m5stick-nemo

M5Stick-NEMO

Firmware for high-tech pranks and digital self-defense on M5Stack ESP32 Devices

Logo by @unagironin

Okay so maybe we're back...

Name and Background

NEMO started a personal project to help me learn more about ESP32 development with the Arduino IDE. I decided to replicate a few common, trending pranks that were getting a lot of attention in the tech community, as a challenge to myself, and to also better understand these attacks.
NEMO is named after the small, clever and stubborn fish in Finding Nemo. This project stands in contrast to another high-tech gadget that's associated with certain sea-dwelling creatures. I did want to prove that there are a lot of things you can do with a small development kit and some curiosity. I have no delusions of superseding the capabilities of any similar device with this project. It's just for fun, and my own education.

My ToDo list

• ideas?

Features

• NEW: BadUSB Hunter (only for Cardputer and ADV Models) - Recognizes many USB peripherals via USB-C OTG and can warn you about HID devices (blinking red LED), suspicious USB Cables and BadUSB devices with multiple interface profiles including HID. Use to field-test unknown and untrustworthy USB peripherals before investigating with a computer.
• NEW: Wireless Attack Detection: BLE Hunter, Deauth Hunter and PineAP Hunter modes provide situational awareness of ongoing attacks in your area.
• TV B-Gone port (thanks to MrArm's HAKRWATCH) to shut off many infrared-controlled TVs, projectors and other devices
• AppleJuice iOS Bluetooth device pairing spam
• Bluetooth device notification spamming for SwiftPair (Windows) and Android
• WiFi Spam - Funny SSIDs, WiFi Rickrolling, and a Random mode that creates hundreds of randomly-named SSIDs per minute
• WiFi NEMO Portal - A captive portal that tries to social engineer email credentials - saves usernames and passwords to SD Card (if inserted into a supported reader)
• WiFi SSID Scanner - Display 2.4 GHz SSIDs nearby, get information about them, and even clone the SSIDs in NEMO Portal
• User-adjustable 24 Hour digital clock backed by the M5 Stick RTC so it holds relatively stable time even in deep sleep and low battery mode
• EEPROM-backed Settings for rotation, brightness, automatic dimming and NEMO Portal SSID
• Battery level and credits in settings menu

User Interface

There are three main controls:

• Home - Stops the current process and returns you to the menu from almost anywhere in NEMO

• Next - Moves the cursor to the next menu option. In function modes, this usually stops the process and returns you to the previous menu.

• Select - Activates the currently-selected menu option, and wakes up the dimmed screen in function modes

• StickC and StickC-Plus

  • Power: Long-press the power button for 6 seconds to turn off the unit
  • Home: Tap the power button (closest to the USB port)
  • Next: Tap the side button
  • Select: Tap the M5 button on the front of the unit

• Cardputer

  • Home: Tap the Esc/~/` key or the Left-Arrow/, key
  • Next/Prev: Tap the Down-Arrow/. key and Up-Arrow/; keys to navigate
  • Select: Tap the OK/Enter key or Right-Arrow/? key

NEMO Portal

In NEMO Portal mode, NEMO activates an open WiFi Hotspot named "Nemo Free WiFi" (configurable in portal.h) with DNS, DHCP and Web servers activated.

• NEMO Portal serves a fake login page that claims to provide internet access if you log in.
• This is a social engineering attack, and will log the username and passwords entered on the page.
• From the Wifi Scan details, you can clone an existing SSID from the scan list. Exiting NEMO Portal will clear the Evil Twin SSID
• You can view captured credentials by connecting to the portal from your own device and browsing to http://172.0.0.1/creds
• You can set a custom SSID by connecting to the portal from your own device and browsing to http://172.0.0.1/ssid
• If your device supports EEPROM for settings, the custom SSID you enter will be saved as the default, even if powered off.
• If your device has an SD Card reader with a FAT filesystem formatted card inserted, the usernames and passwords will be logged to nemo-portal-creds.txt on the SD Card for you to peruse later.
• SD Card support is only enabled by default on the M5Stack Cardputer platform. It can be enabled on M5Stick devices but an SD Card reader must be built and attached to the front panel pin header.
• NEMO Portal is only for use on professional engagements with a valid scope of work, educational or demonstration purposes. Storage, sale, or use of personal information without consent is against the law.

BadUSB Hunter (Cardputer & ADV Models)

Analyzes USB Devices plugged into the USB-C Port on the Cardputer to determine likelihood of performing an HID (Keyboard injection) attack
This tool allows users to field-test unknown USB Devices and cables before using them on a real computer.

• Usage

  • Launch BadUSB Hunter from the main menu
  • Attach USB accessories to the USB-C port using a USB-C OTG adapter if needed
  • BadUSB Hunter will enumerate the device class and any interfaces in its configuration and display the results.
  • Status:
    • Device OK: The device does not have any suspicious indicators.
    • HID-Only Device: The device surfaces only HID (Mouse and/or keyboard) interfaces. This doesn't necessarily mean it is safe.
    • !SUSPICIOUS!: The device has indicators of being capable of BadUSB Attacks
  • VID/PID: The Vendor and Product ID (Hex) of the device
  • Class: The device Class (Text description)
  • Interfaces: The number of interfaces and a list of them is presented

• USB Power:

  • The Cardputer supplies about 3.7 - 4.2 volts from the built-in battery to the USB-C port, and as such it is less than 5 VDC that USB specifies. Many devices will power on to read the device configuration at this lower voltage, but some will not.
  • You can supply a full 5VDC to the Cardputer through the Grove port on the left side if you slide the switch next to it to the "5V In" position. This will pass through to the USB-C port and provide full power to the attached devices.

• Analysis tips

  • Genuine HID devices (keyboards, mice, or wireless adapters for them) will of course show up as HID devices and are likely not suspicious. If a keyboard or mouse also shows up as some other profile like Mass Storage or Serial, that IS suspicious.
  • The VID/PID for the Hak5 Rubber Ducky is explicitly detected. Additional VID/PID pairs for truly malicious devices welcome! I may add an additional status for malicious devices later.
  • Some specialty USB cables have a serial-line converter built-in. If a USB cable shows up as only a serial device, it is likely a proprietary cable (often seen for medical or radio devices) and not likely malicious.
  • Except for the above, USB Cables that are not plugged into anything should NEVER show up as a device. If something appears to be a plan USB cable but registers as a device, it's probably a BadUSB cable (O.MG cable, Evil Crow Cable, etc)
  • Most BadUSB threats look like a USB Flash drive. If a USB Flash drive identifies as anything other than Mass Storage (but especially if it appears as HID and/or Network devices), it is very likely malicious.
  • Some BadUSB Devices like the popular ATTiny85 Digispark identify as a USB Serial interface for a few seconds to allow programming, then switch to a USB HID Device to perform keyboard injection.
  • Some BadUSB Devices show up as a composite device (CDC-Serial and HID for example) to allow for programming and HID Injection
  • Some Advanced BadUSB devices may take several seconds to several minutes to fully register. Many contain a full linux distribution that has to boot up first. Few of these are meant to be "found" by victims, and are more likely to be used in-person by an attacker with physical access to a target computer either for the duration of their operation, or left surreptitiously attached for persistence.

BLE Hunter

Identifies presence of excessive BLE Device Advertisements

• Usage
  • Each session executes 10 consecutive scans and then the counter is reset
  • Buttons are briefly unresponsive during BLE scanning
  • If the number of BLE Advertisements exceeds the threshold during a, BLE Hunter will beep
  • Press the SELECT button to disable the alerts temporarily
  • The signal strength meter uses the RSSI of the most recently received device advertisement. When you are near a heavy BLE Spam attack, this is likely to be related to the offending signal.
  • Use signal strength meter to help you determine the source of the signal. Lower strength is further away. Stronger, you're closer.
  • Keep hands away from the USB Port of M5Stack devices. The BLE antenna is near the USB port and your body will block some of the signal.
  • Adjust the RSSI Sensitivity and Alert Packet count for your environment. Busy places may have a lot of BLE Advertisements that are not BLE Spam.
• Configuration
  • Adjust BH Alert Pkts in settings to modify the threshold for alerts.
  • Adjust "BH RSSI` in settings to adjust the sensitivity of the signal strength meter (smaller negative numbers are less sensitive, -20dBm is less sensitive than -50dBm)

Deauth Hunter

Identifies the presence of WiFi Deauthentication Attacks

• Usage
  • Each session executes for 10 seconds and then the counter is reset
  • Deauth Hunter will scan 2.4 GHz channels and sniff for WiFi Management Frames with the Deauthentication Flag set
  • Occasional Deauthentication frames are completely normal, but more than a few per second usually indicates a WiFi Denial Of Service or Handshake Capture attack
  • Press the SELECT button to disable the alerts temporarily and pause the channel scanning. This will allow you to freeze on the channel being used by the Deauthentication Attack.
  • The signal strength meter uses the RSSI of the most recently received deauthentication frame.
  • Use signal strength meter to help you determine the source of the signal. Lower strength is further away. Stronger, you're closer.
  • Keep hands away from the USB Port of M5Stack devices. The WiFi antenna is near the USB port and your body will block some of the signal.
  • Adjust the RSSI Sensitivity and Alert Packet count for your environment.
• Configuration
  • Adjust DH Alert Pkts in settings to modify the threshold for alerts.
  • Adjust "DH RSSI` in settings to adjust the sensitivity of the signal strength meter (smaller negative numbers are less sensitive, -20dBm is less sensitive than -50dBm)

PineAP Hunter

Identifies the presence of rogue access points that are broascasting many different SSIDs. This is a characteristic of the "PineAP" feature of the Hak5 WiFi Pineapple, and similar KARMA attacks.

• Usage
  • PineAP Hunter performs WiFi Scans and builds a list of all identified BSSID/SSID pairs (up to a total of 50) in memory
  • Buttons are briefly unresponsive during WiFi Scans in PineAP Hunter mode
  • Any BSSID advertising a number of SSIDs above the alert threshold is added to the PineAP List and the alert is triggered.
  • Move the cursor to the desired PineAP in the list and press the SELECT button to view the SSID List. This also stops the alerts.
  • Keep hands away from the USB Port of M5Stack devices. The WiFi antenna is near the USB port and your body will block some of the signal.
  • Adjust the Alert SSID count for your environment if you receive false positives.
  • The SSID list will continue to update, with the most recently seen SSID at the top of the list, with RSSI to the left of each entry
  • Use the most recently-reported RSSI to help you determine the source of the signal. (smaller negative numbers are stronger, -20dBm is closer to you than -50dBm)
• Configuration
  • Adjust PH Alert SSIDs in setti