical thread, when you connect
it, we check the behavior and if if it breaks they used be protocol
for storage device. We block it, we detect it, we block it,
and we also report to the admin that something someone is connecting. Killer
used to be on the poor number one in the in the device in the
com company, or on the floor three or your company. So the idea
is to check the USB protocol that which is which is very strict the USB
protocols said you need to do this in this exactly time. So if something
is connected and don't follow strictly the USB protocol, it means that it's talking
with some other components, is talking with or is typing to the computer,
or is charging the electrical components to to send the boats through the daylimees.
So it means it's doing something else that needs to be needs to do.
If it was startage device, you check the hardware. If there's over voltage,
you know you you block that. That's great, you've checked the the
USB protocol. It's supposed to be a drive, it's not supposed to be
a keyboard. When you say checking the protocol, you've said electrical hardware and
software is checking the protocol. Hardware and software, what's you know? What
did we miss something here? I only heard two things. I heard I
heard I heard electrical, I heard protocol. What what is what is the
hardware? What is the software? The electrical one is the killer US with
that charge the electrical components and then send the boats through the daytimes. The
hardware attack is the raberday the bad USEV with all the we talked. And
then is the software that is this kind of three? The software three is
a completely normal thund drive but with some software, some malware inside. So
we checked the US protocol for for the to the electrical We checked the used
protocol for the electrical attack, and we checked the used protocol for the hardware
attack. And we have antibious built inside on our device to check the software
attack. Can you tell me, I mean, how does your device?
What does it look like physically? I mean, is this something that I,
you know, plug into the wall to have power and I put my
USB in and it gives me a green light and says your USB is good,
go use it wherever you want. And then I go plug the USB
into the PLC. Or do I plug your device into the PLC and then
plug the USB into your device? Is it between the USB and the and
the PLC or is it is sort of off on the side somewhere. Okay,
So the our device is the it's gonna be the first layer of security.
Or your co company is located on the first door of your industrial facilities.
So when someone came to your industrial organization with with the thund drive,
they go to the security the security office with the security guy. He connected
the thund drave to our solution, and from our solution you can transfer the
files to the net through the network to your LC or to the start folder
you want to s STPs a folder you want in order to get that files
directly from our device without connecting that thround drive, that thund drive to your
computer and exposing yourself to thunder. That change the behavior, for example in
the second connection, so our device is connected to a power supply and and
also with the Ethernet coal to your network. Andrew, I'm going to need
a little bit of help here. I follow how this device handles you know,
typical software threats, right, he mentioned anti virus, But how does
it prevent the you know, the USB that is going to fry my motherboard.
That's just it. This is a separate physical device plugged into the wall.
It does not prevent the USB frying your motherboard. It detects. So
you stick the USB drive in there, and you know it's going to give
you a red flashing light saying whatever you do, don't plug this thing into
the POC, it will fry your POC. It detects rather than prevent.
Okay, but then why doesn't this USB fry the device itself that's detecting this?
Well, you know that's the thing that the device is designed understanding that,
you know, nasty stuff physically electrically could be coming at it. So
it's designed to withstand electrical abuse. You know, you can design a circuit
board for two hundred volts. You know, there's there's things you can do.
You just you have to know what's coming at you. And they they've
they've taken this into account, you know, and they so you know,
they do detection, They do antivirus, just like you said, they do
the electrical saying something electrical just happened, and they do the firmware detection as
well. Really, you know what he said was, look, we understand
electrically, you know, voltage wise and signal wise electrically, what a normal
USB drive behaves like it behaves at five volts. We understand USB protocol wise,
what a normal USB drive behaves like. You say, did this question?
It sends you back that answer, you send it this other thing.
You understand the USB protocol for a thumb drive. And so what they're doing
is looking hard at what the USB is doing. Is it deviating from the
electrical protocol with high voltage? Is it deviating from the drive protocol by saying,
hey, I'm a keyboard. Any deviation gives you a red light saying,
whatever you do, do not plug this thing into your industrial network.
Yeah. It also occurs to me, now that you're describing all of this
that if were the USB to fry this device, which as you mentioned,
it won't because they've prepared for that, that would be a pretty good detection
mechanism in and of itself, because they need to have a broken machine,
and then you'd probably not want to plug that USB in anywhere. It kind
of sounds like an advanced version of something we've talked about on prior episodes,
the USB sanitation station, where if you bring a device like that into manufacturing
plan or something, you've got to plug in your USB there or else,
you're not going to be allowed to use it elsewhere, but maybe like one
or two extra steps involved. That's exactly what it is. I mean,
you've used the term sanitation station. I've heard the term kiosk. This is
a physical device that sits at physical security. You know, you come into
the secure zone in the plant, You're asked to empty your pockets. Do
you have any USBs? Stick all the USBs in the device. You're not
allowed to carry the USBs into the system anyway. It takes the files off
the system, you know, puts the files into the network, the clean
ones that antivirus has blessed. So, yeah, this is a kiosk.
It's a sanitation station. It lives as part of your physical security system,
sort of checking information and people and devices on the way into physically on the
way into the secure area. Okay. And so if I have a PLC
and the only way to change the latter logic is with the USB, then
what I have to do is take my sort of external USB, my suspect
USB, run it through your device, get the files off of it on
the other side, and then you know, inside the industrial network, I
need a bunch of I don't know, color coded USBs that have never touched
the outside world. I put the file back on one of those and I
carry it over to the PLC. Is that how it works? Yeah,
we have several modes to work with our product. We have an automatic mode
for people who's working on the factory that is only there for working, not
for knowing how to use our product or other kinds of products. So we
have a mode that automatically transfer everything from the external fun drive to a internal
thund drive that is protected by you. That is an inventory bye by you,
so it's known by our device. So that all makes sense. Can
you give us some examples in the industrial space in your experience? Who is
using these kind of products? What are they using them for? You know,
are they finding anything? Yeah, our main clients are big companies with
critical infrastructures, also defense and the public infrastructures. They find attacks with the
USB devices and something that is important from our devices. When you cannot check
something, you are not knowing nothing about that about the tour of your company.
For example, if you don't have something that checks the email, you
are not checking if someone is downloading something from the from the email. So
at this time nobody has nothing to control what is moving with the sun drives
on your company. So at the first time, at the first day you
connect our product, you start having everything that is running on the sun drives
on your company is reported in real time to a central console, so the
admin can check everything that is running on sun drives and from there we have
clients that the techt someone is trying to inject the company with bad use be.
So that means that you are under attack because that you. The bad
used be are built specifically for you. There are not there. They are
built by because of you. They are built specifically for you. It is
a strange to detect the bad use be that is not target to you.
So with the text killer used to be with the tech we have clients that
the text killer used be also bad use be. The attack the software attack
is very very common. It is it's normal to have thoundraid that half that
half a malware site. So the most important is the most important to detect
and unblocked and also report is the electrical and the hardware attacks. So that
was a long answer. Let me let me summarize. What I heard Mario
say was that, yeah, their systems in use, and most of their
customers are large critical infrastructure sites. Their systems have detected all three kinds of
attacks. The most common attack that they detect is, you know, the
stuff that the anti virus catches. There's a nasty in you know, you
know, one of your files in the six hundred files on the drive,
you know, and quarantine it. So that's sort of commonplace. He also
said that the killer US be the high voltage, has been detected in the
wild, which surprises me. I would have thought that, you know,
if that was going on in the wild, you'd hear more about it,
and you know, this is the first I've heard of it, so that's
a bit of a surprise. He also said that the firmware attacks have been
detected in the wild, and these are in a sense particularly alarming because he
says, in practice, when they've been detected, pretty much always they have
identified a targeted attack, meaning someone with a lot of resources put together an
attack that is specific to this critical infrastructure site or that you know, very
valuable in industrial site. You know, who has those kinds of resources for
that kind of investment in attack technology, It's usually a nation state, So
that's disturbing. That these have been discovered in the wild as well. Yeah,
it strikes me that these kinds of attacks wouldn't be cyber criminal in nature,
but also that I haven't really heard about them before. Is there a
reason why they wouldn't make the news? You know, you have to ask
who's detecting these attacks. If if it is nation state, it may well
be you know, nation state attacks on very sensitive targets. You know,
he did not say that they have I don't know military customers. If you've
got a very sensitive target, they if you know, let's say a large
government owned facility, whatever kind of facility it is, you know, they
might just not report, Hey, we think the Russians or Iran or someone,
you know, North Korea has just come after us. They might share
that knowledge within you know there they're classified within their their their circle of you
know, people that they inform confidentially about these attacks to say, you know,
here's what's happening. Protect yourself. But you know, if the man
on the street is not at risk of you know, a nation state coming
after them, you know, maybe they figure they don't need to know,
and the people who do need to know. You know, our allies have
been informed through classified channels. I don't know. I don't have a security
clearance. I never see any of this, So this is all speculation on
my part, but it seems plausible. So on the industrial side, let
let's take a step back. On the industrial side, the USB attack everybody
talks about is stocks net a very sophisticated attack, you know Nation state grade?
How confident should we be of the USB solution? Could can you detect?
You know that grade of sophisticated attack. We are confident on our solution
because of we check the behavior, but the confident that the client needs to
contact us is We are thirtified by our Spanies Cryptological Center. Also we are
approved and also certified as two two options here certified or approved, we are
both. We are certified and approved to work with the our Spanish National Cybersecurity
Scheam and also we are certified to work with NATO NATO countries. We we
get through a reverse engineer program in order to certified, and we are one
hundred percent made in Spain. We don't use electrical components from the from outside
outside of the European Union. So that's the confidence we send to the to
the our clients. So that's good. You guys have been, you know,
doing this for a while. Can you give us any view in the
future. I mean, where's this going? What are you guys doing next?
The version we have today is the third version we start this company.
We started this company in twenty eighteen, twenty eighteen, twenty and eighteen,
and this is the third version that we are working on. The new versions
with more ports. The model today have two ports through two person three of
the USB protocol. And we are working on the different kinds of devices everything
to to the attack used to be attacked, but different kinds of the devices
with maybe a screen or with more connectors type CE version to to to support
the US with type C or we are we are working on more than more
than one device, more than one model. Well, this has been great,
Mario, thank you for joining us. Before we let you go,
you know, can you tell our listeners what what should they be? What
should they be taking away? What should they be watching? In this USB
space? The first thing is never trust. Used to be the vices.
It can look like thun drive, like your your friends thund drive, but
in reality it can be anything. It can be a keyboard, it can
be Bluetooth is gonna action or Wi Fi connection, So bigware of bigware of
thun drives because it is the first thing the cyber criminal tries to do,
because it's cheap and it is uh is the first is the fastest way to
get inside your system. So the second thing you need to know is we're
goods from the how to use be is the we We are focused on those
environments where they need to use us BE devices every day for every action,
and we are checking the behavior. We are the only ones that check the
behavior of the us BE devices. Other looks on the black list or white
list. We we just checked the behavior of whatever is connected. And we
also report everything in real time, so the admin of your company can can
see everything in in real time. So if you want to know more about
our solutions, you can just contact us with Our website is out USB dot
net and from there you can contact and know more about our solutions. All
right, that seems to have concluded your interview with Mario Andrew. Do you
have a final thought that you can take us out with. Yeah, I
mean something Mario said in sort of his sum up reminded me. You know,
we've talked about sort of in a sense, the mundane, the normal,
the kinds of attacks to expect in you know, he reminded me that
these kinds of attacks can become much more sophisticated. Imagine something that I mean,
these USB drives, they've got CPUs inside. They can be arbitrarily complicated,
they can be arbitrarily powerful because they're little computers. Imagine a USB drive
that has a CPU inside. Yes, and I don't know cellular hardware,
so it can reach out to the cellular network and say here I am What
would you do with that? Well, it would you know, it could
say to the computer, hey, I'm a drive. Great, I'm also
a keyboard, I'm also a mouse, I'm also a screen. And you
know what's the default behavior on most Windows computers when when it says hey,
I'm another screen, it mirrors the first screen to the second screen. And
now you've got you're seeing a copy of the screen. You can move the
mouse, you can type in the keyboard. This is nasty, but you
know, all over the internet, all by remote control. You know.
The bottom line here is that, you know, we need to be deeply
suspicious of any USB drive that comes into our industrial network from the outside world.
We need to scan it nine ways to Sunday, you know, on
the way into the network, ideally pulling the you know, the contents off
of it, not allowing the physical device into the network at all. So
yeah, it's it's a modern threat. It's you know, thank you to
Mario for reminding us of this nasty attack pathway. Yes. Thank you to
Mario Sandlist for speaking with you. Andrew, and Andrew, thank you as
always for speaking with me. It's always a pleasure. Thank you, Nan.
This has been the Industrial Security podcast from Waterfall. Thanks to everyone out
there listening. It's something the