Registry-Stored Payloads for USB Rubber Duckies
Lim Jing Qiang examines using the rubber ducky to deploy a large payload in an air-gapped environment is no easy feat.
Summary
Architecture and Background
Lim Jing Qiang present 'Registry-Stored Payloads for USB Rubber Duckies' at DEF CON SG1 CSIT Village, detailing technical frameworks, attack surfaces, and core methodologies in rubber-ducky, usb-attacks, payload-delivery, air-gap.
Vulnerability Analysis
The technical analysis dissects structural design flaws, protocol vulnerabilities, and edge cases uncovered during rigorous research.
Exploitation and Demonstrations
Using the rubber ducky to deploy a large payload in an air-gapped environment is no easy feat. This talk introduces a way of leveraging USB descriptors to store large payload in the Windows Registry and retrieving it through keystroke injection.
Remediation and Defensive Strategies
Security practitioners and defenders receive actionable defensive controls, hardened configurations, and threat detection strategies to mitigate impact.
Related talks
botconf eu·45 min
Presenters detail vulnerability discovery and exploitation in P17 - Air-gap limitations and bypass techniques.
Main Track 1·18 min
Romain Coltel, Yves Le Provost
Exploiting WSUS update infrastructure to control targeted systems from a compromised domain.
CSIT Village·13 min
Daniel Siok
Daniel Siok examines what does an air-gapped system really mean in practice.