key-logger, video, mouse - hack.lu 2016 · key-logger, video, mouse how to turn your kvm into a...
TRANSCRIPT
![Page 1: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/1.jpg)
Key-Logger, Video, Mouse
How to turn your KVM into a raging key-logging monster
![Page 2: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/2.jpg)
MEETTHETEAM
Yaniv Balmas “This should theoretically work”Security Researcher
Check Point Software Technologies
@ynvb
Lior Oppenheim “The mad scientist”
Check Point Software TechnologiesSecurity Researcher
@oppenheim1
![Page 3: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/3.jpg)
TOOMANYCOMPUTERS• Computers
• Many computers
• A LOT OF COMPUTERS
![Page 4: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/4.jpg)
WHATISKVM?• Keyboard, Video, Mouse
• KVM connects the same Keyboard, Video and Mouse to one or more computers.
1
2
KVM
![Page 5: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/5.jpg)
WHEREARETHEY?• On your desktops.
• In your server racks.
• In *very* secure environments.
KVMS ARE EVERYWHERE!!
![Page 6: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/6.jpg)
KVMEVOLUTION
1990
`A-B Switch`
4 Ports2000
Modern KVM
16 Ports2010
Matrix KVM
1024+ Ports
![Page 7: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/7.jpg)
STUPIDBOXES?
IT RUNS CODE!!
![Page 8: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/8.jpg)
WHATCANWEDO?
• What’s the one common thing here?
• All features require the KVM to process key-strokes!
• If we could “theoretically” control the key processing routine…
KEY-LOGGER
![Page 9: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/9.jpg)
SOFTWARE
• Manuals, Cables, Warranty and a CD…
• CD contains some interesting files:
• A Firmware Upgrade Utility.
• firmware.bin
• Since x86 is no new territory, we can reverse engineer this!
![Page 10: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/10.jpg)
MEETTHEBLOB
Low EntropySize - 64K
No Strings Inconclusive freq. analysis
binwalk
![Page 11: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/11.jpg)
FAIL!
![Page 12: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/12.jpg)
SERIALSNIFF
• Firmware upgrade process is done via a custom serial protocol.
• It is possible to extract the (possibly) encoded firmware binary from the serial protocol.
• It’s just a matter of analyzing the serial protocol.
![Page 13: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/13.jpg)
Data Transfer
PROTOCOLANALYSIS
46 55 a3 00 03 63 40 d7 85 85 32 ea e2 01 6b 85 FU£..c@◊ÖÖ2Í‚.kÖ 32 a6 d9 d6 e5 df 55 a6 d5 22 04 d6 cd 05 d5 96 2¶Ÿ÷ÂflU¶’".÷Õ.’ñ 27 85 85 d7 40 a5 d7 32 01 32 e2 85 6b ea 85 d9 'ÖÖ◊@•◊2.2‚ÖkÍÖŸ df d5 e5 a6 55 d6 a6 04 2d 27 cd 22 d5 d6 96 85 fl’¶U÷¶.-'Õ"’÷ñÖ a5 01 40 85 d7 d7 81 •.@Ö◊◊Å 46 55 23 00 03 63 00 24 FU#..c.$
From KVM
To KVM
Fixed Header
OpCode
46 55 90 00 44 49 b8 FUê.DI∏ 46 55 10 00 43 ** 2d 31 ** ** 34 41 2f 31 ** ** FU..C*-1**4A/1** 32 41 00 00 4d 41 49 4e 00 00 00 56 34 32 52 34 2A..MAIN...V42R4 31 37 56 31 30 52 30 38 31 57 37 38 45 36 35 00 17V10R081W78E65. 00 a2 .¢ 46 55 a0 00 43 54 d2 FU†.CT“ 46 55 20 00 00 bb FU ..ª 46 55 a2 00 ** ** ** ** ** ** 2d 31 37 33 ** 41 FU¢.******-173*A 2f 31 ** ** ** 41 00 00 4d 41 49 4e 00 00 00 56 /1***A..MAIN…V 34 32 56 31 30 04 ce 19 a7 75 50 35 ca aa 6a 0a 42V10.Œ.ßuP5 ™j. ca 8a 0a aa 01 09 8c 69 73 49 1c c0 6a c7 01 ac ä.™..åisI.¿j«.¨ 7f 25 25 49 10 %%I. 46 55 22 00 00 bd FU"..Ω 46 55 a3 00 00 00 05 68 70 7d 5b af 65 05 4d ea FU£....hp}[Øe.MÍ 2d a1 4f 55 85 05 d1 04 04 b7 d8 76 05 05 7a 04 -°OUÖ.—..∑ÿv..z. 04 84 e3 17 04 05 04 04 04 ba 15 ed 32 05 ec 68 .Ñ„......∫.Ì2.Ïh 03 0f 8b 0f be 85 16 37 be 12 85 07 13 c5 b7 96 ..ã.æÖ.7æ.Ö..≈∑ñ 92 03 94 7f 05 3d 2a í.î.=*
CheckSum
Seq. Number
Handshake
![Page 14: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/14.jpg)
GUESSWHO?
![Page 15: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/15.jpg)
FAIL!
![Page 16: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/16.jpg)
PCBLAYOUTUnknown PLD
8052 Processor2K
External RAM
D-Latch
![Page 17: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/17.jpg)
PCBLAYOUT
Unknown X2
PLD X28052 X1 External
RAM X1
![Page 18: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/18.jpg)
UARTMAGIC• 8051\2 Chips have an integrated UART port.
• Which IC pins should be tapped?
• In order to find out, let’s take a look at the specs.
![Page 19: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/19.jpg)
NOTHINGBUTLOGIC
• 30-45 China mail shipping days later.
• We can finally use LOGIC.
![Page 20: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/20.jpg)
TAPICPINS
• Tapping the 8052 IC UART pins using Logic Analyzer.
• Reveals the the UART port’s signals.
![Page 21: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/21.jpg)
SIGNALANALYSIS
• Reviewing the signals in the UI.
• An obvious pattern emerges.
From UART
To UART
![Page 22: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/22.jpg)
GREATFAIL!46 55 90 00 44 49 b8 FUê.DI∏ 46 55 10 00 43 ** 2d 31 ** ** 34 41 2f 31 ** ** FU..C*-1**4A/1** 32 41 00 00 4d 41 49 4e 00 00 00 56 34 32 52 34 2A..MAIN...V42R4 31 37 56 31 30 52 30 38 31 57 37 38 45 36 35 00 17V10R081W78E65. 00 a2 .¢ 46 55 a0 00 43 54 d2 FU†.CT“ 46 55 20 00 00 bb FU ..ª 46 55 a2 00 ** ** ** ** ** ** 2d 31 37 33 ** 41 FU¢.******-173*A 2f 31 ** ** ** 41 00 00 4d 41 49 4e 00 00 00 56 /1***A..MAIN…V 34 32 56 31 30 04 ce 19 a7 75 50 35 ca aa 6a 0a 42V10.Œ.ßuP5 ™j. ca 8a 0a aa 01 09 8c 69 73 49 1c c0 6a c7 01 ac ä.™..åisI.¿j«.¨ 7f 25 25 49 10 %%I. 46 55 22 00 00 bd FU"..Ω 46 55 a3 00 00 00 05 68 70 7d 5b af 65 05 4d ea FU£....hp}[Øe.MÍ 2d a1 4f 55 85 05 d1 04 04 b7 d8 76 05 05 7a 04 -°OUÖ.—..∑ÿv..z. 04 84 e3 17 04 05 04 04 04 ba 15 ed 32 05 ec 68 .Ñ„......∫.Ì2.Ïh 03 0f 8b 0f be 85 16 37 be 12 85 07 13 c5 b7 96 ..ã.æÖ.7æ.Ö..≈∑ñ 92 03 94 7f 05 3d 2a í.î.=*
46 55 a3 00 03 63 40 d7 85 85 32 ea e2 01 6b 85 FU£..c@◊ÖÖ2Í‚.kÖ 32 a6 d9 d6 e5 df 55 a6 d5 22 04 d6 cd 05 d5 96 2¶Ÿ÷ÂflU¶’".÷Õ.’ñ 27 85 85 d7 40 a5 d7 32 01 32 e2 85 6b ea 85 d9 'ÖÖ◊@•◊2.2‚ÖkÍÖŸ df d5 e5 a6 55 d6 a6 04 2d 27 cd 22 d5 d6 96 85 fl’¶U÷¶.-'Õ"’÷ñÖ a5 01 40 85 d7 d7 81 •.@Ö◊◊Å 46 55 23 00 03 63 00 24 FU#..c.$
Or is it?
![Page 23: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/23.jpg)
BREAKINGCODE
• The BLOB is probably translated into 8051 Assembly.
• The translation is done somewhere within the 8052 chip.
• It might be possible to break the obfuscation!
![Page 24: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/24.jpg)
REMEETTHEBLOBLast Bytes are
padded with 0x53
![Page 25: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/25.jpg)
BREAKINGCODE
8051 NOP = 0x00
0x53⊕0x53= 0x00
![Page 26: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/26.jpg)
ALLDONE!
![Page 27: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/27.jpg)
8051ASSEMBLY?
![Page 28: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/28.jpg)
8051ASSEMBLY?
![Page 29: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/29.jpg)
8051ASSEMBLY?EVERYTHING IS 8051!!!
![Page 30: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/30.jpg)
BREAKINGCODE
Final 8 bytes are different.
![Page 31: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/31.jpg)
ACLUE?
• What do these last 8 bytes mean?
• Is this a clue left for us by a mad embedded developer?
![Page 32: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/32.jpg)
CHECKSUM?
• Maybe they are simply a checksum value?
B2 A1 A1 89 A9 00 92 91
CRC32 - 479AE264
MD5 - 43C030C2…
ADLER - A37EFB…
CHKSUM - DD38F4E8
![Page 33: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/33.jpg)
FIRMWAREDIFFS!• We have only analyzed a single
firmware version.Last 8 Bytes
91 99 99 89 91 B2 99 00B2 92 89 81 A1 99 A1 8992 00 A1 A1 89 B2 89 9191 92 A1 89 A1 A1 B2 00B2 A1 A1 89 A9 00 92 91A1 92 00 89 B1 91 A1 B992 00 A1 89 91 B2 A1 8900 A1 92 91 C1 B2 A1 8900 91 A1 B2 C9 89 A1 92
Byte CountA1 1789 1191 90 8
B1 892 899 4B9 2C1 1
![Page 34: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/34.jpg)
FIRMWAREDIFFS!
• By listing the versions next to the bytes.
Last 8 Bytes Firmware Version91 99 99 89 91 B2 99 00 3 . 3 . 3 1 2B2 92 89 81 A1 99 A1 89 4 . 1 . 4 0 192 00 A1 A1 89 B2 89 91 4 . 2 . 4 1 191 92 A1 89 A1 A1 B2 00 4 . 2 . 4 1 4B2 A1 A1 89 A9 00 92 91 4 . 2 . 4 1 5A1 92 00 89 B1 91 A1 B9 4 . 2 . 4 1 692 00 A1 89 91 B2 A1 89 4 . 2 . 4 1 700 A1 92 91 C1 B2 A1 89 4 . 2 . 4 1 800 91 A1 B2 C9 89 A1 92 4 . 2 . 4 1 9
![Page 35: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/35.jpg)
APATTERN?
• Maybe if we look at the binary values of these “patterns”.Digit Hex Binary
1 0x89 100010012 0x91 100100013 0x99 100110014 0xA1 101000015 0xA9 101010016 0xB1 101100017 0xB9 101110018 0xC1 110000019 0xC9 11001001
![Page 36: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/36.jpg)
CANYOUCOUNT?
• Why is this counter located in the middle?Digit Hex Binary
1 0x89 100010012 0x91 100100013 0x99 100110014 0xA1 101000015 0xA9 101010016 0xB1 101100017 0xB9 101110018 0xC1 110000019 0xC9 11001001
ROR 3 Hex00110001 0x3100110010 0x3200110011 0x3300110100 0x3400110101 0x3500110110 0x3600110111 0x3700111000 0x3800111001 0x39
![Page 37: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/37.jpg)
GOTIT?
• Just in case your ASCII-FU is lacking…Digit Hex Binary
1 0x89 100010012 0x91 100100013 0x99 100110014 0xA1 101000015 0xA9 101010016 0xB1 101100017 0xB9 101110018 0xC1 110000019 0xC9 11001001
ROR 3 Hex ASCII00110001 0x31 “1”00110010 0x32 “2”00110011 0x33 “3”00110100 0x34 “4”00110101 0x35 “5”00110110 0x36 “6”00110111 0x37 “7”00111000 0x38 “8”00111001 0x39 “9"
![Page 38: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/38.jpg)
STRINGS?
![Page 39: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/39.jpg)
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8
RESHUFFLE
AGCFEDBHIOKNMLJPQWSVUTRX
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8GC FD H OK NL P WS VT XA I QB J RE M U
Position Original1 12 73 34 65 56 47 28 8
![Page 40: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/40.jpg)
RESHUFFLE
Position Original1 12 73 3
4 6
5 5
6 4
7 2
8 8
![Page 41: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/41.jpg)
SUCCESS!!!
Strings!Assembly!
![Page 42: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/42.jpg)
8051FUN
• We can now design our own custom firmware.
• However, we do need a basic understanding of 8051 assembly!
![Page 43: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/43.jpg)
8051REVIEW+Only 255 OP-Codes, and ~40
Instructions.
- Functions are not *really* functions.
- Just a single memory access register.
- Registers keep on changing for some reason.
![Page 44: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/44.jpg)
KVMLOGICKeyboard Emulation HID Parsing
Hotkeys Handling
Keyboard LEDs
Control
![Page 45: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/45.jpg)
Air Gapped Network
Internet Connected Network
“HELLOKVM!”
1 2 3 4
KVM
![Page 46: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/46.jpg)
DEMOTIME
![Page 47: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/47.jpg)
ATTACKVECTORS• Yes, we had physical access to the
device.
• Just get 30 seconds alone with a KVM. (“evil maid”)
• Supply chain attack (“Interdiction”).
• Many KVMs update over IP.
• KVMs are not exploit proof.
![Page 48: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/48.jpg)
COUNTERMEASURES
• Know your environment.
• Secure your KVMs.
• Be innovative!
![Page 49: Key-Logger, Video, Mouse - Hack.lu 2016 · Key-Logger, Video, Mouse How to turn your KVM into a raging key-logging monster. MEETTHETEAM Yaniv Balmas “This should theoretically work”](https://reader031.vdocuments.us/reader031/viewer/2022013021/5f06ec0d7e708231d41a6726/html5/thumbnails/49.jpg)
ThankYou!
@ynvb@oppenheim1