DEF CON 32 - Breaking Boundaries: Popping Shells in the Airgap w $10 & Arduino Magic - Daniel Beard

The video demonstrates that bad USB attacks on medical devices are feasible without requiring extended physical access or internet connectivity, using a $10 RadioJack T dongle to gain remote shell access via Wi-Fi or long-range radio (LAURA).

Key Takeaways:
• Bad USB exploits are viable in medical devices with Windows or Linux frontends, requiring only minutes and a few dollars 0:55-1:00.
• The RadioJack T dongle emulates USB devices, drops payloads, and provides a remote PowerShell shell over Wi-Fi or LAURA 2:01-3:47.
• Attacks can operate over distances of up to 1.5 miles using LAURA, enabling remote shell access without direct physical presence 11:00-11:59.
• Devices are vulnerable even with air-gapped networks, as the attack only requires a short physical access window and user login timing 3:30-4:00.
• Mitigations include covering unused USB ports, disabling USB stacks by default, and only enabling them during explicit user actions 12:45-13:30.

This attack highlights critical vulnerabilities in medical device security and underscores the need for stronger physical and software protections.

Sources:

• 0:55 Discussion of medical device architecture and bad USB risks
• 2:01-3:47 Demonstration of RadioJack T functionality and payload delivery
• 11:00-11:59 Proof of concept using LAURA for long-range shell access
• 3:30-4:00 Disproof of extended access requirement and persistence needs
• 12:45-13:30 Recomm