Snippet 5: USB Ninja

The USB Ninja is a weaponized cable like the O.MG Cable but with a Bluetooth control interface instead of Wi-Fi, which makes it more covert since few systems detect new Bluetooth devices. This clip demos the cable injecting commands on a Windows machine and shows how Bastille spots it appearing, identifies it, and locates it in the interface.

Key Takeaways

• The USB Ninja is an attack cable that injects keystrokes and commands, controlled covertly over Bluetooth
• Bluetooth control is stealthier than Wi-Fi because few systems alert on a new Bluetooth device appearing
• An attacker can trigger it from a phone app or a small hidden clicker button while walking through a facility
• Bastille detects the cable as it beacons and pairs, identifies it by name and manufacturer, and locates it on the floor plan

Video Transcript

So OMG Cable's not the only one out there, so that's the Wi-Fi based one I was just talking about. There's another cable that's the same idea, except instead of a Wi-Fi interface, it's a Bluetooth interface. And Bluetooth is arguably more covert because there are systems out there that will tell you if a new Wi-Fi access point spins up in your space. But as far as we know, Bastille is the only system that's going to tell you when a Bluetooth device pops up in your space.

And Bastille is the only device, the only system out there that's going to be able to geolocate either of these attack devices. So again, the USB Ninja, same sort of features. You can exfiltrate keystrokes, there's an Android app, or there's a phone app, Android, or iPhone for both of these systems that lets you do the control from an app. So in this case, I'll show you in the video in a second. You can pre-program certain actions, and they call them buttons.

So if you click on this button in the app, then you can have the cable execute a certain action, like running a command or going to a website, that sort of thing. There's also really tiny looking clicker buttons that come with either of these cables, and you can program those buttons to do some action. So you don't even need a phone to actuate this. You could be walking through a facility and push this button as an attacker and exfiltrate keystrokes or inject an attack. So we've got one of these.

We have a demo facility near in the DC area, in Herndon, Virginia. So if anyone would like to come out and see this demo or other's demos, that's a standing invitation to reach out to us. And we'd love to have a meeting with you out there. I'm going to show you a demo that we've done where we were in that facility, and we plugged in this device, and you'll see how it shows up in the Bastille interface. So what you're seeing in the background here is a Windows machine. It's a Windows virtual machine. And it's on a computer.

And we've plugged the USB Ninja into the computer that's associated with this desktop screen that you're seeing. On the right, we've got the Android app overlaid. And you can see the two buttons that the attacker can click. And so once the attacker sees this interface, that means the Android app has paired with that Bluetooth, the USB Ninja. And when you click Button A, it opens up the run command, and it opens up the Windows Update interface. So you barely saw it, but it's opening the run command, and it went straight to the Settings menu.

And you can imagine all kinds of bad things that can happen there. And if you push Button B, we took you to the Bastille website. So if we look at this from the Bastille user interface, here is the USB Ninja, again, just normal looking USB cable. We've plugged it into the computer that we were just looking at in the last screen. And now, we're looking at the Bastille user interface. And we've got the filters set such that we're only going to see new Bluetooth devices. And so as soon as this Bluetooth device pops up, we see it pop up.

We can see actually, the MAC address has a OUI. So we can tell this is the manufacturer, AR Timing. And now this device is pairing with the Android device. Once it does that, it sends a connection request. And when it does that, it actually sends out its name. Conveniently, these USB Ninjas actually are labeled USB Ninjas when they try to make connection requests, and Bastille senses all of that. And then finally, once the connection happens, we can see that we see the residual effect of the beacon frame. So that's this blue dot.

And then when a Bluetooth Low Energy device pairs, it creates two new addresses. So one address is the USB Ninja. The other address is the phone sitting next to the USB Ninja. So all this shows up in sequence in the Bastille user interface. You can set up alerts and rules so that if this pops up in your facility, you hear about it, and you can even automate a response to it.

So we're wary of these devices, but pretty excited that we've got some use cases to show around them and that we can protect enterprises and federal customers from these devices. So the rest of the webinar-- so that was just a quick one that just heard some customers have found these things.