Didier Stevens

Thursday 14 July 2011

Quickpost: Blocking and Detecting a Teensy Dropper

Filed under: Forensics,Hardware — Didier Stevens @ 9:58

A Teensy dropper presents itself as a keyboard (HID) to a PC and this is how it can be used to drop files even if you don’t allow removable drives.

You can prevent the installation of new HIDs, but this is an issue when you need to replace keyboards or mice. Irongeek has a good write-up.

Connected HIDs leave forensics traces in the registry, take a look under key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\

Connecting a Teensy leaves these entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_16c0&Pid_0482\6&31417f27&0&3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_16c0&Pid_0482&MI_00\7&becc88c&0&0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_16c0&Pid_0482&MI_01\7&becc88c&0&0001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_16c0&Pid_0482&MI_02\7&becc88c&0&0002


Quickpost info


4 Comments »

  1. You can change the vendor and product IDs on a Teensy device, so this technique will only detect stock devices.

    Comment by Jon — Thursday 14 July 2011 @ 10:37

  2. @Jon Your correct Jon, but your comment made me think of something else. What would happen if I change the Teensy IDs to the IDs of the keyboard that is already connected, then disconnect the keyboard and connect the Teensy?

    Comment by Didier Stevens — Thursday 14 July 2011 @ 16:37

  3. Checking for the PJRC VID and PID is useless because the VID and PID are trivially easy to change in the device.

    You don’t have to disconnect the PC keyboard, since the OS is fine with accepting multiple devices with the same VID and PID. The best Teensy to use as a dropper currently is the Teensy 2.0++ which has 128k bytes of flash RAM. The Keyboard HID code is only around 6K so you have plenty of space left for your payload.

    Another dropping method is for the Teensy to emulate RNDIS, so the PC sees the Teensy as an ethernet over USB device.

    Comment by grover marshal — Sunday 20 January 2013 @ 6:16

  4. @grover The question is when you spoof the VID and PID of the attached keyvboard, will there be any forensic evidence of a Teensy?

    Comment by Didier Stevens — Tuesday 22 January 2013 @ 21:37


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

The Rubric Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 227 other followers

%d bloggers like this: