11 ms·
Inside a low-budget consumer hardware espionage implant
- eyeareque 9y agoI’ve seen these before on eBay and really wondered what they were all about. Thanks to the person who took the time to write this up! It’s crazy how cheap and small these devices are.
- zbentley 9y agoWhat's especially creepy is that many devices (e.g. laptops) with USB ports continue sending power to those ports even when the device is off. So someone bugged with something like this implant could fully power off their laptop when discussing sensitive information, and if they left a bugged USB drive plugged in, they could still be compromised.
- QAPereo 9y agoBug or feature?
- floofyfloofer 9y agoFug!
- toomuchtodo 9y agoConfigurable option. Charge my iPhone, don’t power a bug.
- avian 9y agoFeature. It allows, among other things, for a computer to be woken up via the (USB-connected) keyboard.
- ThePadawan 9y agoAlso a branding/design feature. I've encountered extended color coding on multiple gaming oriented motherboards: Black for USB 2, Blue for USB 3.1 (so far so standard), Red for persistently powered. That way you can have your phone connected to that port and have it charge overnight, etc.
- scurvy 9y agoOr USB connected IR/RF remote (think media center PC's)
- otp124 9y agoI’d call it a feature. I sometimes need to harvest energy from my computer’s power supply to charge my phone without the computer being on (waste of energy)
- pkaye 9y agoYou can check the BIOS to see if there is an option to disable it.
- danesparza 9y agoGood luck with that: http://www.zdnet.com/article/minix-intels-hidden-in-chip-operating-system/ http://www.zdnet.com/article/minix-intels-hidden-in-chip-ope...
- pkaye 9y agoThat is a different issue. The article was about an external USB device. Also I don't understand the concern with people not trusting Intel. By using their hardware in any form you are inherently trusting them. Unless you are able to check their design and fabrication process, they could easily hide something in there to disable protections in Windows or Linux based on certain patterns of network traffic.
- khedoros1 9y agoSay that we trust Intel completely. Does that somehow make AMT not a security concern? For the ME itself, especially if it's not connected to any networking hardware: Whatever. It seems more like a theoretical threat than a practical problem. AMT sounds like something that I don't want running on my machine, even if I trust Intel itself completely.
- simion314 9y agoI think a CPU that has no mini PC inside it is much easy to verify, you can try a lot of inputs and see if the output gets weird, I think this technique was used to discover some hidden switches in Intel that the government uses to work around the ME on their own systems.
- pkaye 9y agoOkay lets say that the ethernet MAC has some gates that detect a particular 1024-bit random bit pattern in packets and that triggers a behavior change in certain sequence of instructions common in Windows security code to bypass it. How would you discover this?
- frankydp 9y agoThere are good reasons why USBs have been banned in the DOD for over a decade.
- matt_wulfeck 9y agoThis kind of thing would immediately stick out like a sore thumb to a lot of technical users. In the world of USB cables it’s HUGE, even though technically I know it’s very small for it’s purpose. Very cool nevertheless!
- pax 9y agoWhat if you just package it as usb hub & memory stick and hand it out for free? I guess from this point on, given the extra space, it would be relatively trivial to also send the file structure.
- beached_whale 9y agoHow often do people look behind their desks at the usb cables plugged into their systems. Many do not.
- sillysaurus3 9y agoAs someone who was involved with redteaming: ~nobody does. It's very rare to get caught after bugging someone's equipment. Bugs like these blend in seamlessly with the massive amounts of cables behind most desks.
- beached_whale 9y agoIt is scary as heck. I could be behind a desk and almost certainly would overlook this, or the mic I saw online embedded within an Ethernet cable the other day.
- beached_whale 9y agoFound the picture of the ethernet bug. https://twitter.com/nblr/status/928526534226391040 https://twitter.com/nblr/status/928526534226391040 That I would never notice behind a desk Also, in the usb cable with cell https://twitter.com/nblr/status/929132160602296320 https://twitter.com/nblr/status/929132160602296320
- blunte 9y agoThis is obviously not good, but I'm not sure it is particularly useful for something "important". Any target of high value will be pursued and observed by trained humans with advanced tools. The amount of data collected, I suspect, would be less but more accurate. A device like this just lowers the bar (really low) on tracking. However, it increases the noise/inaccuracy. If combined with some key logger and other devices, it could provide a very detailed picture of someone's communications and movements. But it would include a lot of noise as well, which would still require a lot of sifting and organizing to make sense of the data (and especially to filter out the noise). If anything, I think these devices are more a money grab on the "spies" than a significant intrusion on the targets.
- Oxitendwe 9y agoI think it would be pretty easy actually, to keep up with the data - you could just get a Bluetooth headset and set your phone to automatically accept calls from your spying device, then listen in while you go about your day.
- carbocation 9y agoOr hook it up to a Twilio and receive text notifications when a new recording is available. Optionally auto-transcribe and do topic modeling to extract only discussions of interest.
- samstave 9y ago+1 for the thought -100 for the thought... But at the end of the day, we dont want to encourage the deep surveillance state... but we techie always look at this sort of thing and then say "hmmm... wouldnt it be interesting if..."
- Oxitendwe 9y agoI don't think products like this encourage the "deep surveillance state" - if anything, they weaken it by loosening their monopoly on high-tech covert surveillance. These things can be used for good as well as evil - you could spy on a corrupt official or catch someone cheating just as easily as anything else.
- new299 9y agoI wonder what voltage is required to kill the Mediatek chip? Maybe a simple jig that put -24v through it could fry it? Of course, if you're expecting it, this device should be relatively simple to stop. I can imagine more stealthy variants however.
- abstractbeliefs 9y agoSimply removing the SIM would sort you out to stop it doing much, it seems.
- Oxitendwe 9y agoIf you already know it's there, you probably don't need to go through the trouble of destroying it, unless you just want to fry random USB devices.
- evancox10 9y agoThe idea is that you would apply a high voltage to just the cable, with nothing else attached. If it's just a cable, no harm no foul. On the other hand, if you start seeing smoke from the embedded electronics, you may want to use a different cable.
- revelation 9y agoYou could also just use one of those cheap USB power/voltage monitors as the author does. Obviously a cable alone should not be drawing power. Maybe an innovative company could add warnings for USB ports that draw power but have no recognized device. For the advanced ports with charging support and so on they should have power monitoring already.
- comex 9y agoUnfortunately, that approach will become less useful in the future, as all USB-C cables that support USB 3 and/or high power contain a chip to advertise that fact[1]. (And then there are Thunderbolt cables, which look the same but require even more sophisticated electronics.) [1] https://e2e.ti.com/blogs_/b/analogwire/archive/2016/03/07/which-usb-type-c-cable-is-right-for-my-application https://e2e.ti.com/blogs_/b/analogwire/archive/2016/03/07/wh...
- slim 9y agoJudging by the screenshots, the author uses Silence SMS app and you should too
- kardos 9y agoIt's actually Signal, see bottom of the long image [1] [1] https://ha.cking.ch/s8_data_line_locator/images/10_01_cmds.jpg https://ha.cking.ch/s8_data_line_locator/images/10_01_cmds.j...
- deleted 9y ago[deleted]
- VectorLock 9y agoLooks like the site got killed.
- lnanek2 9y agoWow: " This is probably not an elaborate scheme to harvest phone numbers and send them to China, but rather the way the default manufactured SIM code was implemented and it was never trimmed down to the needs of this device. Nevertheless, I found it interesting seeing how the device is accessing virtually everything on the SIM. " I agree, but it's rare to see someone not go fake ballistic claiming phone book capture for page views...
- Hasz 9y agoI wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set. You'd have to dissolve your SIM card in acid and wire bond it to the PCB, but wire bonding machinery is pretty cheap. Realistically, this is stupid easy for a state-level actor. A good hardware hacker worth their salt could probably set up a bug no bigger than 10mmx10mm in a couple of months for a few hundred, less if they already have a wire bonding machine and microscope. For a state level actor, you can roll your own ASIC and just dump RF and microcontroller on one die. Package it up inside a USB flash drive controller IC, mark it with someone else's logo, and you've got a bug that you would only find by dissolving the chip in acid and looking at the die very carefully. It'll cost you a few million, but it's just not that much money when your R&D budget is 150M/y. The weak part of all these systems is the constant GSM heartbeat, but even that is beatable.
- amenod 9y ago> The weak part of all these systems is the constant GSM heartbeat, but even that is beatable. Curious: how do you beat that? Do you listen to other signals and try to transmit at the same time (if you must)?
- Hasz 9y agoYou can broadcast on a timer, you can switch to a low frequency, low bandwidth transmitter, you can store locally and pick up the device later, etc. It all depends on the environment.
- jjoonathan 9y agoOr burst mode. That's been the speculated reasoning I've heard behind the USA's onerous POI restrictions on exported RTSAs.
- Hasz 9y agoThat's probably the better option. I found an article about the export restrictions here. https://signalhound.com/news/how-we-implemexport-controls/ https://signalhound.com/news/how-we-implemexport-controls/ seems like it has to do with the fact it's guaranteed to intercept a signal all the way down to 1.2 uS
- amenod 9y agoOff topic, but still: is that a price of almost 2 EUR per minute of call? (to that stranger's phone - 3333333) I thought calls inside EU are price-limited? Or is this some really old post?
- MyDamnUser 9y agoI found that odd too. I live in Denmark and i pay a fixed amount and can call as much as i want.
- tzs 9y agoHow are remotely monitored sensors and devices, like weather stations and power meters, that need to send a small amount of data periodically, and that use the cellular network for that handled in Europe? Those fixed price for unlimited calling plans that are great for human to human communication would suck for low data sensors and devices. In the US these are handled by special plans that have zero or close to zero fixed monthly cost, but have a high per byte or per minute rate so that they are quite cheap for their intended use (e.g., power meter daily usage report) but are too expensive to use for high data applications. If there are similar things in Europe, maybe that number was one of those?
- mastax 9y agohttps://particle.io https://particle.io and https://hologram.io https://hologram.io have almost worldwide availability for SIM's designed for this. There are probably older less-hip suppliers as well.
- kogepathic 9y ago> have almost worldwide availability for SIM's designed for this. They are great if you have sensors travelling to different countries or your volume isn't large enough to negotiate with a local telco. If you are deploying many devices in one country it will be far cheaper to talk to a local telco about getting a custoomized data package for your SIM cards. https://eseye.com https://eseye.com is another company supplying these roaming SIM cards.
- madengr 9y agoThe antenna could be better.
- ju-st 9y agoThe capacitor and power requirement are very small for a GSM device. My SIM800 experiments needed always a way beefier power supply.