External resources

System-on-Chip resources

• Mk II - i.MX6ULZ

  • i.MX6ULZ Reference Manual
  • i.MX6ULZ Datasheet
  • siliconpr0n chip maps for P/Ns MCIMX6Z0DVM09AB, ATECC608A, SE050

• Mk II - i.MX6UL

  • i.MX6UL Reference Manual
  • i.MX6UL Datasheet

• Mk II - BLE

  • ANNA-B112 Datasheet
  • nRF528832 Datasheet

• Mk I - i.MX53

  • i.MX53 Reference Manual
  • i.MX53xD Datasheet
  • i.MX53 System Development User's Guide
  • i.MX53 Secure Boot Application Note
  • siliconpr0n chip maps for P/N MCIMX535DVV1C

• Secure Boot

  • habtool
  • Secure Boot using HABv4
  • HABv4 RVT Guidelines and Recommendations
  • i.MX Secure and Encrypted Boot using HABv4

Projects

• GlobaLeaks maintains a USB armory specific image

Contributions

• ckuethe is contributing scripts, configurations and much more as well as additional documentation

• Collin Mulliner repository hidemulation provides HID emulation helpers to support composite CDC Ethernet and HID gadget.

• Quentin Young repository armory keyboard provides HID keyboard emulation utilities with partial DuckyScript compatibility.

• Rudd-O repository usbarmory-debian-imagebuilder provides an alternative creation script for Debian images

• Yann GUIBET published a helpful guide on setting up full disk encryption with Arch Linux

• Carl Smith published a guide on Linux kernel module compilation

• Christopher published a guide on configuring the USB armory as a reverse SSH server via Tor hidden service.

• Julien Desfossez published a guide on manually preparing a Ubuntu image for the USB armory with a full disk encryption and signed boot image.

• Vince Cali ported Darwin on the USB armory, a detailed writeup with build instruction is available here.

• ftorn repository Docker for usbarmory provides Dockerfile configurations for automatic creation of several application images (e.g. Tor Anonymizing Middlebox, Electrum Bitcoin wallet images).

• Andrea Covello of scip AG published two excellent tutorials on setting up INTERLOCK on the USB armory: part 1, part 2

• Pedro Vilaca authored a USB armory based USB sandbox, described in this article

• Georg provides a fork for our official basic Debian image generation that allows basic Devuan image generation.

• Wincent Balin contributed a mode switcher script.

Papers, Articles

• Jeroen van Kessel and Nick Petros Triantafyllidis authored a paper titled [USB Armory as an Offensive Attack Platform](contrib/USB Armory as an Offensive Attack Platform Jeroen_van_Kessel-and-Nick_Triantafyllidis.pdf), exploring implementation of DNS hijacking and traffic diversion attacks...BadUSB style.

• Genode Labs - The story behind Genode's TrustZone demo on the USB Armory

• Roland Schilling, Frieder Steinmetz authored a paper titled USB devices phoning home, exploring data leaks through rogue HTTP channels established by malicious USB devices and using the USB armory for attack implementation. The repository with the PoC is available here.

• Matthias Neugschwandtner, Anton Beitler, Anil Kurmus authored A Transparent Defense Against USB Eavesdropping Attacks, a research which explores passive USB sniffing and countermeasures using the USB armory as evaluation platform.

• Mubix “Rob” Fuller wrote a step by step guide titled "Snagging creds from locked machines" that illustrates how to use the USB armory to capture credential hashes on certain Windows and OS X versions, even when locked out.

• Yorick Koster authored U3 armory, a project for emulating a U3 thumb drive with the USB armory to trigger and exploit Windows AutoRun.

• Teddy Reed V authored an excellent writeup on the vulnerability covered by our own advisory and exploit PoC.

Presentations

• Inverse Path (Mk I):
  • Forging the USB armory
• WithSecure Foundry (Mk II):
  • USB armory reloaded
  • TamaGo