8 ms·
Malicious Charging Cable
- Wowfunhappy 7y agoWhat would the white-hat use case for this be?
- kovacs_ 7y agoProbably pen testing primarily. Very similar to a rubber ducky tool.
- thaumasiotes 7y agoThe description explicitly says as much: > the O.MG Cable is built for covert field-use by Red Teams
- sschueller 7y agoI have one with a GSM radio in it. I leave it in my bag so when someone decides to steal it and the use it I can find my stuff.
- solarhoma 7y agoI have never heard of one of these. Link to where I can buy one for my laptop?
- sschueller 7y agohttps://www.aliexpress.com/item/4000221646126.html https://www.aliexpress.com/item/4000221646126.html I leave it in my other bag. Phone and laptop I can recover directly.
- balls187 7y agoHave you been successful in recovering your stolen items?
- sschueller 7y agoNot yet...
- balls187 7y agoI wonder if it's a perception thing--since you are hyper aware to the point you have a specialized USB cable-lojack, you are far less likely to be a victim of theft. Similar to how self-defense training doesn't necessarily make you a skilled fighter, but instead trains you to be more aware of your situations, and there for reduce the likelihood you will need to defend yourself.
- radicaldreamer 7y agoIt might lead you to the original person who stole your bag, but it likely won't help you recover your devices because those are very quickly forwarded onto organized crime networks which take stolen phones, reset and refurbish them, and sell them overseas or via used goods channels.
- snazz 7y agoHow effective is this type of crime system with Activation Lock-secured iPhones? You can't just wipe an iPhone from DFU mode and then set it up normally without the owner's Apple ID information. Do they try to sell to people who they know won't check if the device has Activation Lock and then disappear when the buyer discovers it doesn't work?
- mcny 7y agoWorst case, you can still use it as a bag of spare parts maybe?
- asdff 7y agoOr sell the dud locked phone to some sap on ebay then disappear off the face of the earth a couple hundred bucks richer, as is done.
- XMPPwocky 7y agoVery common to then aggressively try to phish the user's iCloud credentials and remove the activation lock; third-party vendors offer this sort of service, and they're very convincing.
- rahimnathwani 7y agoThere are very convincing phishing attacks used to get the original owner to reveal their Apple password: https://krebsonsecurity.com/2017/03/if-your-iphone-is-stolen-these-guys-may-try-to-iphish-you/ https://krebsonsecurity.com/2017/03/if-your-iphone-is-stolen... I know someone who fell for this. Even though they were skeptical when they received the message, they thought there was a chance it was legit, and therefore gave them some change to recover their stolen phone. I guess they had nothing to lose, as the chance of recovering the phone was ~zero anyway.
- mrlambchop 7y agoI assume it (a) actually functions as a cable that can charge a phone (b) can enumerate on the USB A connection as various types of slave (such as network adapter or storage device) and use this to bridge into the computer (c) enabled connections to the cable Wi-Fi from a phone as a means to control or monitor the cables activities. I initially thought this might be used to hack into phones via the lightening or USB ports, but the security on these devices is pretty good. It seems less likely that an exploit of this value would be put into cables like this. I still worry about plugging my phone into random hotel or transport USB charge ports however... I should pick up a USB condom I guess!
- derwiki 7y agoI think the DEFCON exploit was having this act as a USB keyboard to the computer it’s plugged into, and using the keyboard to open terminal and execute the attack.
- hinkley 7y agoI poked around their site and they talk about Red Teams a lot, which are a concept of institutionalized penetration testing. Not unlike Chaos Monkey is to reliability engineering.
- kybernetikos 7y agoNot this exactly but similar - for some time I've wanted a charging cable with enough fast memory on it to act as a boot drive. Normal charging cable when plugged in on both ends, boot drive when only plugged in on one. Pair with an innocuous windows laptop and you can go through airport security without worrying about compromising your data.
- mynegation 7y agoAt some point iOS started asking if I want to trust the device, so I suppose if I use this malicious cable with charger and iOS asks me about computer or accessory, I would know things are fishy, would not I?
- lisper 7y agoTheoretically. Unfortunately, the device trust settings are not reliably remembered. My phone regularly asks me if I want to trust my computer despite the fact that I haven't made any changes to it. So it might be an indication that something is fishy, or (much more likely) it might just be that a trust setting has expired. Also, no device fingerprint is displayed along with the query, so there's no way to know which device the phone is actually asking you to approve.
- mynegation 7y agoThis is true. If one uses this cable to attach to a computer- there is no way to know, but charger is supposed to be dumb device. I wonder if this thing detects that and does not announce itself.
- kybernetikos 7y agoI saw something about changing the cable's hardware ids to avoid this. I guess you find a piece of hardware that you know is trusted by the target phone and then copy its hardware id onto the cable if you want to evade that warning.
- gruez 7y agoI'm skeptical that would work. If anything it's authenticated with the computer itself, not the cable.
- earthboundkid 7y agoMaybe you first use physical access to connect to the victim’s computer, get the ID, and masquerade as it in the cable? It’s a hassle, but if the laptop is left alone in the house, doable.
- forkexec 7y agoAlmost as awesome as building it into a server's plastic case hardware at the factory, but still awesome.
- wfriesen 7y agoSimilar to this is the USB Ninja, which delivers a remote payload like the Rubber Ducky. https://hackerwarehouse.com/product/usb-ninja-cable/ https://hackerwarehouse.com/product/usb-ninja-cable/
- kweks 7y agoFor those who may be curious, how two very similar products (USBNinja and the O.MG Cable) exist, there is a bit of history. Both products are based on the concept of a HID attack: most modern OSs (MacOS, Linux, Windows, Android...) trust HID (Human Interface Devices) implicitly. This means that when you plug in a Keyboard, Mouse, Storage device or Network device, they work instantly. You don't need to install drivers or explicitly enable them. The newly attached devices work instantly - even on a locked device. The advantage here is obvious. The disadvantage is more subtle, but was exploited by the Hak5 "Rubber Ducky". By emulating a HID device (or even worse, multiple HID devices simultaneously..) - you could essentially control a computer and deploy / execute anything, as if you had full control of the device. "The Classic" PoC is the Windows "Creds" attack [1] - which unlocks locked windows machines - later turned very, very nuclear by Samy Kamkar with PoisonTap [2], which essentially exfiltrates data, exfiltrates cookies and credentials, and permanently backdoors a locked PC. The idea of moving from a dedicated device (Rubber Ducky) to an embedded device first came to surface with the BadUSB device [3]. The idea of moving it into a cable came from the NSA, a device called COTTONMOUTH [4][6], which was leaked during the NSA document dumps [5]. MG, the designer of BadUSB, built a prototype of this with today's resources. RRG, the company behind the latest iterations of Proxmark 3, ChameleonTiny, etc prototyped and built the USBNinja. Their device is built on the Arduino (Ducky) framework, as opposed to the ESP32 Framework. There is / was drama between MG (behind BadUSB) and RRG / Kevin Mitnik; MG claimed that it was his prototyped device was brought to market first by RRG. Drama aside, both products exist, both serve the same purposes, and from a hardware point of view, they're both incredible devices that we could have never imagined 10 years ago. Personally, I find the framework of the USBNinja to be slightly better in practical purposes, (Non-degraded USB-C charging and performance, non detectable wifi etc). I believe there is also a "pro" version slated for release that adds significant functionality. Source / disclaimer for all of this: I source products for https://Lab401.com https://Lab401.com - so we performed a deep dive on both products before deciding which to stock. I also had the chance to visit the factories and witness the prototyping - absolutely fascinating. It's worth underlining that when the COTTONMOUTH device came out in 2009, it had a value of over 1MUSD. 10 years later, arguably better and smaller devices are literally 0.01% the price, and you can have one in your hand. Progress is amazing. [1] https://shop.hak5.org/blogs/news/15-second-password-hack-mr-robot-style https://shop.hak5.org/blogs/news/15-second-password-hack-mr-... [2] https://samy.pl/poisontap/ https://samy.pl/poisontap/ [3] https://github.com/O-MG/DemonSeed https://github.com/O-MG/DemonSeed [4] https://arstechnica.com/information-technology/2013/12/inside-the-nsas-leaked-catalog-of-surveillance-magic/ https://arstechnica.com/information-technology/2013/12/insid... [5] https://en.wikipedia.org/wiki/NSA_ANT_catalog https://en.wikipedia.org/wiki/NSA_ANT_catalog [6] https://en.wikipedia.org/wiki/File:NSA_COTTONMOUTH-I.jpg https://en.wikipedia.org/wiki/File:NSA_COTTONMOUTH-I.jpg
- h4waii 7y agoWow, could those photos be any worse? https://mg.lol/blog/omg-cable/ https://mg.lol/blog/omg-cable/ and https://github.com/O-MG/O.MG_Cable-Firmware https://github.com/O-MG/O.MG_Cable-Firmware have more information about the cable, but is still severely lacking on technical details about the hardware and software used to communicate.
- tyingq 7y agoBased on the firmware[1], I'm guessing esp32. [1] https://github.com/O-MG/O.MG_Cable-Firmware/blob/master/README.md https://github.com/O-MG/O.MG_Cable-Firmware/blob/master/READ...
- dijit 7y agoShameless plug: the hak5 community[0] is super nice and while there are "can you hack facebook" people around there is also a dearth of super kind people who are willing to put in the time to teach people about computers. I have been watching their shows since season two and recently was granted the proud responsibility of hosting their IRC these days[1]. (which is the shameless plug) Obviously it's built for newbies but that's part of the charm and a lot of the content gets new people interested in security and computers in general. :) [0]: https://forums.hak5.org/ https://forums.hak5.org/ [1]: ircs://irc.hak5.org/hak5
- justinjlynn 7y agoThanks for maintaining that IRC server. It's nice to see people keeping that kind of place alive and working. :)
- onionisafruit 7y agoFrom context, I think you mean the opposite of dearth.
- teachrdan 7y agoHeh, Steve Martin made the same mistake: 'I had developed a small reputation from my appearances at the Ice House, and on May 6, 1969, I wrangled a meeting and auditioned in an office for Steve Allen’s two producers, Elias Davis and David Pollock. They accepted me with more ease than I expected, and when I spoke with them afterward, they commented, “There seems to be a dearth of young comedians right now.” I looked puzzled. I said, “That’s odd, I don’t think there are many at all.” Their stares made me realize my blunder. I knew the word, but I had the definition backward.' From "Born Standing Up," an amazing memoir
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- nerfhammer 7y agoI wonder what it would look like if you tested these cables using something like this: https://www.tindie.com/products/16907/ https://www.tindie.com/products/16907/ [cough, cough] Presumably it wouldn't look like data lines were present
- donatj 7y agoNot sure I’m understanding what this does? The page lacks information in the extreme. Can this keylog? Does other data just transparently pass through or can this log it? Does it show up as an HID device when not activated? What wireless bands does this operate on? At the very least a list of specs would be greatly appreciated!
- kweks 7y agoImagine a Rubber Ducky crammed invisibly into a cable, with wireless functionality. Imagine what you could do on a terminal with keyboard mouse and storage, and that's pretty much what this can do. In theory undetectable while not activated.
- MarkSweep 7y agoI wonder how it looks in an x-ray scanner. Some secured facilities x-ray everything that comes in or out.
- winrid 7y agoSo this is for attacking a phone, computer, or both?