8 ms·

This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this d

This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this does for company's cybersecurity practices. A rogue janitor replaces the usb cables on some of the employees of a company that makes $INSERT_SUPER SECRET_TECH$ and done.

TylerE 8y ago
How? I've never seen a device, certainly not a PC, that will just randomly connect to any router it sees without some sort of user input.
- arcaneman92 8y ago
  It looks like it could be a variant of this squashed down to fit in the connector of a cable. https://github.com/spacehuhn/wifi_ducky https://github.com/spacehuhn/wifi_ducky If it is, then the computer doesn't connect to a router at all. The USB cable could make itself available as a network that you remotely connect to then execute commands. The cable then types out your commands as it imitates a USB keyboard. Have you ever seen a device or PC that randomly trusts a USB keyboard you plug into it?
  - pault 8y ago
    I can't tell if you're being sarcastic or not but yes, every device I own automatically accepts input from any keyboard I plug in.
    - arcaneman92 8y ago
      Sorry, I was trying to reply to the above comment by structuring it in the same way, but making one minor switch to show how severe the issue can be. Trusting a router may not happen, but trusting a keyboard (as you've pointed out) almost always does.
- snazz 8y ago
  My understanding is that it allows an attacker connected to it via WiFi to mess with the plugged-in computer using USB (pretending to be a keyboard). See the Twitter video: https://mg.lol/blog/omg-cable/ https://mg.lol/blog/omg-cable/
  - muthdra 8y ago
    A secretly-IoT keyboard that shares your key presses and may "type" malicious stuff when you're not looking at it; the OS wouldn't be able to tell it's not you doing the typing. Not scary at all, no sir.
    - yipbub 8y ago
      It can't read your keypresses (I think)
      - blattimwind 8y ago
        It can't (unless it's the keyboard cable).
        ngcc_hk 8y ago
        Hid usually ok with systems and hence a wireless mouse and keyboard pretended. A windows hack may be - The “mouse” would ask to move to leftmost bottom corner then click. Type searching terms like Cmd<r>. Then if can get hold of the windows one is in ... Any better idea?
        tyingq 8y ago
        <windows-key>R brings up a run dialog with the focus already in the text box waiting for a command. No mouse needed.
        muthdra 8y ago
        Keyboard shortcuts.
- muthdra 8y ago
  Any PC may randomly connect to any router it sees if it firmly believes that is the same router the user allowed it to connect last time.
- blihp 8y ago
  Via the microcontroller embedded with the wifi adapter in the cable. It can effectively operate as a separate computer which uses the host PC parasitically for power and I/O.
- ecpottinger 8y ago
  Who needs access to a router, just sniffing for passwords this would work. Put in the right machine and you can see every company memo as it is written.
- m-p-3 8y ago
  Doable with an ESP chip, monitoring for open WiFi network and connects to whatever is available. Then you could have it await further instructions from a C&C. That wouldn't need further actions from the victim.
- emmelaich 8y ago
  'How' is DHCP. That's one. Apparently there are least 28 more ways to use usb to attack a machine. https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/ https://www.bleepingcomputer.com/news/security/heres-a-list-...
  - gsich 8y ago
    >'How' is DHCP. Not without notice. Your computer won't connect to a wirless network automatically. So in order for this to work, the USB-device needs the same SSID and key. Then, in order to make it not suspicious (and get your data) you need to actually forward traffic to the internet. Not sure if those devices can repeat. Emulating an USB ethernet might help you, as those will connect, but without uplink it's still suspicious.
    - jeroenhd 8y ago
      The "cable" has WiFi, so it's probably possible to set up a hidden WiFi network around the premises of the target and have the implant connect with that. With the right type of antenna you can set up a WiFi connection to a specific device from quite a way away. Then tunnel the connection from your malicious AP and emulate ethernet on the USB side of the implant. Or, search for open/guest networks and use those as an uplink. There's plenty of possibilities for this to work as a malicious network adaptor. However, I think the network example is just a proof of concept and the remote connectivity is much more interesting to any real attacker.
- deathanatos 8y ago
  I think the device featured in the article "merely" appears as a keyboard to the victim machine. The attack can then transmit keystrokes over WiFi. (This is still sufficiently dangerous. Essentially, it's "open terminal, download evil.exe, execute evil.exe, minimize/close" and escalate from there. So, not something you want to happen.) That said, if you click the link next to BadUSB, they detail attacks whereby the device pretends to be a USB Ethernet adapter instead. And while you're right that stuff typically wants user input prior to connecting to WiFi networks, I don't think anything prompts before connecting to wired networks. The onboard WiFi could even make it appear to work, so as to not arouse suspicion (by simply bridging the pretend-ethernet to the WiFi), but now your attack has a MitM and a keyboard… Needless to say, you don't want random USB devices getting plugged into your machine.
  - jon-wood 8y ago
    I’m sure there are some secure networks that require 802.1x authentication against a specific certificate authority, which would ensure devices only connect to a trusted network. That’s definitely an exception rather than the rule though - I’ve never worked anywhere that does anything more than limiting which device can connect to a particular switch port.
    - deathanatos 8y ago
      I've also seen wired network authentication, but that's typically the network authenticating the devices that connect to it. This is more like the need for the device to authenticate the network that it's attached to, or really, to authenticate the USB devices attached to it. This is somewhat problematic: I feel like most employees/people want to go to a coffee shop and do work, or work at home, etc. How does one distinguish between those networks and the rouge ones? (I think ideally, you don't distinguish. Every network is equally untrusted, and you rely on good end-to-end encryption. That doesn't address the rouge HID attack, however.) I've also seen unauthenticated corporate networks where STP packets reach the end user ports, and AIUI, the right response packet would direct the network to start sending all traffic my way…
rwmj 8y ago
In secure locations it's common for USB ports to be physically blocked (the ones I've seen with glue/resin).
- walrus01 8y ago
  In super secure locations like a SCIF, a TSCM (technical surveillance countermeasures) team comes through on a regular basis with highly sensitive, expensive portable spectrum analyzers, which would find this really quick.
  - tomatotomato37 8y ago
    Completely out of scope of anything but superpower espionage, but that got me wondering if you could do something useful with a nanoscale mechanical computer built the same way they do those microchip gyroscopes. The simplest would be a mechanical timer for toggling power only when there's no countermeasure scan going on, but I wonder if there are other clever things you could do if you had a nationstate budget
    - crankylinuxuser 8y ago
      Ive made and will be giving a talk on what a TSCM team would use. My talk was accepted at CircleCityCon in Indianapolis IN. I've built a tablet capable of intercepting and injecting radio from 20MHz to 1.5GHz. https://ccc2019cfp.busyconf.com/activities/5c3a57314808fac1050000b2 https://ccc2019cfp.busyconf.com/activities/5c3a57314808fac10... https://mobile.twitter.com/CrankyLinuxUser/status/1097884386404564993 https://mobile.twitter.com/CrankyLinuxUser/status/1097884386... Repo: https://gitlab.com/crankylinuxuser/siginttablet https://gitlab.com/crankylinuxuser/siginttablet
      - dfc 8y ago
        Why would a TSCM want to inject traffic and potentially alert the adversary to the detection? Have you seen some of the spectrum analyzers built on HackRF?
gruez 8y ago
>I mean someone can just replace the cables in my house and my phones and computer would become infected. Only if you leave your computer unlocked and unattended. If it's attended, obviously you'll see something's going on and pull the plug on the computer and probably investigate further. If your computer is locked (which is a good habit to have when leaving your workstation, the faked keyboard can't do.
- deleted 8y ago
  [deleted]
- cced 8y ago
  So you bring all your cables with you everywhere you go? I think OP is saying that these cables could be swapped out while you’re away. As for “seeing that something is going on”, I really don’t think anyone worth half their salt would allow for such a scenario... authors of such implants aren’t exactly registering the device with the OS.
deleted 8y ago
[deleted]
cmroanirgo 8y ago
While I understand how this could've been fun to 'try out', I can think of nothing but ways that this can be seriously abused. (atm attacks, corporate spying, ...) Can a device like this be used do anything positive toward humanity? Did I misunderstand something? (I'm genuinely curious!) Edited: reworded (honest) question to be less negative.
- SlowRobotAhead 8y ago
  >How does a device like this do anything but affect humanity in a negative way? How is the kind of 'research' remotely legal? Here is some advice, whenever you think “there aught to be a law...” there probably shouldn’t be. Planes would be falling out of the sky and high rises would be on fire if everyone had your sense of what types of research should “be allowed”.
  - cmroanirgo 8y ago
    > whenever you think “there aught to be a law...” there probably shouldn’t be I actually totally agree (which is the reason for my edited response above, before your comment arrived)... but there must be limits, musn't there? We don't arbitarily allow murder, rape or theft. Looking at the concept of "freedom" is a tricky thing, I've found. At what point does "doing whatever I want" become unacceptable to the very society that bred that behaviour? What should that society do to curtail behaviours that are actively destructive against it? As an individual in society, shouldn't I make some stand (as feeble as it might be), against what I (personally) think as exceedingly disruptive and that goes against the "common good"? By the downvotes I've received, it seems that my voice is very much unwanted - which seems to show how it "me" that is the outcast in this situation, and not this builder of spyware. To me this is ironic (but irrefutable), despite the honest question of the purpose of this device which has been popularised on a well known 'tinkering' site.
    - SlowRobotAhead 8y ago
      I don’t know how to reply without being too snarky. Is your position that we shouldn’t “allow” someone to build a wifi module hidden in a USB cable, because we don’t allow rape and murder? I’ll let someone else see if they can help you out. But I think you need to take a BIG step back and ask yourself this “have I solved all the problems in my own life” and if the answer is no, stop thinking so much about what other people should be “allowed” to do. Worry about self. Take up the position that my right to swing my fiat ends at your nose.
ImprovedSilence 8y ago
Or just sell you generic looking cables that have all these funzies inside on amazon/new egg/your favorite online store!

TylerE 8y ago

How? I've never seen a device, certainly not a PC, that will just randomly connect to any router it sees without some sort of user input.

arcaneman92 8y ago
It looks like it could be a variant of this squashed down to fit in the connector of a cable. https://github.com/spacehuhn/wifi_ducky https://github.com/spacehuhn/wifi_ducky If it is, then the computer doesn't connect to a router at all. The USB cable could make itself available as a network that you remotely connect to then execute commands. The cable then types out your commands as it imitates a USB keyboard. Have you ever seen a device or PC that randomly trusts a USB keyboard you plug into it?
- pault 8y ago
  I can't tell if you're being sarcastic or not but yes, every device I own automatically accepts input from any keyboard I plug in.
  - arcaneman92 8y ago
    Sorry, I was trying to reply to the above comment by structuring it in the same way, but making one minor switch to show how severe the issue can be. Trusting a router may not happen, but trusting a keyboard (as you've pointed out) almost always does.
snazz 8y ago
My understanding is that it allows an attacker connected to it via WiFi to mess with the plugged-in computer using USB (pretending to be a keyboard). See the Twitter video: https://mg.lol/blog/omg-cable/ https://mg.lol/blog/omg-cable/
- muthdra 8y ago
  A secretly-IoT keyboard that shares your key presses and may "type" malicious stuff when you're not looking at it; the OS wouldn't be able to tell it's not you doing the typing. Not scary at all, no sir.
  - yipbub 8y ago
    It can't read your keypresses (I think)
    - blattimwind 8y ago
      It can't (unless it's the keyboard cable).
      - ngcc_hk 8y ago
        Hid usually ok with systems and hence a wireless mouse and keyboard pretended. A windows hack may be - The “mouse” would ask to move to leftmost bottom corner then click. Type searching terms like Cmd<r>. Then if can get hold of the windows one is in ... Any better idea?
        tyingq 8y ago
        <windows-key>R brings up a run dialog with the focus already in the text box waiting for a command. No mouse needed.
        muthdra 8y ago
        Keyboard shortcuts.
muthdra 8y ago
Any PC may randomly connect to any router it sees if it firmly believes that is the same router the user allowed it to connect last time.
blihp 8y ago
Via the microcontroller embedded with the wifi adapter in the cable. It can effectively operate as a separate computer which uses the host PC parasitically for power and I/O.
ecpottinger 8y ago
Who needs access to a router, just sniffing for passwords this would work. Put in the right machine and you can see every company memo as it is written.
m-p-3 8y ago
Doable with an ESP chip, monitoring for open WiFi network and connects to whatever is available. Then you could have it await further instructions from a C&C. That wouldn't need further actions from the victim.
emmelaich 8y ago
'How' is DHCP. That's one. Apparently there are least 28 more ways to use usb to attack a machine. https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/ https://www.bleepingcomputer.com/news/security/heres-a-list-...
- gsich 8y ago
  >'How' is DHCP. Not without notice. Your computer won't connect to a wirless network automatically. So in order for this to work, the USB-device needs the same SSID and key. Then, in order to make it not suspicious (and get your data) you need to actually forward traffic to the internet. Not sure if those devices can repeat. Emulating an USB ethernet might help you, as those will connect, but without uplink it's still suspicious.
  - jeroenhd 8y ago
    The "cable" has WiFi, so it's probably possible to set up a hidden WiFi network around the premises of the target and have the implant connect with that. With the right type of antenna you can set up a WiFi connection to a specific device from quite a way away. Then tunnel the connection from your malicious AP and emulate ethernet on the USB side of the implant. Or, search for open/guest networks and use those as an uplink. There's plenty of possibilities for this to work as a malicious network adaptor. However, I think the network example is just a proof of concept and the remote connectivity is much more interesting to any real attacker.
deathanatos 8y ago
I think the device featured in the article "merely" appears as a keyboard to the victim machine. The attack can then transmit keystrokes over WiFi. (This is still sufficiently dangerous. Essentially, it's "open terminal, download evil.exe, execute evil.exe, minimize/close" and escalate from there. So, not something you want to happen.) That said, if you click the link next to BadUSB, they detail attacks whereby the device pretends to be a USB Ethernet adapter instead. And while you're right that stuff typically wants user input prior to connecting to WiFi networks, I don't think anything prompts before connecting to wired networks. The onboard WiFi could even make it appear to work, so as to not arouse suspicion (by simply bridging the pretend-ethernet to the WiFi), but now your attack has a MitM and a keyboard… Needless to say, you don't want random USB devices getting plugged into your machine.
- jon-wood 8y ago
  I’m sure there are some secure networks that require 802.1x authentication against a specific certificate authority, which would ensure devices only connect to a trusted network. That’s definitely an exception rather than the rule though - I’ve never worked anywhere that does anything more than limiting which device can connect to a particular switch port.
  - deathanatos 8y ago
    I've also seen wired network authentication, but that's typically the network authenticating the devices that connect to it. This is more like the need for the device to authenticate the network that it's attached to, or really, to authenticate the USB devices attached to it. This is somewhat problematic: I feel like most employees/people want to go to a coffee shop and do work, or work at home, etc. How does one distinguish between those networks and the rouge ones? (I think ideally, you don't distinguish. Every network is equally untrusted, and you rely on good end-to-end encryption. That doesn't address the rouge HID attack, however.) I've also seen unauthenticated corporate networks where STP packets reach the end user ports, and AIUI, the right response packet would direct the network to start sending all traffic my way…

rwmj 8y ago

In secure locations it's common for USB ports to be physically blocked (the ones I've seen with glue/resin).

walrus01 8y ago
In super secure locations like a SCIF, a TSCM (technical surveillance countermeasures) team comes through on a regular basis with highly sensitive, expensive portable spectrum analyzers, which would find this really quick.
- tomatotomato37 8y ago
  Completely out of scope of anything but superpower espionage, but that got me wondering if you could do something useful with a nanoscale mechanical computer built the same way they do those microchip gyroscopes. The simplest would be a mechanical timer for toggling power only when there's no countermeasure scan going on, but I wonder if there are other clever things you could do if you had a nationstate budget
  - crankylinuxuser 8y ago
    Ive made and will be giving a talk on what a TSCM team would use. My talk was accepted at CircleCityCon in Indianapolis IN. I've built a tablet capable of intercepting and injecting radio from 20MHz to 1.5GHz. https://ccc2019cfp.busyconf.com/activities/5c3a57314808fac1050000b2 https://ccc2019cfp.busyconf.com/activities/5c3a57314808fac10... https://mobile.twitter.com/CrankyLinuxUser/status/1097884386404564993 https://mobile.twitter.com/CrankyLinuxUser/status/1097884386... Repo: https://gitlab.com/crankylinuxuser/siginttablet https://gitlab.com/crankylinuxuser/siginttablet
    - dfc 8y ago
      Why would a TSCM want to inject traffic and potentially alert the adversary to the detection? Have you seen some of the spectrum analyzers built on HackRF?

gruez 8y ago

>I mean someone can just replace the cables in my house and my phones and computer would become infected. Only if you leave your computer unlocked and unattended. If it's attended, obviously you'll see something's going on and pull the plug on the computer and probably investigate further. If your computer is locked (which is a good habit to have when leaving your workstation, the faked keyboard can't do.

deleted 8y ago
[deleted]
cced 8y ago
So you bring all your cables with you everywhere you go? I think OP is saying that these cables could be swapped out while you’re away. As for “seeing that something is going on”, I really don’t think anyone worth half their salt would allow for such a scenario... authors of such implants aren’t exactly registering the device with the OS.

deleted 8y ago

[deleted]

cmroanirgo 8y ago

While I understand how this could've been fun to 'try out', I can think of nothing but ways that this can be seriously abused. (atm attacks, corporate spying, ...) Can a device like this be used do anything positive toward humanity? Did I misunderstand something? (I'm genuinely curious!) Edited: reworded (honest) question to be less negative.

SlowRobotAhead 8y ago
>How does a device like this do anything but affect humanity in a negative way? How is the kind of 'research' remotely legal? Here is some advice, whenever you think “there aught to be a law...” there probably shouldn’t be. Planes would be falling out of the sky and high rises would be on fire if everyone had your sense of what types of research should “be allowed”.
- cmroanirgo 8y ago
  > whenever you think “there aught to be a law...” there probably shouldn’t be I actually totally agree (which is the reason for my edited response above, before your comment arrived)... but there must be limits, musn't there? We don't arbitarily allow murder, rape or theft. Looking at the concept of "freedom" is a tricky thing, I've found. At what point does "doing whatever I want" become unacceptable to the very society that bred that behaviour? What should that society do to curtail behaviours that are actively destructive against it? As an individual in society, shouldn't I make some stand (as feeble as it might be), against what I (personally) think as exceedingly disruptive and that goes against the "common good"? By the downvotes I've received, it seems that my voice is very much unwanted - which seems to show how it "me" that is the outcast in this situation, and not this builder of spyware. To me this is ironic (but irrefutable), despite the honest question of the purpose of this device which has been popularised on a well known 'tinkering' site.
  - SlowRobotAhead 8y ago
    I don’t know how to reply without being too snarky. Is your position that we shouldn’t “allow” someone to build a wifi module hidden in a USB cable, because we don’t allow rape and murder? I’ll let someone else see if they can help you out. But I think you need to take a BIG step back and ask yourself this “have I solved all the problems in my own life” and if the answer is no, stop thinking so much about what other people should be “allowed” to do. Worry about self. Take up the position that my right to swing my fiat ends at your nose.

ImprovedSilence 8y ago

Or just sell you generic looking cables that have all these funzies inside on amazon/new egg/your favorite online store!