Wednesday, 9 September 2015

API update


Updated API.

InputStick Broadcasts - new, easy way to use InputStick in your app:

Starting with 1.40 version of InputStickUtility (update will be available on GooglePlay in a few hours) it is possible to send data using broadcasts. Typing text is now this easy:

        InputStickBroadcast.type(MainActivity.this, "some text to type");

(each call results in sending a broadcast to InputStickUtility, which puts appropriate action into FIFO queue, see com.inputstick.api.broadcast.InputStickBroadcast class for more details).

InputStickUtility takes care of everything:
  • enables Bluetooth,
  • asks user to select InputStick device (if more than one is available),
  • establishes Bluetooth connection,
  • select keyboard layout and typing speed (can be set in preferences),
  • closes connection (when application requests to do so or after reaching max inactivity period),
  • if anything goes wrong, handles all InputStick-related errors.
Using broadcasts introduces additional latency, compared to "standard API". If precise timing, direct control over connection and buffers are necessary in your use case, you should use "standard API".
Example:
  • password manager app: latency increased by several milliseconds most likely won't be even noticed.
  • remote control app: additional latency can make such app unusable in many situations.

For more details, please download latest API and take a look at "BroadcastDemo" example.

Adjustable typing speed:

Text typing speed can be decreased by multiplying number of HID reports. The more reports USB host will receive, the longer it will take to type.
Example (typing "a" character, 3 reports - 100% typing speed):
  • Report 1: keys released,
  • Report 2: "A" pressed,
  • Report 3: keys released.

Example (typing "a" character, 6 reports - 50% typing speed):
  • Report 1: keys released,
  • Report 2: keys released,
  • Report 3: "A" pressed,
  • Report 4: "A" pressed,
  • Report 5: keys released,
  • Report 6: keys released.

Decreasing typing speed can help to solve missing characters problems, which can occur when working with BIOS (due to simplified keyboard implementation) or advanced text editors (due to spell-checking, auto-complete and similar features).

Easier way to use keyboard layouts:

It is no longer necessary to get KeyboardLayout:

        KeyboardLayout layout = KeyboardLayout.getLayout("pl-PL");
        layout.type("some text in Polish");

now you can simply call:

        InputStickKeyboard.type("some text in Polish", "pl-PL");

Other changes:

  • fixed "init" package name (com.inputstick.init to com.inputstick.api.init),
  • fixed problem when connection gets stuck on "USB not ready" step,
  • BT4.0 connection timeout now works properly,
  • optimized look-up-tables for keyboard layouts,
  • fixed Swedish keyboard layout (could cause app crash),
  • case is now ignored when using layout codes ("en-US" = "en-us" = "EN-US").

Protocol documentation.

  • fixed mistakes in command examples.
  • added info about known bugs in 0.97 firmware version.

Thursday, 16 July 2015

BruteForce app update

New version is now available in download section.

List of changes:

  • redesigned UI,
  • text file with passwords can be manually selected (from /BruteForce/ directory),
  • data set can be previewed after loading (first 100 entries),
  • sound and vibration notifications
  • more configuration options: keep screen turned on, disable screen rotation, continuous mode options
  • continuous mode (see below),
  • alternative sequence (see below),
  • updated typing sequence syntax (see below).

Continuous mode.

If selected, authentication attempts will be continuously performed until one of following conditions is met:
  • end of data set is reached,
  • limit of max attempts is reached,
  • action is cancelled by user.
In many cases this mode should make the whole process faster and require less attention, but keep in mind that the app will continue to work even after correct password is entered. You should make sure that it will not break anything in such case. Also you will not know which password was the correct one, so it is a good idea to limit number of max attempts (100? 1000?).

Alternative sequence.

When continuous mode is used, it is possible to execute alternative sequence once every N attempts. This allows to get rid of dialog windows (press Enter/Esc) and deal with timeouts (wait 30s) after number of unsuccessful authentication attempts.

Updated sequence syntax:

%p - type password
%u - type user name (pre-defined)
%u=param - type user name (defined by param)
%d - delay (pre-defined)
%d=param - delay (defined by param)
%s - type custom string (pre-defined)
%s=param - type custom string (defined by param)

%e - press Enter key
%t - press Tab key
%x - press Esc key

Example 1:
Simple case: password is entered into text field and confirmed with Enter key. Next authentication attempt can be performed immediately after failed one.

Sequence:
%p%d%e
type password, wait 500ms (default), press Enter key

Example 2:
User name and password are entered into console. User must press "r" followed by Enter to retry. Once every 10 failed attempts, system is locked for 1 minute.

Sequence:
%u%d=100%e%d=100%p%d=100%e%d%s=r%e%d=100
type user name, wait 100ms, press Enter, wait 100ms, type password, wait 100ms, press Enter, wait 500ms (default), type "r", press Enter, wait 100ms.
 
Set "Type alternative sequence every N attempts" to 10.
Alternative sequence:
%d=60000
wait 1 minute.

Screens:

Main screen.

Settings

User-defined variables.

Selecting data source.

Friday, 12 June 2015

BruteForce app

Here's a very simple app that I've recently made for a presentation. It allows to use Android smartphone and InputStick to perform brute force attack (via USB keyboard interface). This is just a simple demo application, not a real "hacking" tool.


With InputStick and BruteForce app, it is possible to perform up to 100 logon attempts in less than 2 minutes (best case scenario, no timeout after unsuccessful attempt). If user picked one of commonly used passwords (like "123456") or easy to guess password, like: combination of user name, number, year of birth, etc. (individual set of passwords can be generated before attack), it is possible that even such a simple attack may be successful. During a short presentation it can be shown how important it is to use following security measures:
  • enforcing strong password policy,
  • limiting max number of logon attempts (before account is locked),
  • adding timeout after unsuccessful attempt,
  • limiting physical access to USB ports.

Please note that it is not necessary to install any kind of software on a targeted OS. In most cases, OS will simply recognize new USB keyboard and use generic USB HID drivers. It takes just a few seconds before first password can be typed. Also, even if new USB hardware is filtered, based on PID and VID, it is possible to change the numbers using InputStickUtility app, to match values used by currently connected USB keyboard.

(12.01.2017 - updated download URL)

Quick overview of the app:



Use "Data source" button to select source of passwords:
  • 4 digit PIN numbers: 0000, 0001 ... 9999,
  • load list of 100 most commonly used passwords (from Adobe leak),
  • you can also prepare your own list of passwords and save them to //passwords.txt file. Note: it may be necessary to reboot OS if app is not detecting this file.





"Setup" allows you to:
  • prepare "typing sequence",
  • decrease typing speed (use if USB host is not accepting fast keyboard input, for example: in BIOS),
  • select keyboard layout
 Typing sequence can consists of following parameters:
  • %p - password
  • %u - user name (in such case you must provide it in text field below),
  • %e - press Enter key,
  • %t - press Tab key, 
  • %d - 500ms delay.
 Examples:
  • %p - type password
  • %p%e - type password, press enter
  • %u%t%p%e - type user name, press Tab, type password, press Enter,
  • %u%e%d%p%e - type user name, press Enter, wait 500ms, type password, press Enter.



Now you are almost ready to go. Plug InputStick into USB port and hit "Connect" button.

"Type" - type currently selected password (or sequence) and go to next one,
"Prev", "Next" - select previous or next password from current set (without typing),
"Jump" - jump to password at selected position (without typing),
"Enter", "Tab", "Esc" - press Enter, Tab or Escape key.


Wednesday, 3 June 2015

InputStickUtility 1.33

What's new in this version:
  • Modified "Add new device" screen (auto detecting Bluetooth type, advanced options).
  • Fixed bugs causing application crashes.

Most noticeable changes are related to "Add new device"screen:
  • Application will display information whether BT4.0 is supported by this Android device.
  • Bluetooth type is now automatically detected. Devices without BT4.0 support will always assume that InputStick uses BT2.1 version.
  • Behavior of "Refresh" button is now more intuitive. 
  • Introduced  "Advanced" button.
  • MAC address can be manually provided (for example when for some reason it is not being discovered by this device).
  • Bluetooth type can be manually selected (just in case if auto detection is not working properly). 
  • Device verification can be skipped, what allows to add InputStick device even if it's firmware is corrupted (if bootloader is still functional). 



Tuesday, 28 April 2015

Bluetooth 4.0 version - now available

InputStick with Bluetooth 4.0 is now (finally) available, you can get it here: inputstick.com/buy. New version is a bit more expensive (+3 USD/EUR), due to higher price of BT4.0 modules. InputStick with BT2.1 will still be available and supported by all InputStick compatible Android applications. After all, there are still a lot of Android 4.0 and even 2.3 devices being used.

Support for iOS devices.

BT4.0 version is next step towards making InputStick available for iOS users (Android users can also benefit from using BT4.0).

Good news:
  • BT4.0 version is confirmed to work with iPhone 4S and newer.
  • If you are an iOS developer, familiar with BT4.0, it should be relatively easy to use basic functions (like typing ASCII characters) using protocol documentation (available here).
Not so good news:
  • At this moment there are no iOS apps nor API available. Basic functionality (typing ASCII characters) is relatively easy to implement, but full API will require much more effort: encryption and authentication, keyboard layouts, firmware upgrade, restoring defaults. 
  • Since I'm not familiar with iOS development, this task will be carried out by other developer. At this moment I still can't give any more details about when the API may be finally available.

Why standard (BT2.1) version is not compatible with iOS devices? Apple decided that classic-Bluetooth devices must go through approval process and have special authentication chip. This is no longer the case when it comes to BT4.0, which was first introduced in iPhone 4S.

Hardware & Firmware.

The only difference between previous version and the new one is Bluetooth module. Other than that, hardware is exactly the same. Starting with 0.97 version, firmware supports both Bluetooth modules. This means that any firmware updates will be released for both BT2.1 and BT4.0 devices at the same time.

Android compatibility.

All existing applications (that use InputStickUtility as a proxy), will work with BT4.0 version out of the box. Examples: USB Remote, KP2A plugin.
If you've developed your own app and decided to use direct connection method (instead of connecting via Utility app), it will be necessary to rebuild the app using latest InputStick API.

How to use BT4.0 InputStick with your Android device? When adding new device in InputStickUtility, check "This is a BT4.0 device" checkbox.

Android requirements: 
  • 4.3 or newer (API18),
  • Bluetooth 4.0,
  • InputStickUtility app, version 1.30 or newer.
How to check if your phone supports new InputStick?
  1. download InputStickUtility application from GooglePlay store,
  2. go to "About & Help",
  3. click "Check BT4.0 support".
If your Android device was released within last 18 months, it is most likely compatible with new InputStick.

Bluetooth 4.0 vs Bluetooth 2.1.

Pros:
  • faster connection establishment: BT4.0 takes less than a second to establish a connection and go through initialization. In case of BT2.1, this usually required approximately 2-3 seconds.
  • lower latency: BT4.0 allowed to reduce latency, this makes noticeable difference when it comes to mouse interface, which now works smoother.
Cons:
  • lower data transfer rate: as a result, typing is approximately 25% slower. This becomes noticeable when a lot of text is being typed (more than 50 characters), for example when typing text files. You most likely won't even notice this when using apps like KP2A plugin or USB Remote.
  • no pairing PIN: due to bug in Android OS, if BT4.0 device requires pairing PIN, the OS will ask for the PIN during EVERY SINGLE connection attempt. Because of that, by default there is no pairing PIN and changing PIN for BT4.0 devices is disabled in InputStickUtility. Note: InputStick can be password protected using 128bit key, so lack of pairing PIN does not make it less secure (compared to BT2.1 version). If someone connects to password-protected InputStick, he won't be able to use it in any way (send key or mouse events) unless correct password is provided. Also, firmware makes potential bruteforce attack less effective by limiting authentications attempts to one each second.
In my opinion, in most scenarios advantages of BT4.0 are definitely more noticeable than its disadvantages.

Which version is right for me?

If you are mostly interested in using InputStick with iOS devices, you should wait a bit longer and wait for updates regarding iOS API and apps. Unless you are an iOS developer, familiar with using Bluetooth and want to try it ASAP.

You should get standard, BT2.1 version if:
  • your Android device does not support BT4.0
  • you are going to use InputStick to type A LOT OF TEXT (like thousand characters at a time) and typing speed is very important in your use case.
In every other case, you should consider getting BT4.0 version.

Wednesday, 15 April 2015

InputStickUtility 1.32

This update fixes a bug that appeared in previous version. When some other application was attempting to establish connection and InputStickUtility was not launched manually before, it would crash during the connection attempt.

Friday, 10 April 2015

InputStickUtility 1.31

Support for BT4.0 can be checked (About & Help).

InputStickUtility can now be used to check if your Android device is compatible with upcoming BT4.0 version of InputStick.
XT910 does not support BT4.0 InputStick.

Added Polish translation.

Polish translation won't matter for most users, but this is the first step to other language versions.

Polish version.

Other changes.

  • added proper summary for settings,
  • minor bug fixes and UI modifications.