,
6 tweets,
5 min read
Read on Twitter
Compromising hosts with with vulnerable presentation clickers needs network access for a back channel?
Wrong!
PoC: relaying a remote shell through the receiver of Logitech SPOTLIGHT presentation remote (host air gapped otherwise).
Wrong!
PoC: relaying a remote shell through the receiver of Logitech SPOTLIGHT presentation remote (host air gapped otherwise).
The receiver is unmodified. The client agent used to run the covert channel (data is hidden in RF protocol of presentation clicker) is deployed with copy&paste into powershell.
Of course this could be replaced with keystroke injection.
Of course this could be replaced with keystroke injection.
Those kind of attacks could be mitigated by using the Bluetooth mode of the clicker, instead of the receiver.
Addition: Never hand out the receiver to anyone, as it takes less than a second to compromise the link encryption keys
