Exploit Demo
Abstract
Over the last year research has been performed into practical USB exploitation by NCC’s exploit development group. Whilst there have been previous investigations into finding USB memory corruption-based vulnerabilities, there is much more limited public domain information on exploitation.
In 2025, Amnesty International released the first detailed write-up of an in-the-wild chain of USB related vulnerabilities which was used to compromise mobile phones demonstrating that these attacks are a real threat.
This left us with the question - “just how practical are USB memory corruption vulnerabilities to exploit against modern operating systems and what constraints are there?”
In the process we developed a framework which we call Dynamic USB Exploitation Tool (D.U.E.T.). The framework allows us to rapidly prototype new USB devices, perform common exploit techniques (such as heap manipulation) and transmit data in both directions between the USB device and the attacker (to allow for controlled information leakages and KASLR bypasses).
This framework was implemented on top of Raspberry Pi Pico’s as a related inexpensive way to deploy and coordinate large numbers of custom USB exploitation devices of varying exploitation roles via Wi-Fi.
Whilst performing this research and development, we discovered issues which affected Tesla’s automotive in-vehicle infotainment (IVI), core Linux kernel components, and developed several exploits along the way (CVE-2024-53150, CVE-2024-53104).
This talk will start by walking viewers through the Linux kernel attack surface of USB, discussing in-the-wild vulnerabilities, describing exploitation of three vulnerabilities and then moving on to discussion of the framework we developed.
Finally, we will wrap the talk up by demonstrating an end-to-end exploit for a modern Ubuntu version.