Biz & IT —

Playing NSA, hardware hackers build USB cable that can attack

With built-in USB hub and radio, cable can spy or launch man-in-middle attacks.

The NSA's USB man-in-the-middle device, Cottonmouth-1, costs about $20,000. Soon, the electronically inclined will be able to make their own for about $20.

Just over a year ago, Jacob Appelbaum and Der Spiegel revealed pages from the National Security Agency's ANT catalog, a sort of "wish book" for spies that listed technology that could be used to exploit the computer and network hardware of targets for espionage. One of those tools was a USB cable with embedded hardware called Cottonmouth-I—a cable that can turn the computer's USB connections into a remote wiretap or even a remote control.

Cottonmouth-I is the sort of man-in-the-middle attack that hackers dream of. Built into keyboard or accessory cables, it allows an attacker to implant and communicate with malware even on a computer that's "airgapped"—completely off a network. And its hardware all fit neatly into a USB plug. Because of the sophistication of the hardware, the advertised price for Cottonmouth-I was over $1 million per lot of 50—meaning each single device cost $20,000.

But soon, you'll be able to make one in your basement for less than $20 in parts, plus a little bit of solder. At Shmoocon in Washington, DC, this past weekend, Michael Ossman, a wireless security researcher and founder of Great Scott Gadgets, and a contributor to the NSA Playset–a set of projects seeking to duplicate in open source the capabilities in the NSA's toolbox, showed off his progress on TURNIPSCHOOL, a man-in-the-middle USB cable project under development that fits a USB hub-on-a-chip and a microprocessor with a built-in radio onto a circuit board that fits into a molded USB plug.

Ossman shared the stage with two collaborators, Dominic Spill and Jared Boone, to talk about TURNIPSCHOOL and two other projects that aim to allow monitoring (and potentially hacking) of the data traveling over USB connections. "The tools spooks use aren't that big a deal," said Ossman. "We can build them ourselves." In fact, he said, many of the tools hobbyists and hackers have built so far "are more sophisticated than stuff in the ANT catalog."

Most of the NSA Playset projects depend on off-the-shelf, open hardware such as the BeagleBone Black. USBProxy, a project developed by Spill using a BeagleBone Black, provides a way to monitor traffic passing over a USB 2.0 connection and replicates some of the capabilities of the more expensive FaceDancer USB emulator and "fuzzer" hardware.

But Ossman, Spill, and Boone have moved into building custom printed circuit boards to take on other hacking tasks. Another project targeting USB 3.0, called Daisho, uses an adaptable piece of circuitry that can plug into different pairs of inputs onto a board with an inexpensive field-programmable gate array (FPGA) to handle the heavy lifting of monitoring USB 3.0's high-speed bus.Daisho attracted attention from beyond the hardware hacking world—it even received funding support from the Defense Advanced Research Projects Agency's Cyber Fast Track program (under the name "Physical Layer Monitoring for Wired Communication Media").

But while these projects, and others based on open or custom hardware, have shown promise in matching or exceeding what the NSA can do, they're still "kind of big and expensive," Ossman said. TURNIPSCHOOL was born out of a challenge to see if a hobbyist could manufacture something as miniaturized as Cottonmouth-1.

TURNIPSCHOOL is based on a custom, 4-layer PCB board that costs $1.50, a USB hub-on-a-chip, and a Texas Instruments microcontroller with a built-in RF transceiver that cost about $4 each—solder, 3-D printed injection mold, and plastic cover not included. "I soldered it myself," Ossman said. "It's totally accessible at a hobbyist level." The only hint that there may be some funny business involved with the device to the end user is that it reports itself when plugged in as both a hub and a device. The next step in TURNIPSCHOOL development is to use it to attack the host computer.

You must to comment.