USB credential stealing while Windows/Mac OS X screen is locked in just 13 seconds

A Security researcher has discovered a unique attack method that can be used to steal credentials from a locked computer (but, logged-in) and works on both Windows as well as Mac OS X systems.

Security expert Rob Fuller demonstrated and explained how to exploit a USB SoC-based device to turn it into a credential-sniffer that works even on a locked computer or laptop.
Fuller modified the firmware code of USB dongle in such a way that when it is plugged into an Ethernet adapter, the plug-and-play USB device installs and acts itself as the network gateway, DNS server, and Web Proxy Auto-discovery Protocol (WPAD) server for the victim's machine.

The attack is possible because most PCs automatically install Plug-and-Play USB devices, meaning "even if a system is locked out, the device [dongle] still gets installed."

"Now, I believe there are restrictions on what types of devices are allowed to install at a locked out state on newer operating systems (Win10/El Capitan), but Ethernet/LAN is definitely on the white list."

Why your computer automatically share Windows credentials with any connected device?
That is because of the default behavior of Microsoft Window’s name resolution services, which can be abused to steal authentication credentials.

The modified plug-and-play USB Ethernet adapter includes a piece of software, i.e. Responder (available at github), which spoofs the network to intercept hashed credentials and then stored them in an SQLite database.

USB Armory ($155)
Debian/Jessie - https://github.com/inversepath/usbarmory/wiki/Starting#preparing-your-own-microsd-card
Kali on USB Armory - http://docs.kali.org/kali-on-arm/kali-linux-on-usb-armory
Resizing the SD partition - http://base16.io/?p=61

Hak5 Turtle ($49.99)
Turtle video guides and wiki: https://lanturtle.com/wiki/#!videos.md


The hashed credentials collected by the network exploitation tool can later be easily brute-forced to get clear text passwords.

If you watch Mr. Robot Season 2 Episode 9  USB Rubber Duckie is similar to this method  with Angela venturing onto the FBI floor of the Evil Corp offices to plant the exploit-laced femtocell.

 

Apparently, to conduct this attack, attackers would require physical access to a target computer, so that they can plug in the evil USB Ethernet adapter. However, Fuller says the average time required for a successful attack is just 13 seconds.

Watch the video demonstration below that shows Fuller's attack in action.





Fuller successfully tested his attack against Windows 98 SE, Windows 2000 SP4, Windows XP SP3, Windows 7 SP1, Windows 10 Enterprise and Home (but not Windows 8), as well as OS X El Capitan and OS X Mavericks. He’s also planning to test it against several Linux distros. 

Fuller tuts explains in his blog post.

Read More

How to make a bootable Kali Linux 2.0 USB with persistence that save files

So, you want to change the settings, update, and save some files in Kali Linux Live USB without losing your work.

How to make a bootable Kali Linux 2.0 USB with persistence. Persistence means that all the data changes that take place while you are using the system, they will be saved on the usb / pendrive that you Linux is in.

Reasons for using Live USB with Persistence are:

• · You use all of your system resources eg. CPU, RAM, GPU, etc
• · You take no space of your Hard Drive for it.
• · You can take your OS to any PC you use.

Requirements:

1. Universal USB Installer : www.pendrivelinux.com/universal-usb-inst­aller-easy-as-1-2-3/

or Rufus Faster bootable maker : https://rufus.akeo.ie/


2. Kali Linux Image : https://www.kali.org/downloads/

3. MiniTool Partition Wizard : www.partitionwizard.com  
OR http://download.cnet.com/MiniTool-Partition-Wizard-Free-Edition/3000-2094_4-10962200.html

 OK  LET'S START...


1. DOWNLOAD KALI LINUX ISO AND MAKE A BOOTABLE LIVE KALI

 3. CREATE 2 PARTITION WITH MINI TOOL

1. Select your USB drive with Kali Linux  right click  and choose  Move/Resize
  I resize mind 3.2 gig

 
2. Click the Unallocated rigth click to create new partition.

3. Name the partition label  "persistence" , create as "primary" , file system "Ext4" , cluster size "default" .

4. Click "Apply"  check .. and then click Yes.

Wait 10 minutes or more...

4. BOOT FROM YOUR NEW KALI LINUX LIVE USB PERSISTENCE
OPEN THE TERMINAL (CMD LIKE)

Commands Used In Kali :

UUI is the drive name change with your own drive name label

1. fdisk -l : To List Your Drives

2. mkdir -p /mnt/UUI : Make a directory on the filesystem to mount your USB

3. mount /dev/sdb2 /mnt/UUI : Mount the partition on the directory you made

4. echo "/ union"> /mnt/UUI/persistence.conf : Adds a configuration file to enable persistence.

5. umount /dev/sdb2 && reboot : Unmount the partition and reboot.

OK DONE!!..

When Kali as password type : toor
user name is : root



You might also like :

• Top 10 Wifi Hacking Tools
• How to Fix Kali Linux "Unable to locate package"

Read More

SanDisk SDDD2-032G 32GB OTG Dual USB Drive 3.0

Having your files everywhere is a great advantage for people who are constantly on the move or traveling. That way, you won’t be neglecting your work or projects even when you’re away from the office or school. Aside from Cloud storage, flash drives, portable external hard drives, and sometimes even your smartphone or tablet, have been the reliable devices when it comes to this purpose, but the SanDisk SDDD2-032G 32GB OTG Dual USB Drive 3.0 (Black) goes beyond the capability of a flash drive.

Massive storage for your convenience
Like any other flash drive, the SanDisk OTG Dual USB Drive saves and stores your important files with its nifty 32GB storage memory. It’s also made user-friendly because you won’t need a CD driver to use the flash drive, as it is automatically detected when connected to a computer, whether you’re using Mac or Windows. What sets the SanDisk Ultra SDDD-032G is the Dual USB connectivity it allows--on one hand it features a USB 3.0 for your computer, and on the other, a micro USB for your Android tablet or smartphone.

Getting more from your USB and Android device
With this thumb drive, you can easily move files from your Android smartphone or tablet to your computer, thus freeing up space on your device for other applications and files like music, photos, videos, or messages. Furthermore, you can download the SanDisk Memory Zone application and organize your stored files on internal and external device for better management and easier viewing. Thus, you can keep tabs and get a hold of of your important data faster.

The Right Accessories for your Computer
It's time to go ahead and grab the right accessories for your computer. You can choose from data cards to printers, from foldable laptop tables to mouse and keyboards, as well as audio accessories to make your user experience better than ever.

Technical specifications:

• Capacity: 32GB
• Interface: Micro-USB and USB 3.0 connectors
• Backward-Compatible with USB 2.0
• Transfer speed up to 130mb/s
• Plug and Play
• Device/OS compatibility: Windows Vista, Windows 7,Windows 8, Mac OS 10.6+
• USB 3.0 allows up to 10x faster file transfer
• Longer microUSB connector for Android Smartphones with cases

SanDisk SDDD2-032G 32GB OTG Dual USB Drive 3.0
₱ 469.00
Before ₱ 999.00,
You save 53%

Order Here!!-> http://ho.lazada.com.ph/SHFTtZ

Whether you're a student or professional, browse and shop at Lazada's Computer & Laptops section to save you time and money.

Read More

USB Killer 2.0 by Dark Purple is More Powerful to Damage any Computer

A Russian security researcher nicknamed Dark Purple devised a weird USB stick that is capable of destroying sensitive components of a computer when plugged-in. Dark Purple, has launched a new version of his computer-frying USB Killer pendrive – USB Killer version 2.0.

USB Killer 2.0 is much more powerful than the previous version and is able to "kill" more than just a PC it is plugged in.

The first version of USB Killer was consist of a DC/DC converter, a few caps and an FET. When plugged into a system, the converter in the USB Killer would charge the caps up to -110V, apply that voltage to signal lines of the USB interface, and repeat the entire process until everything possible in the computer is broken down.

However, the second version of USB Killer dump -220V directly onto the signal lines of the USB interface, which is powerful enough to damage practically any computer with a USB port.
Another major improvement in the new version of USB Killer is the reaction rate. Once plugged into a computer, USB Killer 2.0 takes only a few seconds for the PC to shut down and stop working.

Proof-of-Concept Video Demonstration
While testing his USB Killer 2.0 stick, Dark Purple destroyed his brand new Lenovo Thinkpad X60 laptop. You can watch the video demonstration given above that shows the attack in work

"Do not worry about the laptop, the new motherboard is on the way - and the laptop will live again," Dark Purple wrote in a blog post. "Originally did not plan to restore it, the laptop was purchased specifically for the test."

So it's not false to say that a computer could be converted into a bomb because a hacker can probably make your computer explode as well.

Therefore, next time if you find a USB stick that doesn't belong to you, just beware before inserting it into your laptop. You could lose your Laptop, along with all your important files and data stored in it. I recommend use USB port HUB  do not plug Unkown USB Pendrive directly to your PC/Laptop USB port.

Killer USB is not at all a new concept, USB drives are used as a valid weapon to compromise the system in air-gapped networks.

When creators of the state-sponsored Stuxnet worm used a USB stick to infect air-gapped computers inside Iran's heavily fortified Natanz nuclear facility, trust in the ubiquitous storage medium suffered a devastating blow.

 You might alos like to read:

• BadUSB Exploit -Thumdrive that hacks computer

Complete Circuitry Interface USB Killer

For Educational Purposes Only!!
source: http://habrahabr.ru/ 

RED Version 2.0  Black Version 1.0

Firts USB Killer Prototype :

The principle of operation of the flash drive is quite simple. When connected to a USB port starts inverting DC / DC converter and charges the capacitor to a voltage -110v, when that DC / DC voltage is switched off at the same time opens the FET through which -110v applied to the signal lines USB interface. Further, when the fall of increasing voltage on the capacitors before -7v transistor closes and runs DC / DC. And so the cycle until you will break everything. The inquisitive mind of the reader is familiar with the electronics already realized why use a negative voltage to the other I will explain that a negative voltage switching easier, as required N-channel field-effect transistor, which, unlike the P-channel may be significantly more current in the same space. Pro area of application will not speak, but a former colleague says it's like an atomic bomb, cool to have, but can not be applied. Dark Purple explained.

Version 1.0

Sample Bread  PCB (Printed Circuit Board ): 
This 4 USB Killer Ver 2.0 ( dalawang tapos na, 2 wala pang laman)
Pwede ka umorder sa China PCB  dito : http://www.kikipcb.com/

Read More

How to Create Windows 10 Technical Preview USB Drive

First of all, make sure you download the Windows 10 Technical Preview by joining the Windows Insider Program as explained in this article. Also make sure your using a USB that is at least 4 GB for the 32-bit version and 8 GB for the 64-bit version.

One of the first cool things about Rufus  (size 800kb) is that no installation is necessary, which means you can stick it on a network location, or other external drive to run it. When you run it, setting it up is simple. Select the USB drive you want to use, select your partition scheme – it’s worth noting that Rufus also supports a bootable UEFI drive.

NOTE:

Use the GPT file format for UEFI mode or MBR file format for BIOS mode.
Boot into UEFI mode or legacy BIOS-compatibility mode when installing Windows from your USB, DVD, or network location.
If you install Windows using the wrong mode, you won’t be able to use the features of that firmware mode without reformatting the drive.

More info Boot to UEFI Mode or Legacy BIOS mode:

Read this Article :http://www.blogmytuts.net/2015/06/boot-to-uefi-mode-or-legacy-bios-mode.html

Then select the disc icon next to the ISO dropdown and navigate to the Windows 10 Technical Preview ISO.

After that click Start and you should be good to go, within minutes. If you want to be extra careful, check the option to check device for bad blocks. I didn’t do that and my bootable drive turned out fine.

In my experience, using the older USB 2.0 port and drive, it actually took less than 5 minutes to create the drive. If you use a USB 3.0 set up, I would love to know how fast that works!

Anyway, after it’s created you can go ahead and install the Windows 10 Technical Preview on a spare computer.

Let us know what you think of this tool over Microsoft’s Windows 7 USB/DVD Tool, for me, I am going to continue to use Rufus – at least until Microsoft updates or recreates a new utility – if it does at all.

( Ayaw sa Windows 7USB/DVDTool  sinubukan ko whehehe)

And yes, of course you can use this to create other versions of Windows or a Linux dristro from an ISO you can.

source:http://rufus.akeo.ie/

Windows 10 Insider Preview -  is now close

 

UPDATE: Creating Dual Boot Flash Drive with Windows XP and Windows 10 using  WinSetupFromUB.
TUTORIAL LINK:  http://www.blogmytuts.net/2013/10/creating-bootable-windows-xp-and.html

To Boot  from USB Flash Drive .. Go to your BIOS Setting Change your Boot Sequence .. First Boot should be External  Disk or Flash Drive.. Don't tell is not working cause I will not post it if didn't tried it..

On my Laptop I just Press F12 to Select Boot..

Booting From USB Flash Drive..I can choose XP or Vista Here is Latest Windows 10

Now Windows 10 is booting up..

Less than 20 minutes I'm done installing Windows 10 on USB port 2.0

Print Screen

You may want to Read More about Windows 10 :
http://www.blogmytuts.net/2015/06/windows-10-blogmytuts-review.html

Read More

Slax Linux Your Pocket Operating System

Slax is a modern, portable, small and fast Linux operating system with a modular approach and outstanding design. Despite its small size, Slax provides a wide collection of pre-installed software for daily use, including a well organized graphical user interface and useful recovery tools for system administrators.

Yes you can boot this on USB drive then backup all the files from failure PC.

The modular approach gives you the ability to include any other software in Slax easily. If you're missing your favourite text editor, networking tool or game, simply download a module with the software and copy it to Slax. There is no need to install and no need to configure, it simply works.

Slax is available in more than 50 languages and includes translations, keyboard mappings, fonts and system settings for each localization. Slax follows XDG Base Directory Specification in order to provide localized names for well known user directories such as the desktop folder and the music folder. Select your preferred download below and enjoy Slax in your language!

Check this tutorial how to recover files : http://www.blogmytuts.net/2015/04/troubleshoot-all-sorts-of-problems-with.html 

Create Bootable USB : http://www.blogmytuts.net/2015/04/create-ubuntu-live-bootable-usb-drive.html

How to Create a SLAX USB Flash Drive

1. Download and run Universal USB Installer, select SLAX, and follow the onscreen instructions
2. Once the script has finished, reboot your computer, set your BIOS or Boot Menu to boot from the USB device and save your settings. On next boot, you should have a successful launch of  your Portable SLAX

Slax is full Linux system in 210 MB

Universal USB Installer

Read More

Create Ubuntu live Bootable USB drive

Anyone can make a free Ubuntu USB drive, CD, or DVD. A Ubuntu live drive can be used as a digital Swiss army knife to troubleshoot all sorts of problems with any PC, whether you need to recover files from a failing computer, diagnose hardware problems, perform a deep virus scan from outside Windows, or even reset a forgotten Windows password.

Visit Ubuntu’s website and download Ubuntu Desktop— we used 12.04 LTS for this, but any available version will do. Download the Universal USB Installer tool, then select your USB drive and the ISO file and the tool will create a bootable USB drive. You can also burn the ISO file to a CD or DVD, but those spinning discs will run slower than a USB drive tricks here use NTFS File format.

Create an Ubuntu Live USB Flash Drive from Windows: In the following tutorial, we show you an easy way to put Ubuntu 9.10/10.04.*/10.10/11.04/11.10/12.04 on a USB Flash Drive using Windows. Once finished, you should be able to run Ubuntu directly from your Flash Drive, just as it does from a Live CD. Ubuntu's  casper-rw feature is also utilized for persistently saving and restoring your changes on subsequent boots.

Distribution Home Page: ubuntu.com

Minimum Flash Drive Capacity: 2GB

Persistent Feature: Yes

Ubuntu Live USB Flash Drive Creation Essentials

• Windows PC to perform conversion
• Ubuntu 9.10/10.04/10.10/11.04/11.10 ISO or any Click here to Download
• 2GB or larger USB flash drive (fat32 formatted) or NTFS fast boot
• Universal USB Installer (does the conversion)

Ubuntu Live USB Flash Drive Creation tutorial

1. Download and launch our Universal USB Installer and follow the onscreen instructions
2. Once the script has finished, restart your PC and set your BIOS or Boot Menu to boot from the USB device, save your changes and reboot

You should be booting from your own personal Live Ubuntu USB that might also be used to install Ubuntu to a Hard Drive.

Tested on Laptop and Netbook no Disk Drive.

Troubleshoot all sorts of problems with any PC with Ubuntu live drive

http://www.blogmytuts.net/2015/04/troubleshoot-all-sorts-of-problems-with.html

Read More

BadUSB Exploit -Thumdrive that hacks computer

When creators of the state-sponsored Stuxnet worm used a USB stick to infect air-gapped computers inside Iran's heavily fortified Natanz nuclear facility, trust in the ubiquitous storage medium suffered a devastating blow. Now, white-hat hackers have devised a feat even more seminal—an exploit that transforms keyboards, Web cams, and other types of USB-connected devices into highly programmable attack platforms that can't be detected by today's defenses.

Stealthy attack that reprograms USB device firmware

Back in the early days of 3G dongles, they would show up as both the dongle itself and as a virtual CD drive from which to install the device driver from. this attack vector is the same concept, only for malicious intent and not built into the device intrinsically. 

There's nothing stopping a USB Flash Drive being fully functional as a USB Flash Drive whilst also surreptitiously acting as a keyboard if it's firmware has been modified to advertise it as such. A USB device can have multiple device ID's and able to process commands as any of them.

My understanding is that if you plug it in, it will infect, auto play or not, and that this is not limited to any one operating system. This attack vector uses the actual firmware on the USB device, which tells the computer the type of device being plugged in. So you plug in an infected usb storage device, and it tells the computer that it's also a keyboard. Then it types commands as though you were doing it at your actual keyboard. 

Same as BadBios

The capabilities of BadUSB closely resemble the mysterious badBIOS malware security consultant Dragos Ruiu said repeatedly infected his computers. Nine months after Ars reported security researchers were unable to independently reproduce his findings, that remains the case. Still, Nohl said BadUSB confirms that the badBIOS phenomena Ruiu described is technically feasible.
"Everything Dragos postulated is entirely possible with reasonable effort," Nohl said. "I'm pretty sure somebody is doing it already. This is something that's absolutely possible."


Dubbed BadUSB, the hack reprograms embedded firmware to give USB devices new, covert capabilities. In a demonstration scheduled at next week's Black Hat security conference in Las Vegas, a USB drive, for instance, will take on the ability to act as a keyboard that surreptitiously types malicious commands into attached computers. A different drive will similarly be reprogrammed to act as a network card that causes connected computers to connect to malicious sites impersonating Google, Facebook or other trusted destinations. The presenters will demonstrate similar hacks that work against Android phones when attached to targeted computers. They say their technique will work on Web cams, keyboards, and most other types of USB-enabled devices.

"If you put anything into your USB [slot], it extends a lot of trust," Karsten Nohl, chief scientist at Security Research Labs in Berlin, told Ars. "Whatever it is, there could always be some code running in that device that runs maliciously. Every time anybody connects a USB device to your computer, you fully trust them with your computer. It's the equivalent of [saying] 'here's my computer; I'm going to walk away for 10 minutes. Please don't do anything evil."
In many respects, the BadUSB hack is more pernicious than simply loading a USB stick with the kind of self-propagating malware used in the Stuxnet attack. For one thing, although the Black Hat demos feature only USB2 and USB3 sticks, BadUSB theoretically works on any type of USB device. And for another, it's almost impossible to detect a tampered device without employing advanced forensic methods, such as physically disassembling and reverse engineering the device. Antivirus scans will turn up empty. Most analysis short of sophisticated techniques rely on the firmware itself, and that can't be trusted.
"There's no way to get the firmware without the help of the firmware, and if you ask the infected firmware, it will just lie to you," Nohl explained.
Most troubling of all, BadUSB-corrupted devices are much harder to disinfect. Reformatting an infected USB stick, for example, will do nothing to remove the malicious programming. Because the tampering resides in the firmware, the malware can be eliminated only by replacing the booby-trapped device software with the original firmware. Given the possibility that traditional computer malware could be programmed to use BadUSB techniques to infect any attached devices, the attack could change the entire regimen currently used to respond to computer compromises.
"The next time you have a virus on your computer, you pretty much have to assume your peripherals are infected, and computers of other people who connected to those peripherals are infected," Nohl said. He said the attack is similar to boot sector infections affecting hard drives and removable storage. A key difference, however, is that most boot sector compromises can be detected by antivirus scans. BadUSB infections can not.
The Black Hat presentation, titled BadUSB—on accessories that turn evil, is slated to provide four demonstrations, three of which target controller chips manufactured by Phison Electronics. They include:

• Transforming a brand-name USB stick into a computer keyboard that opens a command window on an attached computer and enters commands that cause it to download and install malicious software. The technique can easily work around the standard user access control in Windows since the protection requires only that users click OK.

• Transforming a brand-name USB stick into a network card. Once active, the network card causes the computer to use a domain name system server that causes computers to connect to malicious sites impersonating legitimate destinations.

• Programming a brand-name USB stick to surreptitiously inject a payload into a legitimate Ubuntu installation file. The file is loaded onto the drive when attached to one computer. The tampering happens only after it is plugged into a separate computer that has no operating system present on it. The demo underscores how even using a trusted computer to verify the cryptographic hash of a file isn't adequate protection against the attack.

• Transforming an Android phone into a malicious network card.

No easy fix

Nohl said there are few ways ordinary people can protect themselves against BadUSB attacks short of limiting the devices that get attached to a computer to those that have remained in the physical possession of a trusted party at all times. The problem, he said, is that USB devices were never designed to prevent the types of exploits his team devised. By contrast, peripherals based on the Bluetooth standard contain cryptographic locks that can only be unlocked through a time-tested pairing process.
The other weakness that makes BadUSB attacks possible is the lack of cryptographic signing requirements when replacing device firmware. The vast majority of USB devices will accept any firmware update they're offered. Programming them in the factory to accept only those updates authorized by the manufacturer would go a long way to preventing the attacks. But even then, devices might be vulnerable to the same types of rooting attacks people use to jailbreak iPhones. Code signing would likely also drive up the cost of devices.
"It's the endless struggle between do you anticipate security versus making it so complex nobody will use it," Nohl said. "It's the struggle between simplicity and security. The power of USB is that you plug it in and it just works. This simplicity is exactly what's enabling these attacks."

Read More

Creating a Bootable Windows XP and Windows 7 in 1 USB

Tuts how to create  bootable  2 OS in one USB  :)
Now  you can combined  Windows XP and Windows 7 in 1 USB Flash Drive.

You Need:
1. Flash Drive with 8 Gig Capacity or more.
2. ISO file of Windows XP and Window 7.
3. Magic ISO Virtual CD/DVD.  ( use this and insert your ISO or image  )  DOWNLOAD
4.WinSetupFromUSB_0-2-3  DOWNLOAD ,  Mirror
password :blogmytuts.blogspot.com

Guide:
1. Insert your 8 Gig USB Flash
2. Open WinSetupFromUSB then Click the RMPrepUSB

 3. Fallow this setting on this image

 

4. Click the Prepare Drive  this  will Format your USB into NTFS Filesystem for fast I/O.

When done click Exit.

 5 Prepare your   Magic ISO  CD/ DVD  mount your XP and Windows 7.

Set  2 Number of Drives

Inserct each ISO on each drive

6. Windows XP bootable

• Brows e your Windows XP Drive   
• ( used magic ISO to insert your windows  ISO file Virtual Drive is much faster than a real disk )
• then click OK  
• then click GO to start the copying

When done  just click OK and accept any agreement.

7. Insert Windows 7 Bootable

• Check the box  Vista/7
• Browse  your Win 7 
• then click OK
• click  GO

Click OK when done..

8. Replace the Boot Files

• Open the bootfiles folder
• copy the  2 files
• open your Flash drive
• Paste and replace  and your done!!

Now for the Test...

Choosing XP Setup

Windows 7 Setup

Selfie pic  lol

Read More