Merken

A Monitor Darkly: Reversing and Exploiting Ubiquitous On-Screen-Display Controllers in Modern Monitors

Zitierlink des Filmsegments
Embed Code

Automatisierte Medienanalyse

Beta
Erkannte Entitäten
Sprachtranskript
. death at the top the and the and the and the B brought
to the hi guys sorry for the delay I just want before we start the dark I just want to let you know that there will be giving this awesome stake thing Bonner I wasn't do
if you answer all the questions so please pay attention to him and it's very hard is they just what I make a quick announcement before I introduces goes on so just a reminder that there is no but tonight at 9 of the city which is where the concert was lost sight and it's at the saddest fear for those of you who haven't been there before in the past it's an experienced so with that I like to introduce entree was washable no and yet in tutorial we'll be talking about waters next the OK yes like judge so we're going to get out that really cool thing if you answer 1 really question
so the title of our talk is monitored directly in here is the cast of
characters and this I'm all jotain is trying to set the demo that over there the strong François is right on the internet is a canadian is great and
this is the law from hatcheries and I've never met you were so what is made up of the I and I personally I speak to memorialize here is concerned area
man named Chris will be part of the story and
and area man of concern should he which will also be her 1st get primary main
objective we're going after monitors that's what this talk is about you know why monitors the what is
this is really a security problem you know that's always talk about so I thought you know in retrospect you why I did the monitoring and I think that what to do
with you badly day I used to existing cubicle life he was very sad I found a picture of my actual hedge fund cubicle office thing friend and I think those Machel desk and taken contains actual sadness uh enabling I went back to
school I a I a you maybe subconsciously wants to dismantle cubicle life technology so jot maniacal University la work on the cell phones we looked at each reporters and you would did work with Cisco routers so the last thing that's left in a picture a is the
monitors the monitors gone down today that's that's what we're doing but I'm in more of a user's
nova look at this website GATE it's chase outcome there's a green little locker degree means good OK I would probably you know posit that we've probably spent about a billion dollars creating all of the technology in the infrastructure to support the kernel got all the technology to support and infrastructure where we can put a green icon on that browser window right so we can feel safe about encryption but looking at the letters in which we see
this browser through right it's a monitor so you know if you want a compromise the system as a whole rate maybe let's look at the minimum the cost of 1 billion dollars of the crypto and all infrastructure secure group around to her own browser and uh maybe whatever the cause of bypassing the security in the monitors maybe it's a lot may be too little and so we talk about they end right a good
hackers a lazy hackers of going after to the car on the browsers change the pixel from that and let's see if we can just change the pixel and the screen itself OK so the story
serves back until the 15 rate will travel and at the time uh right so
I get this really sweet you monitor in my office great in fact and John has 2 and we look at it would plug it into a
machine and the 1st thing that it says is hot you speech ITC solution from Texas Instrument and also you know is illegal 34 10 boot device right so we look at that and we say that's pretty cool it's very interesting
and then like a minute of googling later we find this post fund del suppor form
right a or about it you can download this like we're driver but really you know it will use it for firmer update and you should never need this so every fine Ray and I was at that time that's that's also really interesting so
you know I sedan John page stare down a sphere 34 inch model we have enough office we already have sweet monitors why don't we that according to their like will who cares and then area manner concern area may increase over here colorization and
he says like have you guys know hearts like there's no end to this senseless savagery and also I have a million of them plug and very sad day and others that all of
that's the saddest story ever heard why but how about dense let's give that's due to the inherent variability they will be sad so great this is our
interplay we love these people they're very talented dedicated people working in a office and it just so happens that the interns get standard issue you know tell you 24 10 minus but they
are and you know like 15 minutes ago later we find is really very informative document that says you know you 24 for 10 years the former upgrade instruction rate is so clear that I think it's almost like insultingly clear because you'll
that this is such a little says like you plug the power cord in the power core wall thing but here's a staff 3 and you do the rest but the
rest of the document very formative show screenshots of this tool that they'll released to do for update rate lots of Reveries who information like if you look at the the for the name of the file the former image right so you know if you find it the we maybe can do this process of figure out how you know a of they words in a model and very interesting things access rights supersede he command or it's 500 who knows what that does rape but whatever this thing is this process takes from were copies of from use the amplitude directly into purses search on a monitor with that's comical picked so we do
more going you know we find all sorts of things like Genesis energy probe and then this
hardware from the nineties rated this thing takes a pole of all power supply rate and that has a parallel port articles the VGA and some other mystery dongle every vendor due every manufacture monitor make something sort of secretly similar to this but it's not not the same and we found this in time monitors made you know like late nineties early 2 thousands of the by
modeling we find St microlens somehow symbolic in Alexis there been is a thing that you know as the micro makes and somehow all this stuff ended up in the dome monitors gay
so would love a global users will be found that the string after 3 that's what we started and that's part of the tool that G problem Genesis critical G probe OK I and this you know in the early 2000 appear to be very industry-standard type of software that people use to manage to solve running monitors they Morgan later and this is the story so Genesis Inc was the operating and at around 2002 they saw themselves to as the micro array but they're also the people who created you program and they were very high creating that face a standard for this protocol called DDC which of about right and then as the microbial genesis in 2008 radiates have their own IP and you Provan's stuff that they want to miss the other and created this strip called the DP 600 or 60 x and a hundred 80 x and then that was put into a looks forward and in x company that designed the screen controllers which is you know partially all by fast time and then later you del source ill-afford right into the dough monitor and this is kind of the reason why we have terrible security you know in modest Davison which mishmash of you know where this technology came from uh and you know
we got a copy of G probe just by looking around googling that's what it looks like
you know it has the ability to communicate to connect to the device in this case the monitor over your parallel serial USB basically the story is as long as there is some way to get onto the ITC bus of the monitor G protein of the the former and do all sorts of other diagnostics which is called they and then we took the use the former
tool uh we capture the use the traffic rate and now it's it's very noisy lots lots of traffic and this is the capture of what this snippet that of from Robert process and before we get into the details of that let me
just a brief story about DC DC stands for display data channel right it's the standard that new was created by a visa and there are many
versions in some versions of the uses there's the C version 1 to I think 3 and to be in some versions the of the plot the I plus a b blob about 1 else OK but now let's look at what I package that has this information looks like going over the years before so this
is a scuzzy command riches send using USB monsterous vertical away
and use B and then add this is another back at which encapsulates BDC to be back at our which has appeared on cheaper back on the which you can now you know up to ask about like history read are
and you wanna do like run board or anything like that this is a DDC Dewey I packet structure which contains a DDC destination sewers man of the CB prefix which is like which are open for ban and and cheaper message and checksums that back
so the nearly like how you do a small command and Dr. the mind about this very simple common from very simple and and it's basically I might ask hate I wanna talk to you by sending evasive vendor-specific see gold and I ask for uttered history as a SKOS as a space argument and and then a montage say is that I acknowledge that the 1 adopted me and our money to say but BCC is that I acknowledge that you acknowledge that the 1 about me so and and I also acknowledge that you want to do it is to read over so the last 2 packets is like end of transmission for the acknowledgment of the request coming and then again and then again that the mother BCC is our gap could you please give me a response by presenting a scuzzy command and then asking for a good response to me and say that I acknowledge that you want to get the response so it is that I acknowledge that you acknowledge that you want a response so here the responsible that's still told packets rates to do this very simple Cohen and we saw this over USB B you would figure that out and now we decided was time to take apart some 4 inches monitor and see what we see so you know that if you take a out of
off the back cover this is with the mayor are model look like by the logic analyser in the bus part did not come standard that hours that an air and yeah and I you know on the top you have all that standard power equipment grade on this side is this a little use the controller which will get back to it on the bottom is a USB hub and that they will thing with aluminum great heat sink that's the stuff that's the thing that we want to execute the code and then France or mapped
out all the different parts rate so the main and stock the STEP UP AT T 28 right out and right next to it is the multiplexer fry to see and connected to that ravier ITC is this USB 26 49 is programmable controllers such of rate and that's something that's on the side of the monitor that you can plug in a sea of you were connected on the left side of the ball exactly so that's that 1 is a dumb use the rate which will get to so when Japan's send this package Ray all as your become a packet what happened was the packet went through the USB hub so the reason why the 1st command is a undocumented scuzzy all sea of command is a goes up the hub to the 26 49 over USB rate and that puts that divides into like super sneaky cytosines Russia receive mode In the 2nd packet that you send rate if this were a format over your be break gets sent to the hub to the controller and the controller then takes the capsule is the packet takes the period near the raw ITC message right with the right and ITC bus and a sensor directly to the the the microcontroller that the stock rate and that's why you have so many packets basically you know you put this thing in that that the US you into does cancelation and this allows you to go whatever right it's a message you want onto the bus you can do ITC messages that you can come and communicate with the sock right and what should you do with that but merely for the
pore over we found that to make about this guy flash so we did the obvious thing dump the
flash and this is what a in-house of entropy analyzer that we haven't is renders essentially white is really random black is now a animal trainer just the right off the cuff you look at the image that's obviously some kind we're table structures were interested in that but this kind of looks like code grade 3 different segments of code who knows what it does probably data and it's a little village the and of this income you know that probably looks like some sort of compressed data so we're interested in what the the next obvious thing
is you know what's the strings rate and we found exactly what we found was defined with this analogs Morris grade is internal destination for the board class and guessing and effective from Rob they talk shows up with Mars that hex which is a small driver that allows you to communicate with the board but don't worry for 10 and you know if you look at the other commands rate you have really cool stuff like Yemenis were always the showed the hide is exactly the kind of functions that we wanna play with so we do the next obvious thing
it's like let's open up an idea or a and I didn't really like it and I don't
like Texas excited that's why you know the greatest didn't really do all the with that this assembly and the reason why is because this is terrible a 186 right which is and and all 16 bit 6 system that can extend to either a 24 bit 24 20 yeah 24 bits source said select so it does all sorts of funky stuff and don't really you know know what to do with it and then I go little I
heard of somebody 2008 exactly when it's the microbot genesis and all the stuff posted on overseas it with a very specific question about a very specific file some guesses somebody probably work in this in 2008 and Evora wrote a very reasonable response like this is you know how I the words and you know through all 186 is all the edges do this the and I look at it will
get a see section like I don't do the neuron going home and I'm not a fan of working with exceeds and general and then of
the year passes send Radio and succinct and uh naively was
sitting around and we really so we can this so
well as you know we what we want to know how the student computer words we have to do with the 6 I'm Israelite Arnold sets as go far right and then you'll find can respond ordered new
virtual there's a very long insightful explanation of exactly the winners of ITER and how to deter 186 and knew he was even as an disassemble Mars acts the IDD just show as a light blue the it's you just do this obviously so you know we we did it any of you know either
elite so many segments of the final you wanna see we fail was hard and then of fog and but please don't look at this
but it was like because that my basically and put cross-references in every function there was no was the and so I just added a hockey was it in place applications define the divergence and that
as documented in their probe on top that tradition we found was that history to which we can read any resisters with EAP anyway we want our so definitely there's good execution and this
is 1 of those commands we found it is undocumented through the DOE bit of which allowed us to put show on in there all see and in the maybe up there about 1 so keep in mind this is
all just straight standard gene probe interface spread has run code as read memory has right memory radius or legitimate communication were not exploiting so the next thing we would say that OK let's write a whole program OK so we found this really cool AP test 3 which is no way to run diagnostics and that this is always the file a filled rectangle right but but still rectangle with colored that's exactly 1 meningitis as those do run right let's plant shellcode and hijacking this that and then it works but was like really gross let that any of your little heart from
us that is the a worse but this is kind will look like we had to look at this and debug it for hours and hours and the on it'll make if you did that 1 little lowered wings by the way yet just what is science
science rate OK so far at this point this is what we know about the from where we got a moralist assembled you know we have this range of 8 0 0 0 0 to these 0 0 0 0 there and they and then we solve new pretty quickly that they're all these little far calls to the F 0 0 there's and we really cares about that because that's not part of the former gay and you know it's stuff something as part of the sort that the former of the process that is in touch and so I said Hollis that stumped some data definitely have a disagreed eigen dump data for your speed and get down the way for it down and on is very slow at this place was that 1 kilobyte everybody's on Indians so what about you have 120 Mbytes requires like stalled messages earliest us to to get right so that you can only extract up to 120 bytes it's 827 but something we comes out so while this
designating a sign marking the hardware so I figure maybe there's a way to do something with hardware maybe we can play with the GPI owes maybe we can axletree trait data using something else aside from USB maybe we can maybe you can find it if you feel that we can repurpose so I just use everything is available and I flip the bins and so I finally found
something I found 1 thing we can actually flipped the sprawling more out there we 3 others more later but at this point I 1 so with 1 I can do a sink cereal or something like that and then I can axletree data may be like a makerbot something which I did and we also figured might as well just hijack the printer function and some dynamic and and have a look at what's happening in the monitor
in real-time and extract some strings because we had no you by we can find it maybe that's fine play with maybe if their but at this point we actually see some activity when pressed buttons this did not take us anywhere but it's was worth a shot so further literally water
often something guys and cynical reimplemented your in GPI Ireland's monitor all the back and a 5 rate many came back at data in a worst rate how cool set and OK so we did some dumps very dynamic data coming out of modern finally and now we realize that 0 so Levitical going we realized we were really wrong about without about this former it's not always the from OK Pinellas and this over it really is all cm executables him for on-chip microcontroller and it turns out there isn't always the but inside the stock go cm and always tier 2 separate computing devices the is to effectively go to cost writing in the red part is with all I ran and purpose of Ireland is it's an actual wrong that's sits inside the chip that acts as a driver that allows the all cm controller to come to connect to work with the always the controllers right was all done through shared memory and you make of space is a tiny little network inside a tiny light using our you know I'm on and there so many cool things to do in this monitor you can do
actually PAP bridges display inside itself but you can display to screen someone go there and then we use we had that like a we go over like a million years rate and we find this piece of
gold itself what is the stock 88 . com its definition of a place where you want to go to include link to the end but you should click on every single link because it's such a great website but it does have a the datasheet for exactly the chip that were looking for so this chair you know and what is a she will learn a upon about internal as in all the registers and then stuff that we never thought we knew we would find it had little microcontroller inside the monitors they so with with that you know the document with his glasses of core execution were late were ready to put at least pick a single pixel on the screen the call we won the location rates are like let's display of
pictures and the following 3 questions we have asked for a was the 1st version weighted transport
image right the 2nd question is like how how the display the transform it was together with the 1 and also 1 of the colors on the colors work that is you know what it is it like a compressed images that J peg know was the format of each pixel was a form of of the image excetera so
you know we we we will look at if you plug the power into the monitor nothing happens in connect anything to it the dollar comes of this is kind the monitors boots going and you know as we saw that a really will this thing must be like in the forward right and after many constructive you know sober and
and highly productive discussions area between John and I we we're just looking at the static
stuff and you know John line that's obviously covered yeah you know so maybe this picture knows but unlike well below the all like what is that really maybe that's a good thing you know and there are some great hand if you stare at this thing for
long enough like cattle why does is to me when it does like crazy things that you will bring it get you more drawn right so we're doing this in France or in Italy
guys like this things and was made by preferred to just press buttons and see what's happening some pressing buttons and dumping at the same time because of this we don't pronounce some dumping always information from to compare what's happening in random with stable 1 what's changing some to see evening and get a better picture of happening so a lot of great dynamic data as things are happening as men user coming up and down so we get to we get this which was undeceiving numerable John's been analyzing those information for so long uses comes in point this in France what that was definitely a command or is this kind of you get that is there so this is
our command control structure of UST are you can specify the climate system and the size of the image you want to display are you what which quality you want and and then you can also compress the image and you know expanded in the West itself and
so this is an interesting works on the OCM on stocks to be always the sends commands and speed our controls such as informed forms of 2 there like 3 or 4 structures you send out to the main gene and that that's how we fixed on transfer and display image and this this is a candidate if you if you passed this you will be able to display our thinking box and get epilepsy or something but that's a bit too would
be eyes which are required are which is an as yet and lead to which you can leave waters and the always as France and the right EVI and that's what
happens when there were getting better at doing this look it's getting cute here rate still blinking when you want it's so
you it yeah blinking fast in our genome-wide is a going faster than before but I don't know what
a quick of I was of no points but it it's really grows if you look at it this does make notches so you see this I'm able to like move the command box now and I was really happy and those weeks of work within a week of work and we can think what's this is from the cells in the
OK so we have 1 2 down the all we need to know is the count of that like form of picture you know what is the color of packet data were done with the display whatever we want so we
fill the buffer worth incrementing values are like 0 1 2 3 and then you know we got that which is that no expected right because they were expecting you know maybe like very slightly different colors because removing you know 1 bite at a time to you 1 bit really that's no haven't base so we looked at that relate and the way we
understand the size that these were scientists so we took a microscope I would put it right in the
model I wouldn't display by will look away example comes out a pixel and we're figures 1 hour a week the called that color and the comma in there which 1 do it for and have a finite book yeah exactly that's also another layer of R and the other 1 on it's not as can be seen both grows
and then so I've never seen this before that that's really cool because Eulalie saying that are array which is dot the g in the beta labels 3 things is a single pixel cell OK and know the value we put up there is always 3 3 0 3 3 3 3 3 3 3 so same colors and patterns and know it's we now we give each each individual RGB like RGB value through this all microscope and that's well we got so instead of
the same value was cellulases you 3 3 0 0 3 3 0 0 and a and this is what we got here on the on the microscope so for 1 super amazing thing on that would run a demo on you when is the answers question right k how many bits per pixel is it the word and 6 now yet so we were putting in the word 3 3 0 0 3 3 0 0 0 on getting this thing on the string 24 % of its who added to for it I can you actually don't
for this but it's a but I thought I can nominal would you do regret that 32 bits right there is a bit odd that there's a bit green and a bit linear but so how can you encode using 4 but obviously like you have to use some kind of comic of able and we went through the documentation that's what we use but this is that so you get access to the full system you get access to 16 arbitrary tatoeba college so you can display any color of your choice 16 guy lavatories rate and Anzio we found out in later that it is the transparency and so where is the column a
bit logical and what we found is that when you go have
16 colors but each color is actually 32 bit the right so you can do all the colors you want to is limited by the number of colors you can use any image going right so
called you know let's find a color look-up tables modifiability we can change the colors they and then orally or how we do that and
the inference of the of course I'm obsessed or so it seems so just but this point we we found out there an excellent external as the RAM which is like more data dumps and perfected the the procedure and now we can dump all 128 megabytes of external as the Rams trying to see what's in there for you find images were from find more mn and we continue will continue to work with they're the that the OCM from with mapping STEM so that it's also it's sex right so we will also work really hard all you're doing this obviously the way so this 1 for a long time In like 2 days later we all find
we're looking for I squared is and then it
turns out it's exactly the same OK so it's the same as the how the command goes from those him processor to those the so basically there's a color look-up table that sits inside all cm from 1 a function loads it sets of a DMA engine and the 40 images inside the full parser and it puts it into that's sermon at the DOA the page set deposit and does magic right so this is world
1 OK like we actually will do frame with former on management the loaded and displayed put where we want so we made this whole unicorn and that it's a rainbow has a title as locks that comes out of it because now we can do as many as a lot as we like and put it anywhere we want and that's why this year magic come in all this work for just making a unique on fire but with locks for crypto it's good OK so at this point you know I'm very
happy I'm not worrying raised flagrant later Friday nite they I go John and the the that's a lot 16 colors to those look great you know the the colors and so high on it's really have have but we when we look
around and we saw that daddy high would that support the we but public so but we
like instead of finding this I found a peak was so a bit thread that allows it happens 16 1256 scholars suggest deftly enough for that you and that is a that I found out how to put break points and the chip and then begin to dynamic analysis and figure out like how with every call is working and so you
can answer Newport batch so if you would have found this before it is of like a 1 enactment work it would have been only a week maximum we found this little lower 95 % that 1 is work right and if we use this from day 1 it would have been the soul of much less this is we have to scroll through all the pages menus not PDO so loads slowly 1 page of times and you have to give them equal to downloaded the is literally all the colors something terrible used that race early had tabulate breakpoint
following with the notes that working very it
so because I don't drink so just keep working with the someone workers I get some interns images keep we just keep working at until we figure out pretty much everything except for the 256 colors but that'll come and this point yeah and dumping more and more and to the point where we actually can put in AGI together and get something working so we have all the stuff the organ show and so more into this sleepy begins Callen and so some of the screen and everyone knew that so they get it to load image put it to a different place we have a really call them and talk about until later but match is literally the next like we
found is really amazing treasure OK so somewhere deep in the code addresses vertical crack pixels rate and you know the hard hammer expectation was that those job is to put pixels on the screen to overlay menus and whatever but apparently it can also see every pixel to like why has the power I don't really know what's cool fact it's their means you can have a piece of software that will to the string and also manipulate the so use imagination and maybe you can track where things are the screen and change them dynamically who knows and so in the end in review
right we were able to change every pixel we can see every place on the screen and uh this is uh the thing which we did call fund had I don't really have much time to actually at the level of it and so the idea of and had is to take the
software and use the the very ubiquitous harbor find all these embedded devices in order to turn those devices into data transmitted they rated transporters and in this case we adapted from Sparse Code trilogy BIO with a longer tracer along the table on the board which was long enough for us to transmit something probably a few meters away so probably outside this rooms and then saw flipping just a single GPL and and you know this is gonna call because this is building off of the markers stuff he did right from the Vedic freaking to you don't then freaking LCDs and here we now have the power to compute on the data on the screen and then use going itself actively transmit not just the raw content of the screen with the computer metadata defined on the screen and over here is a cheap TV antenna that's an internal rate at were transmitting somewhere like 16 megahertz rate uh subtlety and that's that code is also you in the and get OK so and of talk were going to so I don't Bryan Russell led them oscillate gently this is what
Greek would society we'll get there was from so the poster back at the we call of it it's a very special about our College Chapel back but if you if you remember it all from presentation that is in the amount of concern and Chickie ahead and so I'm to the promise we deem promising made promise a we would use this for the devil ahead its sorry and but how I should also explain that the use the armory rate of with all over POC go it's busy running Linux and it's just doing all that use the traffic that we were talking about before so if you want if you upon if you want a random guy and I just want move watching you can use our API downloaded on get out and you are getting this better also we can get rid of him half the users they have this that's creative commons whatever it's not let me let me give us a packets that's right the 2nd 1 it the so that means go and get a very informative this for a discussion that side well
so that's a nice demo excited I have to this
if the so as we all know about
this if this website but it has it is very informative as I have learned all these years our but it is missing it is it is always miss 1 thing which is less than a given it that led John do every day you go it In the years yes I did did everything you think you know what I wanna see everything's OK that's OK the very little of the last last demo the big you know so this is a little
less this so this is just a screenshot of you you know there's no factory behind this thing but have you know maybe there's a familiar this is with your typical HMI human machine interface will look like as a graphical interface to something like and thus a process thing right you have computers controlling uniflorous obtains involve and that all reporting that growth and status and generally speaking you green is good and red is bad right and you know when you have a red light on a big tanker whatever you know its promise unusual into people probably freak out so just look at the screen and K was who haven't done to see if the pattern there you go right so instead of going after the nationwide that the PLC is the network you know what if you wanted to influence human behavior just on the monitor good luck tracking that count rate I and URIs rate so that's so that's heard demos only have 1 moment at for all bonuses refinements are proof of concept we just put it in the are as follows located on demands obedience we go wrong the 1st time consuming the amusement we're probably uses of was just whichever comes 1st opaque so you know let's talk a little bit about the implications of this thing I know how big is the problem OK so we actually had some folks look into the business and of this and we estimate that the over last 10 years that we've made over billion monitors trade and I would guess by by a large majority the monitors that we have work in some ways very similar to this dominant in the sense that hasn't always the controller and you could put a menu thing on the screen and runs software rate that drives that system so yeah pretty much everywhere models probably vulnerable to this or some variant of this day very and that's a problem and you know how practical is this attack for your uh help radicals attacks of of vectors so if you notice that the way we did this had we had to physically plug in a USB cable rate and that's how the use speech ITC interface work but i and keep in mind the 1 the DDC to in the DTC commands were originally designed to do the go back over all the data channels including VGA nation in my uh so there's always a possibility that that commenting go through that the channel and also gray as soon as you have access to the ITC but even if he didn't have a legitimate you know we bridge they got you there were however you got how we get there as long as you and ITC bison you working with something similar to this right you should be able to you know do something like what we've done here and he noticed a very modern the very new 34 inch curve monitor with the USP to ITC solution right I mean that tells me that maybe that the board is not exact the same in the former versions of different but they were so using this methodology of you know getting some bridge to touch ITC in order the parties answering controllers to do something like a from a of the and uh so the user beware how realistic will be if with the fixed the if there was a fixed and know I thought this 1 through a little bit rate so in order to fix this thing you either have to do something like a physical recall of the billing models which they're happening or you have to release the suffer update to fix the issue which means probably you have to do something similar to our you know our path rate or you have the release the former update process right to all the users of the world which will actually help the adversary the back as fashion helps a good that's great because you know the reason why we can do this and 104 models states is we have a higher monitors but if you release the the way uniform from wrote that is done and everything then that's probably not good so the way we fix it is when the slightly tricky and and uh we haven't
put the code up and get out of the word in nebulae were actually do it today that's supposed to be a link the we're will definitely and and uh this is like no Francis that all of the code that we we came up with all the code that you ran demo and a lot of documentation of the API as we found new ways of using graph pixel ways of displaying images in our ways of doing front and stuff and you know so let's great please contribute if you if you like this work you know take apart your monitor take part in France monitors theory see was society this year this is 1 set of data points and obviously there's thousands of different manufacturers for monitors and poly tens of thousands of different from word versions bubble plot that you know if we started getting more data points you would probably get a better idea you know how widespread this type of attack can be and then you know lastly really were now and during that time you know where we probably have to download the pesos coming out of a screening test is yet another secured from where the worry about rate and that's not great so you know if we can come together and try to fix this problem and some tangible way that of the most excellent so in conclusion greater happiness the story we spotted owl and as of
yesterday Dell has not released the security their to fix the shark attack so that's so gonna happen and many
monitors were harmed in the making of this presentation and uh but the bed that the
happy ending is the Chris now lives happily with this set my unmodified 34 inch mile uh so you got our no that's not dead so that's it are there questions the yes the the yeah the old old high that the yeah thanks so the chair that have we never met so it is made up of words that have to be in the 1st edition how much alcohol was consumed during you know on january think it's cool and how much of it was consumed the the making this presentation 25 bottles of wine out of its I would say that you want but they will you know they clearly got the Japanese so the and 2nd that he mentions that you have to use me about the deal control accusing Desert Eagle Cottle tool to talk directly in the D G C R so that's the next thing that we will look to any started to look at a a clear now we we Newton's sufficient so last year that's a big over the western great and I like a city in any prefer on a monitor that gets you on ITC bison there what we do it rate will probably be able to get you to the this call it any other questions this trend yeah the reader min program have the
Gamecontroller
Zustand
Vorlesung/Konferenz
Computeranimation
Gamecontroller
Wasserdampftafel
Computeranimation
Demo <Programm>
Flächeninhalt
Mereologie
Flächeninhalt
Gesetz <Physik>
Computeranimation
Metropolitan area network
Internetworking
Videospiel
Computersicherheit
Vorlesung/Konferenz
Router
Verkehrsinformation
Computeranimation
Office-Paket
Extrempunkt
Green-Funktion
Physikalischer Effekt
Browser
Computersicherheit
Gruppenkeim
Physikalisches System
Bitrate
Bildschirmsymbol
Computeranimation
Kernel <Informatik>
Verknüpfungsglied
Chiffrierung
Minimalgrad
Rechter Winkel
Kryptologie
Bildschirmfenster
Virtuelle Maschine
Pixel
Booten
Browser
Gewichtete Summe
Sprachsynthese
Booten
Bitrate
Hacker
Computeranimation
Office-Paket
Touchscreen
Offene Menge
Software
Informationsmodellierung
Bildschirmmaske
Kugel
Druckertreiber
Flächeninhalt
Booten
Druckertreiber
Computeranimation
Einfache Genauigkeit
Office-Paket
Service provider
Variable
Datenverarbeitungssystem
Konvexe Hülle
Stab
Hill-Differentialgleichung
Bitrate
Computeranimation
Leistung <Physik>
Office-Paket
Energiedichte
Informationsmodellierung
Prozess <Physik>
Rechter Winkel
Dateiformat
Wort <Informatik>
Bildschirmsymbol
Culling <Computergraphik>
Elektronische Publikation
Figurierte Zahl
Quick-Sort
Bildgebendes Verfahren
Computeranimation
Polstelle
Informationsmodellierung
Hardware
Dongle
Bitrate
Parallele Schnittstelle
Quick-Sort
Computeranimation
Protokoll <Datenverarbeitungssystem>
Computersicherheit
Programm
Quellcode
Codierung
Computeranimation
Temperaturstrahlung
Rechter Winkel
Software
Datentyp
Mereologie
Standardabweichung
Zeichenkette
Touchscreen
Motion Capturing
Diskrete-Elemente-Methode
Prozess <Physik>
Einheit <Mathematik>
Rechter Winkel
Datensichtgerät
Bus <Informatik>
Serielle Schnittstelle
Bitrate
Parallele Schnittstelle
Quick-Sort
Computeranimation
Sinusfunktion
Monster-Gruppe
SCSI
Adressraum
Versionsverwaltung
Plot <Graphische Darstellung>
Information
Druckertreiber
Computeranimation
Datensichtgerät
Einfache Genauigkeit
Lesen <Datenverarbeitung>
Parametersystem
Datentransfer
Bitrate
Whiteboard
Raum-Zeit
Computeranimation
Homepage
Überschall
Message-Passing
Endogene Variable
Datenstruktur
Kanal <Bildverarbeitung>
Message-Passing
Metropolitan area network
ATM
SCSI
Logikanalysator
Subtraktion
Mikrocontroller
E-Mail
Bitrate
Frequenz
Code
Computeranimation
Gradient
Rohdaten
Rechter Winkel
Minimum
Mereologie
Vererbungshierarchie
Kontrollstruktur
Dateiformat
Bus <Informatik>
Vorlesung/Konferenz
Message-Passing
Leistung <Physik>
Standardabweichung
Flash-Speicher
Subtraktion
Rechter Winkel
Volumenvisualisierung
Entropie
Datenstruktur
Bildgebendes Verfahren
Code
Quick-Sort
Computeranimation
Gradient
Tabelle <Informatik>
Schraubenlinie
Webforum
Lineares Funktional
Sechsecknetz
Klasse <Mathematik>
Kraft
Mathematik
Bitrate
Information
Codierung
Whiteboard
Computeranimation
Gradient
Druckertreiber
Ein-Ausgabe
Ganze Funktion
Zeichenkette
Bit
Lemma <Logik>
Rechter Winkel
Endogene Variable
Wort <Informatik>
Physikalisches System
Quellcode
Extrempunkt
Elektronische Publikation
Quick-Sort
Computeranimation
Transinformation
Einheit <Mathematik>
Datenverarbeitungssystem
Fächer <Mathematik>
t-Test
Wort <Informatik>
Garbentheorie
Turbo-Code
Computeranimation
Lineares Funktional
Siedepunkt
Default
Skript <Programm>
Kartesische Koordinaten
Analysis
Computeranimation
Softwaretest
Radius
Telekommunikation
Bit
Rechteck
Programm
Elektronische Publikation
Code
Computeranimation
Rechter Winkel
Festspeicher
Gerade
Standardabweichung
Schnittstelle
Spannweite <Stochastik>
Prozess <Physik>
Punkt
Eigenwert
Mereologie
Systemaufruf
Speicherabzug
Bitrate
ROM <Informatik>
Message-Passing
Quick-Sort
Computeranimation
Lineares Funktional
Punkt
Hardware
Vorzeichen <Mathematik>
Gerichteter Graph
Computeranimation
Trennungsaxiom
Punkt
Wasserdampftafel
Mikrocontroller
Bitrate
ROM <Informatik>
Raum-Zeit
Computeranimation
Druckertreiber
Software
Rechter Winkel
Datenverarbeitungssystem
Festspeicher
Mereologie
Speicherabzug
Speicherabzug
Zeichenkette
Offene Menge
Pixel
Datensichtgerät
Kreisring
Systemaufruf
Einfache Genauigkeit
Bridge <Kommunikationstechnik>
Mikrocontroller
Bitrate
Binder <Informatik>
Computeranimation
Datenverarbeitungssystem
Speicherabzug
URL
Touchscreen
Gewicht <Mathematik>
Pixel
Booten
Jensen-Maß
Datensichtgerät
Versionsverwaltung
Solitärspiel
Computeranimation
Rechter Winkel
Dateiformat
Kantenfärbung
Bildgebendes Verfahren
Leistung <Physik>
Punkt
Flächeninhalt
Diskretes System
IRIS-T
Information
Biprodukt
Computeranimation
Bit
Quader
Datensichtgerät
Wärmeübergang
Koordinaten
Zeiger <Informatik>
Computeranimation
Bildschirmmaske
Wärmeausdehnung
Datenstruktur
ATM
Dynamisches RAM
Kontrollstruktur
Information
Datenstruktur
Bildgebendes Verfahren
Pixel
Spezialrechner
Punkt
Quader
Wasserdampftafel
Wärmeübergang
Zellularer Automat
Vorlesung/Konferenz
Bitrate
Gleichheitszeichen
PASS <Programm>
Computeranimation
Puffer <Netzplantechnik>
Bit
Bildschirmmaske
Rechter Winkel
Datensichtgerät
Kantenfärbung
Zählen
Computeranimation
Informationsmodellierung
Pixel
Finitismus
Datensichtgerät
Mustersprache
Zellularer Automat
Einfache Genauigkeit
Kantenfärbung
Figurierte Zahl
Computeranimation
Demo <Programm>
Bit
Pixel
Green-Funktion
Physikalisches System
Bitrate
Computeranimation
Linearisierung
Wort <Informatik>
Kantenfärbung
Brennen <Datenverarbeitung>
Auswahlaxiom
Zeichenkette
Nominalskaliertes Merkmal
Mapping <Computergraphik>
Bit
Punkt
Inferenz <Künstliche Intelligenz>
Rechter Winkel
Speicherabzug
Nummerung
Kantenfärbung
Algorithmische Programmiersprache
Bildgebendes Verfahren
Computeranimation
Tabelle <Informatik>
Lineares Funktional
Punkt
Parser
Computeranimation
Homepage
Stochastischer Prozess
Datenmanagement
Rechter Winkel
Last
Kryptologie
Kantenfärbung
Bildgebendes Verfahren
Tabelle <Informatik>
Tabelle <Informatik>
Programm
Bit
Punkt
Diskretes System
Raum-Zeit
Systemaufruf
Textur-Mapping
Dateiformat
ROM <Informatik>
Computeranimation
Datensichtgerät
Physikalisches System
Gamecontroller
Kontrollstruktur
Thread
Surjektivität
Kantenfärbung
Figurierte Zahl
Pixel
Analysis
Punkt
Matching <Graphentheorie>
Extrempunkt
Selbst organisierendes System
Ausnahmebehandlung
Web Site
Computeranimation
Homepage
Last
Kantenfärbung
Stapelverarbeitung
Bildgebendes Verfahren
Touchscreen
NP-hartes Problem
Pixel
Adressraum
Bitrate
Overlay-Netz
Code
Computeranimation
Übergang
Arithmetisches Mittel
Erwartungswert
Knotenmenge
Prozess <Informatik>
Software
Leistung <Physik>
Touchscreen
Zeichenkette
Content <Internet>
Systemaufruf
Schwach besetzte Matrix
Kombinatorische Gruppentheorie
Bitrate
Whiteboard
Code
Metadaten
Datenverarbeitungssystem
Meter
Ordnung <Mathematik>
Touchscreen
Tabelle <Informatik>
Leistung <Physik>
Demo <Programm>
Maschinenschreiben
Bit
Demo <Programm>
Subtraktion
Punkt
Prozess <Physik>
Versionsverwaltung
Vektorraum
Sprachsynthese
Bridge <Kommunikationstechnik>
Polygon
Physikalische Theorie
Code
Whiteboard
Computeranimation
Weg <Topologie>
Informationsmodellierung
Software
Datentyp
Uniforme Struktur
Mustersprache
Radikal <Mathematik>
Kurvenanpassung
Bildgebendes Verfahren
Hilfesystem
Touchscreen
Schnittstelle
Softwaretest
Pixel
Benutzeroberfläche
Graph
Zehn
Güte der Anpassung
Plot <Graphische Darstellung>
Physikalisches System
Vektorraum
Binder <Informatik>
Bitrate
Menge
Rechter Winkel
Datenverarbeitungssystem
Beweistheorie
Mereologie
Wort <Informatik>
Benutzerführung
Faktor <Algebra>
Ordnung <Mathematik>
Aggregatzustand
Offene Menge
Kernel <Informatik>
Hydrostatik
Domain <Netzwerk>
Konfiguration <Informatik>
Extrempunkt
Radikal <Mathematik>
Programm
Bildschirmfenster
Analysis
Chirurgie <Mathematik>
Computersicherheit
Punkt
Druckertreiber
Hacker
Folge <Mathematik>
Dichte <Stochastik>
Reverse Engineering
Computersicherheit
Kryptologie
Dualitätssatz
Systemaufruf
Prognostik
Spieltheorie
Debugging
Computervirus
Bitrate
Optimierung
Software
Twitter <Softwareplattform>
Menge
Framework <Informatik>
Mailbox
Translation <Mathematik>
Adobe Acrobat
Formale Semantik
Explosion <Stochastik>
Multiplikation
Kontrollstruktur
Stochastischer Prozess
Dezimalbruch
Virtuelle Maschine
Kraft
Ablaufverfolgung
Nummerung
Kombinatorische Gruppentheorie
Mathieu-Differentialgleichung
TUNIS <Programm>
Systemprogrammierung
Physikalisches System
Proxy Server
Datennetz
Stochastische Abhängigkeit
Transaktionsverwaltung
Hardware
Programm
Physikalischer Effekt
Ortsoperator
Binärcode
Gasströmung
Sichtenkonzept
Kombinatorische Gruppentheorie
Office-Paket
Wort <Informatik>
Vorlesung/Konferenz

Metadaten

Formale Metadaten

Titel A Monitor Darkly: Reversing and Exploiting Ubiquitous On-Screen-Display Controllers in Modern Monitors
Serientitel REcon 2016
Teil 14
Anzahl der Teile 20
Autor Cui, Ang
Charbonneau, Francois
Kataria, Jatin
Lizenz CC-Namensnennung 4.0 International:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
DOI 10.5446/32747
Herausgeber REcon
Erscheinungsjahr 2016
Sprache Englisch

Inhaltliche Metadaten

Fachgebiet Informatik
Abstract There are multiple x86 processors in your monitor! OSD, or on-screen-display controllers are ubiquitous components in nearly all modern monitors. OSDs are typically used to generate simple menus on the monitor, allowing the user to change settings like brightness, contrast and input source. However, OSDs are effectively independent general-purpose computers that can: read the content of the screen, change arbitrary pixel values, and execute arbitrary code supplied through numerous control channels. We demonstrate multiple methods of loading and executing arbitrary code in a modern monitor and discuss the security implication of this novel attack vector. We also present a thorough analysis of an OSD system used in common Dell monitors and discuss attack scenarios ranging from active screen content manipulation and screen content snooping to active data exfiltration using Funtenna-like techniques. We demonstrate a multi-stage monitor implant capable of loading arbitrary code and data encoded in specially crafted images and documents through active monitor snooping. This code infiltration technique can be implemented through a single pixel, or through subtle variations of a large number of pixels. We discuss a step-by-step walk-through of our hardware and software reverse-analysis process of the Dell monitor. We present three demonstrations of monitoring exploitation to show active screen snooping, active screen content manipulation and covert data exfiltration using Funtenna. Lastly, we discuss realistic attack delivery mechanisms, show a prototype implementation of our attack using the USB Armory and outline potential attack mitigation options. We will release sample code related to this attack prior to the presentation date.

Ähnliche Filme

Loading...