Karsten Nohl will be presenting on BadUSB at PacSec in Tokyo on Nov 12 2014.

This talk introduces a new form of malware that operates from controller chips inside USB devices. Peripherals can be reprogrammed in order to take control of a computer, exfiltrate data, or spy on the user. We demonstrate a full system compromise from USB and a self-replicating USB virus not detectable with current defenses.

Karsten Nohl will be presenting on BadUSB at POC in Seoul on Nov 6 2014.

This talk introduces a new form of malware that operates from controller chips inside USB devices. Peripherals can be reprogrammed in order to take control of a computer, exfiltrate data, or spy on the user. We demonstrate a full system compromise from USB and a self-replicating USB virus not detectable with current defenses.

USB devices are connected to – and in many cases even built into – virtually all computers. The interface standard conquered the world over the past two decades thanks to its versatility: Almost any computer peripheral, from storage and input gadgets to healthcare devices, can connect over the ubiquitous technology. And many more device classes connect over USB to charge their batteries.

This versatility is also USB’s Achilles heel: Since different device classes can plug into the same connectors, one type of device can turn into a more capable or malicious type without the user noticing.

Reprogramming USB peripherals. To turn one device type into another, USB controller chips in peripherals need to be reprogrammed. Very widely spread USB controller chips, including those in thumb drives, have no protection from such reprogramming.

BadUSB – Turning devices evil. Once reprogrammed, benign devices can turn malicious in many ways, including:

1. A device can emulate a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install malware. Such malware, in turn, can infect the controller chips of other USB devices connected to the computer.
2. The device can also spoof a network card and change the computer’s DNS setting to redirect traffic.
3. A modified thumb drive or external hard disk can – when it detects that the computer is starting up – boot a small virus, which infects the computer’s operating system prior to boot.

Defenses?
No effective defenses from USB attacks are known. Malware scanners cannot access the firmware running on USB devices. Behavioral detection is difficult since behavior of an infected device may look as though a user has simply plugged in a new device. Blocking or allowing specific USB device classes and device IDs is possible, however generic lists can easily be bypassed. Pre-boot attacks may be prevented by use of a BIOS password and booting only to the hard drive.

To make matters worse, cleanup after an incident is hard: Simply reinstalling the operating system – the standard response to otherwise ineradicable malware – does not address BadUSB infections at their root. The USB thumb drive, from which the operating system is reinstalled, may already be infected, as may the hardwired webcam or other USB components inside the computer. A BadUSB device may even have replaced the computer’s BIOS – again by emulating a keyboard and unlocking a hidden file on the USB thumb drive.

Once infected, computers and their USB peripherals can never be trusted again.

More details are available in the slides of our talk at PacSec 2014. (An earlier version of the talk was presented at BlackHat 2014.) YouTube has a video of the BlackHat talk.

Proof-of-Concept. We are not yet releasing the modified USB controller firmwares. Instead we are providing a proof-of-concept for Android devices that you can use to test your defenses: BadAndroid-v0.2

Questions? – usb [you know what to put here] srlabs.de

I just spent the last couple of weeks tinkering around with this… a Companion Cube from the video game Portal. It’s made from quarter inch plywood with laser cut oak veneer for the surface detail.

The locking mechanism is basically identical to this project.

And yes… it was a triumph.

Click on any of the images above to see more construction pictures.

Karsten Nohl and Jakob Lell will be presenting BadUSB at BlackHat 2014 in August 2014

USB has become so commonplace that we rarely worry about its security implications. USB sticks undergo the occasional virus scan, but we consider USB to be otherwise perfectly safe — until now.

This talk introduces a new form of malware that operates from controller chips inside USB devices. USB sticks, as an example, can be reprogrammed to spoof various other device types in order to take control of a computer, exfiltrate data, or spy on the user.

We demonstrate a full system compromise from USB and a self-replicating USB virus not detectable with current defenses.

We then dive into the USB stack and assess where protection from USB malware can and should be anchored.

Karsten Nohl will be presenting on Mobile network attack evolution at Positive Hack Days in Moscow, May 21-22 2014.

Mobile networks should protect users on several fronts: Calls need to be encrypted, customer data protected, and SIM cards shielded from malware.

Many networks are still reluctant to implement appropriate protection measures in legacy systems. But even those who add mitigations often fail to fully capture attacks: They target symptoms instead of solving the core issue.

This talk discusses mobile network and SIM card attacks that circumvent common protection techniques to illustrate the ongoing mobile attack evolution.

Linus Neumann and Ben Schlabs will be presenting On our fear and apathy towards smartphone attacks at Re:publica on May 7th 2014.

Smartphones are migrating from lifestyle object to the epicenter of communication on the individual and societal level. Equipped with cameras and microphones and constantly connected to communication networks, the phones are also becoming an attractive target for spies and data thieves. The fear among smartphone users grows without their knowing if and how they are actually being attacked.

This talk aims to take the fear factor out of the smartphone security discussion: We explain how phone attacks work and which ones you should be worried about, what you should demand from your network operator, and how you can protect yourself. To further drive mobile security evolution, we introduce a crowdsourced way to measure mobile network protection around the world.

December 30, 2014:

• Upgraded to wordpress 4.1
• Testing a new theme that is a bit less “bloggy”
• Added a big fat “download now” button on the front page.
• Fixed layout for small screens (like smart phones in portrait mode.)

January 24, 2014:

• v3.0.0 release candidates are available for download and testing.  The official v3.0.0 release is scheduled for 17 Feb.
• Upgraded to WordPress 3.8.1

December 20, 2013:

Upgraded to WordPress 3.8 and the Twenty Fourteen theme.

November 25, 2013:

FlightGear v2.12.1 (bug fix release) is now available for download.

October 3, 2013:

Upgraded to WordPress 3.6.1 and new TwentyThirteen theme.  The FlightGear web site server hardware has been relocated to a newer larger building.  And v2.12 has just been released!

February 13, 2013: Updated Scenery Download Path

The FlightGear scenery downloads has been updated to v2.10 in preparation for the 17 Feb v2.10 release.  The scenery content does not follow the same release schedule and has updates and improvements every few days.  Thus this is more of a name change formality, and the “v2.10” scenery will work fine with v2.8 and probably most v2.x versions of FlightGear.

January 12, 2013: New Wiki Server

The FlightGear Wiki (http://wiki.flightgear.org) has been moved from a shared hosting server to a new dedicated virtual private host.  The FlightGear wiki is *very* popular and generates a lot of traffic and server load so hopefully this will improve the performance and reliability of our wiki and at the same time help all the other services on the old shared hosting server.

The new wiki host has been donated to the FlightGear project by DigitalOcean. If you are searching for a good hosting service among an ocean of possible options, they are good guys.

December 18, 2012: WordPress 3.5 & New Theme

The FlightGear web site has been upgraded to the newest version of wordpress (3.5) and I am experimenting with a new theme.  We can always return to the old them if we decide we like that better, or we can more forward too.  The new theme has some better support for mobile devices.

December 29 update: when switching to the new 2012 theme, we ended up with comments enabled on all content pages.  This was unintentional.  The page comments were mostly support requests or the odd snarky comment.  I have removed the comments area from regular content pages, but comments are still allowed (and encouraged) for “post” pages.  However, comments will be filtered carefully for topic and usefulness.  Do they expand or clarify the conversation of the post topic?  Support questions will still be referred to the FlightGear forum.  Random positive/negative statements (like “I love flightgear” or “I hate flightgear” will generally be ignored.)  English is preferred for post comments, but exceptions have been made and probably will be made in the future.

October 24, 2012: Scenery Download Page updated

The World Scenery Download page is updated to SVN version 20579.  It may take a day or so for the updated files to flush through the mirror system.

September 7, 2012: WordPress 3.4.2

Upgraded to wordpress-3.4.2.

August 20, 2012: Updated Gallery

Featuring the winning entries of the 15th anniversary screenshot contest, we have added a new screenshot gallery to go along with the v2.8.0 release!

August 17, 2012: Version 2.8.0 Released

Yeah!  Look on the front page (or the recent posts list in the side bar) to read the official release announcement.  Better graphics, new aircraft, new visual effects, tons of new things to explore!

July 30, 2012: v2.8.0 Release Candidate “RC4” Available.

If you are interested in trying the next release of FlightGear ahead of time (and helping us sniff out any remaining bugs or packaging issues) then please take a look for download links in the release candidate section towards the bottom main download page.  Also notice that updated v2.8.0 aircraft are also available for download along with the pre-release.

June 28, 2012: WordPress 3.4.1

The FlightGear web site software has been updated to WordPress v3.4.1.

February 28, 2012: Version 2.6.0 Updates

Both Mac OS X and Windows have had small tweaks to follow up the v2.6 release.  For Mac OS X there is “r319” version of the 2.6.0 dmg which fixes a couple problems some Mac users were seeing.  For Windows there is a “Setup FlightGear 2.6.0.1.exe” which fixes one small 32bit vs. 64bit dll packaging problem some 64bit users were seeing.

February 17, 2012: Version 2.6.0 Released

There has been a large number of changes and updates to the download and information pages as part of the v2.6.0 roll-out.

Jan 29, 2012: New v2.6.0 Release Candidate Available

A complete test release for the upcoming FlightGear 2.6.0 version is available to try.  Follow this link to the FlightGear v2.6.0 Release Candidate page.

Jan 6, 2012: New Developer Snapshot Available

A new developer snapshot (v20120105) is available for download and testing.  This is a way to keep up with all the coolest new features and experimentation without needing to compile the code yourself from scratch.  You can find the download link on the main download page.

Dec 28, 2011: Contributors Section added

A new section has been added to the FlightGear web site: Contributors.  We plan to periodical add profiles of different contributors to this section.  If you’d like to be included here, or have corrections or updates to existing entries, please contact the web master!

Sep 27, 2011: Scenery Download Page added

A World Scenery Download page has finally been added to the new web site.  You can find the page in the main site menu.  The graphical download page has also been updated.  All the links should now point to the v2.4.0 version of the scenery (this corresponds to svn version 16700 from the terrascenery archives.)  Update: a small link error has been fixed so the download map should be working again.  Thanks to those who reported it!

Sep 27, 2011: New wiki and liveries server

The server hosting wiki.flightgear.org and liveries.flightgear.org has been upgraded and the content has been migrated over.  There shouldn’t be any problems, but of course if you spot something odd, please let us know.

Fingerprint sensors have sought to replace password- and PIN-based authentication for years. The sensors are widely found in laptops, sometimes in payment terminals, and recently in several smartphones. The latest entrance to the field is Apple’s iPhone 5s. The sensors continue to fail their marketing claim of secure device unlocking.

Security level.

Using fingerprints as credentials for local user authentication has two shortcomings when compared to passwords:

A. Limited revocation. Once a fingerprint gets stolen, there is no way to change it. To offset this high compromise penalty, fingerprints would need to be very hard to steal. However:

B. Credential spread. Users leave copies of their fingerprints everywhere; including on the devices they protect. Fingerprints are not fit for secure local user authentication as long as spoofs (“fake fingers”) can be produced from these pervasive copies.

Fingerprint spoofs.

Spoofs have been produced time and time again from images of latent prints – even while camping – and most recently by Starbug from the CCC to overcome the protection of an iPhone 5s.

Other current devices with touch and swipe sensors are equally duped by spoofs. This video shows how an iPhone 4s-taken photo results in a fingerprint-spoof that unlocks a Thinkpad laptop, a Fujitsu smartphone, and an iPhone 5s:

ID theft risk.

The iPhone 5s’s fingerprint sensor does not only appear to provide no additional protection, its use even undermines other security mechanisms. This video demonstrates how other flaws in iOS and iCloud are exposed that – when combined with Touch ID’s vulnerability to fingerprint spoofing – allow for online identity theft:

Remote authentication.

Fingerprint sensors still have a strong protection proposition: To provide a second (and third) authentication factor in remotely-executed transactions, such as authorizing money transfers. Modern fingerprint sensors can compare templates and scans on-chip – that is: protected from malware on the device – and conduct a strong cryptographic authentication to a web service. Industry seems to be determined to standardize such transactions.

An attacker would need to get access to three credentials: the banking password, the fingerprint sensor that stores an authentication certificate, and a spoof of the fingerprint that activates this certificate. For the most common miscreant, remote attackers, the latter two should be out of reach.

Evolution path.

Defeating local attackers is still of value even when the fingerprint only provides an additional authentication factor.

The iPhone 5s already moved slightly beyond the capabilities of earlier touch sensors: It provides a higher resolution image and – as far as initial experiments can tell – uses this higher resolution to match based on finer structures:

Low resolution fingerprint image, sufficient to create spoofs for older sensors

High resolution fingerprint image with clear features along the ridges, which newer sensors detect

Even these finer structures can be spoofed, for example based on an equally high resolution smartphone camera image, showing that some defense strategies only improve at the pace of the corresponding attack technique.

Fingerprint spoof prevention would better be based on intrinsic errors in the spoof-creation process or on fingerprint features not present in latent prints (and become much harder to steal). Examples of such spoof-detection features are air bubbles contained in the glue often used for spoofs (white dots in left image) and minute details that are visible through a fingerprint sensor but not in a latent print (black dots in right image).

Sensor read of spoof finger with white air bubbles, but fewer minute details

Sensor read of real finger with minute details but no air bubbles

Even by just comparing the density of white vs. black dots, sensors would challenge hackers to improve their spoofing techniques. The iPhone 5s, on the other hand, was defeated by techniques widely published years ago.