{"id":9861,"date":"2013-03-14T17:50:14","date_gmt":"2013-03-14T16:50:14","guid":{"rendered":"https:\/\/www.corelan.be\/?p=9861"},"modified":"2013-03-14T17:50:14","modified_gmt":"2013-03-14T16:50:14","slug":"blackhateu2013-day-1-to-dock-or-not-to-dock","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2013\/03\/14\/blackhateu2013-day-1-to-dock-or-not-to-dock\/","title":{"rendered":"BlackHatEU2013 - Day 1 - To dock or not to dock"},"content":{"rendered":"

Time flies ! \u00a0After hanging out with @repmovsb and @botherder, it's time for the last talk of the day. \u00a0In the \"To dock or not to dock, that is the question\" talk, Andy Davis<\/a>, research director at NCC Group shares his research around using laptop docking stations as hardware-based attack platforms.<\/p>\n

Why docking stations as an attack platform?<\/h3>\n

Docking stations sit in an important position - they have access to all the ports and provision additional interfaces that may not be available on the laptop itself. They are commonly used in \"hot-deskting\" environment and thus might be used by different laptops every day. \u00a0They are permanently powered on and to the network. \u00a0IT Admins and users consider these to be \"dumb\" and trusted devices and treat them as \"passive\" and anonymous. \u00a0If a docking is broken, it can be easily replaced (with a device that has been 'prepared' by the attacker, for example).<\/p>\n

Encrypted data is decrypted at the laptop and is therefore accessible in the clear, including from the dock perspective. \u00a0Andy believes this is a realistic threat.<\/p>\n

How do docking stations work ?<\/h3>\n

Andy mentions that he's using a Dell E-Port Plus (PRO2X) docking station, which is why he has performed the research on that particular device. \u00a0The EPORT extends all interfaces and provisions a number of additional devices (additional USB ports through an internal USB hub, as well as a DisplayPort). \u00a0It has a passive Ethernet switch. The laptop ethernet port gets disabled\/disconnected when docket.<\/p>\n

There's not a lot of public information available about the inner workings of the station, so Andy had to do research of his own to figure out how it actually works and what the functionality is of the various components placed on the device circuit board. \u00a0By default, the dock is extended, allowing you to use a large laptop battery. \u00a0This also gives room for additional \"features\".<\/p>\n

What would a hardware implant do ?<\/h3>\n

Potential attack vectors or purposes might include:<\/p>\n