How I Built Them: Custom Hardware Implants

How I Built Them: Custom Hardware Implants

Speakers: c4m0ufl4g3 (Cyber Security Principal Engineer)

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=k-BbXJJO7GY

Overview

In this insightful SAINTCON presentation, c4m0ufl4g3, a Cyber Security Principal Engineer, walks the audience through the arduous yet rewarding journey of developing a custom hardware implant from initial proof-of-concept to a fully realized, open-source printed circuit board (PCB). The talk, titled "How I Built Them: Custom Hardware Implants," demystifies the complex process of hardware implant design, offering a unique perspective on the challenges, lessons learned, and iterative refinements involved. The project, known as Injectal and Hide, is a sophisticated hardware implant designed to sit between a keyboard and a computer, intercepting keystrokes and exfiltrating data via a covert mesh radio network.

The core objective of this research was to highlight critical supply chain vulnerabilities from a hardware perspective, an often-overlooked attack vector. Unlike readily identifiable commercial implants, Injectal and Hide prioritizes stealth, customizability, and scalability, aiming to provide a more evasive and persistent threat for red team operations. The speaker's extensive background in both operational technologies and offensive cybersecurity provides a solid foundation for understanding the intricate balance between electrical engineering principles and advanced threat emulation. This talk is not just about the final product, but an inspirational guide for security professionals interested in diving into custom hardware development, offering a practical methodology for tackling such ambitious projects.

Background

▶ Watch: Introduction to custom hardware implants and speaker's background (0:00)

The genesis of the Injectal and Hide project stemmed from a desire to explore hardware-based supply chain attacks, an area that c4m0ufl4g3 felt was underexplored despite its significant potential impact. Inspired by the NSA ANT catalog and the increasing prevalence of commercial hardware implants like the OMG cable and USB Rubber Ducky, the speaker sought to create a more advanced, difficult-to-detect alternative. The context of the COVID-19 pandemic further amplified the relevance of this research, as the shift to remote work and subsequent "hotel cubing" scenarios introduced environments where employees were frequently plugging devices into untrusted or unfamiliar peripherals, inherently increasing the attack surface.

The decision to build a custom solution rather than utilizing existing commercial or open-source projects was driven by several key limitations identified in current offerings. Many commercial implants rely on common protocols and network infrastructures for command and control (C2), making them susceptible to existing network detections. Furthermore, popular chipsets like the ESP32 often interface via Rogue APs, which can be easily identified in monitored environments. The market saturation of well-known devices also meant they were easily identifiable by defenders, limiting their utility across multiple engagements. Beyond detectability, concerns about data handling and firmware trustworthiness in supposedly "open-source" commercial devices (where only payloads, not firmware, were open) prompted the team to build from scratch to ensure complete control and transparency over sensitive client information. Finally, the need for adaptability and scalability—moving beyond single-compromise scenarios to potentially compromising an entire office environment—necessitated a custom, modular design that could evolve with operational requirements and be deployed across numerous targets without immediate detection.

Key Findings

▶ Watch: Inspiration: NSA ANT catalog and supply chain issues (2:00)

The journey of developing Injectal and Hide yielded several crucial findings and practical lessons, highlighting the complexities and iterative nature of hardware development in a security context:

• Iterative Prototyping is Essential: Starting with Commercial Off-The-Shelf (COTS) components to prove out concepts and code before committing to custom PCB designs significantly reduces time, cost, and resource waste. This "fail fast" approach allowed for rapid iteration and troubleshooting of fundamental design flaws.
• Unforeseen Technical Challenges Demand Creative Solutions: Issues like noticeable typing lag in the initial prototype, unexpected driver conflicts, and especially the discovery of an undocumented UART failover mechanism in SparkFun boards (by grounding the SCL pin) underscored the need for deep technical investigation and ingenious workarounds.
• Chip-Level Understanding is Paramount: Moving beyond development boards to directly interface with raw chips (like the SAMD21) revealed the critical importance of understanding minimum viable circuit requirements. The speaker found that while some firmware could run on a bare chip, Arduino firmware required a minimum of two capacitors, a detail not explicitly clear from general datasheets.
• Supply Chain Resilience is Crucial: The global chip shortage during COVID-19 significantly impacted the project, forcing the team to creatively source components, including desoldering chips from existing COTS boards at a 250% markup. This highlighted the vulnerability of hardware projects to external supply chain disruptions.
• Strategic Design for Stealth and Adaptability: The project continuously refined its design to reduce footprint, enhance covertness, and improve scalability. The accidental necessity of using header pins for the radio due to component availability transformed into a key feature, enabling field-swappable radios (e.g., LoRa, LoRaWAN, sub-GHz XBEE) for diverse operational requirements.
• Practical PCB Design Considerations: The talk meticulously detailed the considerations for custom PCB design, including power management (stepping down USB's 5V to 3.3V), connection options, component footprints (TQFP vs. QFN), multi-layer routing, RF isolation (copper keepout areas), and the integration of debugging interfaces like Serial Wire Debugging (SWD).
• The Value of Open Source: By making Injectal and Hide's schematics, board layouts, and code open source, the project not only contributes to the security community but also inspires others to delve into custom hardware development, fostering innovation and transparency.

Technical Deep Dive

▶ Watch: Why build custom implants? Avoiding common pitfalls (3:20)

The technical journey of Injectal and Hide began with a foundational understanding of USB. The speaker provided a high-level USB primer, explaining the host-device relationship where one host controls the bus, capable of communicating with up to 127 devices per controller. Crucially for this project, acting as both a host (to the keyboard) and a peripheral (to the computer) required two separate USB controllers. Devices identify themselves to the computer via descriptors, which include a class code (e.g., 03 for Human Interface Device (HID)), a Vendor ID (VID), and a Product ID (PID). The ability to spoof these VID/PID combinations, along with manufacturer and product strings, was a core requirement, allowing the implant to impersonate legitimate devices. The chosen ATmel SAMD21 chip facilitated this, offering dedicated serial lines for USB and allowing VID/PID modification at compile time via the Arduino bootloader.

The initial proof-of-concept (PoC) leveraged readily available COTS components: an Adafruit Trinket M0 and an Arduino Nano 33 IoT for the implant, and two SparkFun XB3 Thing Plus boards for wireless communication, all controlled by a custom Python 3 C2. The SAMD21 microcontroller, central to both the Trinket M0 and Arduino Nano 33 IoT, was selected for its dedicated USB hosting capabilities, existing HID libraries, 3.3V operating voltage, and low cost ($4 per chip). For wireless C2, the team opted for Digi Mesh protocol via XBEE radios (specifically the XB3 and later XB Pro). Digi Mesh, a proprietary protocol similar to Zigbee, offered 256-bit encryption, an advertised indoor range of 300 feet (realistically 100 feet in noisy environments), and support for up to 1000 nodes, providing the crucial scalability and covertness required.

The initial architecture involved the Trinket M0 and Arduino Nano 33 IoT acting as the implant, communicating wirelessly via a SparkFun XB3 to an "extender" (another SparkFun XB3), which then meshed out to the C2. However, this prototype immediately encountered a noticeable typing lag, a critical showstopper that would prompt user investigation. Another issue was that programming the Arduino board as a HID device prevented it from loading correctly when reconnected to the same computer without manually deleting the original driver.

To address the lag, the team hypothesized the SparkFun board was overloaded. The next prototype introduced an additional Arduino Nano board into the extender to offload some processing, resulting in a Trinket M0, two Nano boards, and two SparkFun boards. This phase hit a major roadblock: the SparkFun board's UART communication, despite being advertised, was not implemented. A serendipitous accident by Jeremy Miller, co-creator of Injectal and Hide, revealed that grounding the SCL pin of the I2C bus forced the SparkFun board into a UART failover mode, making it functional. Despite this discovery, SparkFun's support was unable to provide a stable workaround due to remote work limitations and lack of testing hardware.

This led to the third prototype, which eliminated the problematic SparkFun board from the extender, using a Trinket M0, two Nano boards, and two XB Pro radios directly. This iteration finally achieved stable UART communication and met operational goals. Further refinement aimed to shrink the footprint, reduce cost, drop the detectable Bluetooth (BLE) interface, and add onboard storage (SD card) for long-term engagements.

The fourth prototype, the final COTS mockup, consisted of a Trinket M0, a Nano 33 board, two XB radios, and an SD card, removing the separate extender and allowing the implant to mesh directly with the C2. Integrating the radio directly into the Arduino required using a software-defined UART interface (SoftSerial), which presented its own challenges related to pin mapping and variant files. With the functional COTS circuit established, the next logical step was to transition to a custom PCB.

Before designing the PCB, the team validated the circuit at the chip level using SAMD21 development boards, ensuring direct interaction with the raw chip was feasible. This involved understanding the minimum viable circuit for the SAMD21, which, contrary to initial assumptions based on SparkFun firmware, required at least two capacitors for Arduino firmware to function. The project then navigated the global chip shortage by desoldering SAMD21 chips from existing Trinket M0 boards.

Custom PCB design involved selecting appropriate software suites like EasyEDA (used initially due to its AutoCAD-like interface) and KiCad (most common in the industry). Key design considerations included:

• Power: Stepping down the 5V from the USB bus to the required 3.3V using a low dropout (LDO) voltage regulator to ensure stable power during voltage dips. USB A was chosen for connections.
• Component Footprints: Choosing between TQFP (Thin Quad Flat Package) with its exposed legs (easier for manual soldering) and QFN (Quad Flat No-leads) (smaller footprint, better for automated assembly).
• RF Considerations: Incorporating copper keepout areas for the radio module to prevent interference and dedicated grounding pads for proper operation and cooling.
• Mounting: Utilizing Surface Mount Technology (SMT) for most components (Surface Mount Devices - SMD) and through-hole connectors for USB A for cost and convenience with test probes.
• Debugging: Integrating Serial Wire Debugging (SWD), a two-wire interface similar to JTAG, for flashing ARM Cortex M processors like the SAMD21.

Early PCB iterations faced challenges: reverse polarity in communication lines, heat transfer issues when stacking chips on both sides of the board, and soldering difficulties with tiny SMD components, highlighting the necessity of a microscope for inspection. A fortunate consequence of the chip shortage was the pivot to a radio with a header interface, which transformed into a design feature allowing field-swappable radios (LoRa, LoRaWAN, sub-GHz XBEE, Digi Mesh) on the final custom PCB. The final design, Injectal and Hide, features a compact, squared-up PCB with both SAMD21 chips on the top, header pins for modular radios, and integrated SWD connectors, achieving the project's goals of stealth, adaptability, and scalability.

Demo / Proof of Concept

▶ Watch: Trust and adaptability: firmware transparency and future needs (5:20)

The "demo" in this presentation is the comprehensive journey itself, culminating in the functional, custom-designed Injectal and Hide PCB. Rather than a live demonstration of the implant actively compromising a system, c4m0ufl4g3 meticulously detailed the step-by-step process of its creation, showcasing how each technical challenge was addressed and how the design evolved.

The talk demonstrated the progression from bulky, multi-board COTS prototypes to a sleek, single custom PCB. This included visual aids of the various prototype stages on breadboards, illustrating the complexity and eventual simplification of the circuit. The final custom PCB, with its compact form factor, integrated chips, and field-swappable radio interface, serves as the ultimate proof of concept for the feasibility of building highly covert and adaptable hardware implants from the ground up. The speaker also highlighted the open-source nature of the project, making all schematics, board layouts, and code available to the community, effectively demonstrating the reproducibility and utility of their research.

Defensive Implications

▶ Watch: Technical tangent: High-level USB primer (6:40)

The Injectal and Hide project offers crucial insights for defenders facing increasingly sophisticated hardware-based threats. The primary implication is the stark reality of supply chain attacks at the hardware level. The ability to covertly introduce malicious components into seemingly legitimate devices means organizations must extend their trust boundaries beyond software and network layers. Traditional endpoint detection and response (EDR) solutions are unlikely to detect such implants, especially those utilizing non-standard, encrypted mesh network protocols for C2.

Defenders should recognize that physical security around sensitive systems and peripherals is paramount. The "hotel cubing" scenario underscores the risk of untrusted USB devices. Organizations should implement strict policies regarding the use of personal or unknown peripherals, and ideally, physically inspect devices for tampering or unauthorized additions. The project's emphasis on VID/PID spoofing means that simply logging device identifiers is insufficient for detection; more in-depth hardware analysis might be required to differentiate between a legitimate device and a sophisticated implant.

Furthermore, the use of Digi Mesh and other non-WiFi/Bluetooth radio protocols for C2 bypasses common wireless intrusion detection systems. This necessitates a broader approach to RF monitoring in secure environments, looking for unusual or unauthorized radio transmissions. While challenging, understanding the specific radio technologies used by adversaries (e.g., LoRa, XBEE) can inform the deployment of specialized RF sensors. Finally, the open-source nature of Injectal and Hide, while beneficial for the community, also means that defenders can study its design to develop more targeted detection and mitigation strategies against similar custom hardware implants.

Key Takeaways

• Iterative Design is Key: Complex hardware projects benefit immensely from a phased approach, starting with COTS prototypes to validate concepts before committing to custom PCBs.
• Deep Technical Research Pays Off: Unforeseen challenges, like undocumented firmware behaviors or chip-level requirements, necessitate thorough investigation and creative problem-solving.
• Supply Chain Resilience is Critical: Chip shortages or component unavailability can significantly impact project timelines and costs, requiring adaptable sourcing strategies.
• Custom Hardware Enables Advanced Stealth: By designing from scratch, implants can achieve covertness, scalability, and evasion capabilities (e.g., non-standard C2, VID/PID spoofing) that commercial products often lack.
• Modular Design Enhances Adaptability: Incorporating features like field-swappable radio modules allows for rapid adaptation to diverse operational environments and evolving threat landscapes.
• Open-Source Hardware Fosters Innovation: Sharing designs and code empowers the security community to learn, build upon, and collectively improve defenses against hardware-based threats.

About the Speaker(s)

c4m0ufl4g3 brings a rich and diverse background to the field of cybersecurity. With over nine years of experience in the information security community, his focus has been predominantly on the offensive side, encompassing pentesting, red teaming, and security research. Prior to transitioning into infosec, he dedicated approximately a decade to operational technologies (OT). During this time, he was actively involved in designing, implementing, and programming electrical control systems for various industrial applications, including factory automation and off-highway machinery such as bulldozers, cranes, rail equipment, and farm equipment. His hands-on experience included designing and building wire harnesses, implementing radio controls, programming embedded controllers, and interfacing with engines. This extensive background in hardware, RF, and IoT systems naturally led to a keen interest in their security, prompting his move into the infosec industry. For this presentation, c4m0ufl4g3 is speaking as a strictly independent researcher, sharing insights derived from his personal research and development.