36 ms·

O.mg Cable

1690 points by fredley 5y ago

shapefrog 5y ago
You should use a data blocker when using an unknown USB cable to charge your phone. Occasionally described as a USB condom. Simply a Male to Female USB adaptor with the data wires not passed through.
- shadilay 5y ago
  Is that USB-PD compatible?
  - gumby 5y ago
    I have not seen one that is. You can block data access and revert to USB 2-level power "negotiation" with a couple of passives and that is all I've seen anyone do. I did look into designing one a few years ago. The PD negotiation is quite complicated (and is done through the signaling lines, so you have to manipulate them yet block all other uses). That was early days for USB C -- there may be better chip support for doing that today.
  - mschuster91 5y ago
    The "USB condoms" I know are USB2/3 only which means there isn't any form of PD negotiation anyway, and the oldschool Qualcomm Quickcharge and Apple's negotiation won't work either as these depend on D+/D-. A decent USB-C condom would also have to cut not just the USB2 D+/D- line, but also the USB3 SS and SBU lines... the really interesting thing is the CC wires, since without these you can't have reversible connectors, but not cutting them leaves an avenue for attackers (e.g. putting an USB-C port into JTAG mode). And on top of that USB-C PD 1 used the Vbus line with an overlaid HF signal. That means a decent USB-C condom will need: - a low-pass on the Vbus line to block PD1 - cut D+/D-, SS, SBU - cut CC1/CC2 and insert an as-dumb-as-possible controller chip to handle plug orientation
    - megous 5y ago
      You don't need orientation handling if you've cut all the other signals, so... Power negotiation is also not a big problem. Just use a correct resistor on the CC pin and you can make the phone use up to 5V/3A, which is plenty for any smartphone. You'd have to make sure to use a 5V/15W capable power source, though.
      - mschuster91 5y ago
        > You'd have to make sure to use a 5V/15W capable power source, though. ... which precisely is something I cannot make sure on a device where I'm tempted to use a USB condom, and it won't be useful at all for laptops.
        shapefrog 5y ago
        I actually learnt a lot from these comments, so my thanks - USB-C is still just a mirrage on the horizion for me, so not something I have considered deeply.
        megous 5y ago
        So use Sink.Default instead, and live with 5W, that all USB power sources support. Security is inconvenient.
    - PeterisP 5y ago
      What I hear from you is that a decent USB-C-condom needs to be a smart "MITM" device that has sufficient internal logic to proxy the power negotiation between devices at both ends.
- deleted 5y ago
  [deleted]
aabajian 5y ago
I live in Seattle and have had my car broken into three times. Each time, they steal my iPhone's USB cable. I wonder, could they add cellular connectivity to this cable and use it as a GPS locator?
- lucideer 5y ago
  Not sure about GPS but it includes remote access via WiFi, and some of the cables on offer quote "Long Range WiFi (2 KM+)"
  - Y_Y 5y ago
    Why can't all my devices have 2km WiFi‽
    - VenTatsu 5y ago
      The cables have 2km WiFi with a directional antenna (presumably on the other end), you could probably get similar range out of most of your devices if your bases station had a directional antenna, but that eliminates much of the value for many WiFi applications.
    - megous 5y ago
      Because you'd share bandwidth with 100k other people in a city. You'd be glad for the days of dialup.
- cbg0 5y ago
  Are they really breaking into your car just to steal your USB cable or is there other stuff you leave in plain sight?
  - shepherdjerred 5y ago
    Lightning cables are expensive, and Apple is definitely encouraging car theft by not including them in the box anymore. edit: this was a joke and it got appropriately downvoted. I regret nothing.
Eiriksmal 5y ago
Wow! Is the trick that we now have powerful microcomputers small enough to fit into a USB plug? That's pretty incredible technology. How many years ago did this become possible? My IT security training is dated, I am aware of the risks of plugging in a random USB key, but just a cable from a helpful "coworker"? Yikes.
- fragmede 5y ago
  That level of miniaturization is far older than Apple's removal of the iPhone headphone jack in 2016, but the related lightning-to-audio jack dongle had a microcontroller with a DAC inside that you'd never think existed due to the form factor.
  - varikin 5y ago
    Just for reference, here are a couple breakdowns of how impressive the iPhone headphone jack is. It is impressive how good it is and how tiny it is. https://www.ifixit.com/News/8448/apple-audio-adapter-teardown https://www.ifixit.com/News/8448/apple-audio-adapter-teardow... https://www.kenrockwell.com/apple/lightning-adapter-audio-quality.htm https://www.kenrockwell.com/apple/lightning-adapter-audio-qu...
    - duped 5y ago
      It would be more impressive if they could fit it inside the phone.
      - 1-more 5y ago
        remember project aria? Apple actually did that and everyone got mad!
      - ChuckNorris89 5y ago
        Funny enough, that shouldn't be a challenge for Apple since the world's slimmest smartphone ever made actually has a headphone jack[1], so Apple excuse of not enough space inside the phone is horse shit to force everyone into the Airpods ecosystem. [1]https://youtu.be/Ijssm6Qv5nE https://youtu.be/Ijssm6Qv5nE
flixic 5y ago
Took me a moment to realise, but this is for keyboards, not iPhones. I don't think (?) anybody can access anything from an iPhone using an evil cable (using publicly-known attacks).
- ttul 5y ago
  I’m kind of surprised that Apple doesn’t encrypt keystrokes between its keyboards and the host machine, given than they have the capability to enable the keyboard to authenticate the host using PKI. Maybe this is on their todo list.
  - girishso 5y ago
    So we can’t use third party keyboards with Apple devices? No thanks.
    - mikestew 5y ago
      That’s...not what parent typed. Use whatever keyboard you like, but you’ll only get E2EE with an Apple keyboard.
      - VenTatsu 5y ago
        The cable claims that it's a random 3rd party keyboard when it talks to the Mac, the cable claims it's a random non Apple device when it talks to the keyboard, the keyboard falls back to non-encrypted mode as it's not on a product that supports it. Man in the middle is hard to prevent when you need to be compatible with incredibly broken insecure legacy protocols. Apple could maybe go the route that all new Apple keyboards only work with new Macs and iOS devices, but that would mean that they can't work with any existing Apple hardware or third party systems.
        amatecha 5y ago
        I guess the MITM attack could be mitigated in the OS by showing an "encrypted keyboard connection" UI indicator of sorts. Assuming the MITM hardware doesn't exploit a vulnerability in the OS to incorrectly show that indicator. ;)
reilly3000 5y ago
It was my firm belief that many of the angry mobs at vote counting offices around the 2020 elections were cover for planting these types of devices. That is very much out of the Roger Stone playbook. The lack of anomalies has shaken that belief… but I do hope that the existence of these types of devices is included in security training for future polling staff.
- upearly4 5y ago
  I vote (so to speak) for paper ballots and voter ID. Of course in that case, Roger Stone's guy would have won handily.
  - vajrabum 5y ago
    Be nice if convicted felon Roger Stone or his guy had ever presented evidence of that in a court room. In federal court it's sanctionable for a lawyer to lie to the court. Did you notice that Sidney Powell, the former guy's attorney, was sanctioned and referred to the bar for disciplinary action for providing fraudulent information in court in connection with a 2021 presidential election related lawsuit? Not a good look for someone who claims to have been cheated.
- SavantIdiot 5y ago
  Hak5 makes some great stuff, but yeah: how hard would it be to swap the vote counters USB sticks with Hak5 BashBunnies loaded with exfiltration software if their protocols suck to begin with? I really hope there are root of trust procedures.
- mhh__ 5y ago
  The only true defense is a paper and pencil (why pencil: Disappearing ink).
mmastrac 5y ago
Can you write custom code for this thing? I actually have some non-nefarious use cases...
- fredley 5y ago
  They sell a programmer for it, so probably!
  - mmastrac 5y ago
    Interesting. I'm not sure if that is for pre-programmed payloads or not
    - fredley 5y ago
      As was posted in a separate thread, you might look at http://tomu.im/ http://tomu.im/ too
      - mmastrac 5y ago
        Those are pretty cool. One of the big use-cases for me is small-form-factor USB-passthru sniffing, however. I don't think any of the Tomu devices have that but would definitely be an option if so.
- VenTatsu 5y ago
  The product pages mention custom payloads, in some of the images it looks like some variant of the DuckyScript used in some of the other hak5 products. It likely depends on if what you want to do is supported or if it would need changes to the firmware to accomplish.
progman32 5y ago
As an aside: somewhat ironic that a shop selling gear such as this has such a large 3rd-party javascript footprint. At least some of that js is required for the page to work, as I'm unable to see pictures of the device. I counted 25 3rd party domains in uMatrix. That's quite the attack surface.
- Natsu 5y ago
  You can get pictures if you enable scripts for a couple of shopify domains, but it just looks like an ordinary USB cable, which is kind of the point.
- deleted 5y ago
  [deleted]
- moron4hire 5y ago
  How is that ironic? Seems more in-character. Selling a device to steal data, they also extract data from whomever is visiting the site.
- foxfluff 5y ago
  It threw a modal at me after enabling scripts and scrolling a bit. Yeah, not reading further.
  - MaxikCZ 5y ago
    Oh why thank you. Yes, I just landed on your page for the first time, looking around to see what you got there. What? If only I give you my email adress you will send me info about your page on a weekly basis as if I were the most interested person? And I have no guarantee you wont share my adress further? That sounds like an amazing deal! Let me sign up right now, before I even can read a paragraph on your page, I feel like I will definetly not regret it. -- Seriously, how do these modals still have high enough conversion rate to justify their existence?
- hoppla 5y ago
  I bought something from them once, and they shared my email address with Facebook to do targeted advertising - that was not something I expected they would do.
auslegung 5y ago
I want to need one of these things. Pranks on my friends are difficult with a lockdown and permanent wfh status, so I’d need a better reason. Can anyone think of non evil uses? My imagination is stunted I guess.
- Arrath 5y ago
  Mine is too, I can only come up with prank ideas. I do wonder how thoroughly they vet their customers, and what silly things I could get up to with one.
- rkagerer 5y ago
  Couple legitimate uses could be to test a driver or "port mirror" for debugging. (It does more than just keylog... eg. logs raw HID reports)
- yreg 5y ago
  I'd be afraid to prank someone with a tool like this. It seems like it would be easy to unintentionally hack said friend or at least make them believe that you might have hacked them.
lrvick 5y ago
See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-type-c-backorder/ https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listening-Surveillance/dp/B077WBM93S/ref=mp_s_a_1_11?crid=21J4EPAOUWOLZ https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 https://www.ebay.com/itm/223990414124 I have been making, collecting, and testing toys like this for more than a decade. It is a race to the bottom on price now. Your best defense for USB code execution attacks is use Linux with USBGuard or QubesOS with the default USB quarantine VM. Windows and Mac users are currently easy targets. I don't know of any good defenses there.
- hughrr 5y ago
  When USB came out I was working in the defence sector. We closed the vector off with cages for the PCs with tied looms under desks, epoxy in all the holes we didn’t want people to use and with threat of being in deep shit.
  - lrvick 5y ago
    When I was frequently using things like this on coworkers in red teaming (back when being in an office was a thing) putting my own desktop in a steel cage with a good lock proved effective against retaliation. Then we moved on to attacking the firmware in each others keyboards.
    - hughrr 5y ago
      We just broke the locks on the cages with a screwdriver. Locks only keep honest people honest.
      - xenadu02 5y ago
        Most common locks can be easily picked with a tiny bit of practice. I'm completely incompetent but I can pick any Master lock in 5 minutes or less.
rkagerer 5y ago
This makes me miss older, simpler protocols. Sure, a parallel cable could also be compromised to snoop but at least it couldn't pretend to be some other device or install rootkits.
- kortex 5y ago
  Challenge accepted. Any time you have physical access (especially HID), you have the potential for exploits. I couldn't find much for parallel port hax (in 5 min googling), but I'm sure it's been done. Probably too old to be documented on the shallow web. https://www.quora.com/Can-a-computer-be-hacked-through-a-PS-2-port-via-A-V-switch https://www.quora.com/Can-a-computer-be-hacked-through-a-PS-...
- SavantIdiot 5y ago
  That's because it isn't a cable, it is a computer. In the 1980's I worked with CAD/CAM software that required hardware dongles on parallel ports as an anti-piracy measure. That probably could have been exploitable: e.g., instead of returning the security response, cram a ton of data and cause buffer overrun on their 80286 + DOS5 application and smash the stack. It would be fun to go back in time and see just how vulnerable that software was.
- folmar 5y ago
  Sure it can. In the golden days of parport we've used parallel port device autodetection based on Device ID. There was a lot of place in the plug to use for a microcontroller in the end of the parport times.
deleted 5y ago
[deleted]
andix 5y ago
Does it work like a normal USB Cable, so can you still charge your phone with it and connect it to the PC? Couldn't find this information. If yes, you can just switch someones cable in his bag and attack him with that. We need to be very careful in the future with our cables...
rntksi 5y ago
I remember about decades ago that keyloggers would be very scary and powerful because your only defense was your password, and you couldn't know someone was logging in at the same time as you if you were not aware of it. Nowadays, with 2FA and all the big companies doing extra security check up when they see something wrong with the login patterns ... I don't see the use of keyloggers anymore.
- lrvick 5y ago
  I can assure you keyloggers still work very well at most major companies. Maybe in a couple more decades they will have begun to use basic defenses already available.
- andix 5y ago
  Even if 2FA prevents you from logging in, you still get A LOT of information from a keylogger. You know the content of all the emails this user writes. You know the websites they visit. Based on the 2FA auth key they use, you may find out what kind of system it is. A great start for social engineering. The target user writes an email to someone and the day afterwards you can fake call them and pretend to be the recipient of the email (you have all the information). If you're lucky they wrote an email to management and now you can pass orders in this call.
lisper 5y ago
I'm not sure what is scarier, the existence of this cable, or the amount of Javascript that this site tries to run when you visit it. According to my NoScript plugin, it's loading Javascript from at least 17 different domains.
- kag0 5y ago
  Totally unrelated to this cable, but since you mention it... I've been trying to build web/single page applications using new ES modules and no build tool, so all dependencies are pulled from their creator/CDN rather than bundled locally. Would this set off flags for a no-script user?
  - judge2020 5y ago
    If they use pure noscript with scripts disabled globally, then yes, it’ll just be unable to load the one first-party script.
  - lisper 5y ago
    The more domains you load JS from, the more entities have control over what happens on that page, and the higher the risk that one of those entities is trying to do something nefarious. So yes, loading all the scripts from one place will set off fewer alarm bells, at least for me.
throwawayswede 5y ago
I wonder what happens if you fly with one of these.
- OJFord 5y ago
  I would expect nothing, because the security we put ourselves through is nowhere close to sophisticated enough to notice.
  - throwawayswede 5y ago
    I'm pretty sure this would look kind of weird under xrays. They probably see thousands of cables and it'd be pretty easy to spot the difference.
    - VenTatsu 5y ago
      Standard Apple cables already have a chip inside, and USB 3.1 cables are also supposed to have chips inside. I would also assume they are not paying enough attention to even notice, there is no regulation against them so there is no reason to even train to notice differences in USB cables. > They probably see thousands of cables and it'd be pretty easy to spot the difference. If anything seeing thousands of cables will make them less likely to notice anything, change blindness is a real problem in jobs like that.
    - Arrath 5y ago
      They see thousands of cables and probably don't give any a second glance for the bare few seconds they gaze at each bag, an extra IC or two in the connector or not. The sheer volume of bags that get run through those x-ray machines in a shift, and the time given to look at each one precludes too much fine grained inspection, especially for something as minor as cables. Airport security is pretty dismal at detecting actual weapons or contraband, why should they be any better at noticing a slightly different cable?
    - OJFord 5y ago
      Yes, perhaps. And so the day (after) someone brings down a plane with a non-standard cable, they'll start looking for cables that 'look kind of weird'.
notorandit 5y ago
Oh My God!
post_break 5y ago
Been a follower of Hak5 since way back in the day. Even crashed at the hak house with Darren a long time ago. Cool to see them here since they actually hack stuff haha.
- nebula8804 5y ago
  Was very fortunate to meet Darren, Shannon, and Patrick Norton at Defcon in 2019. It was surreal to see them and even though I probably acted all nervous around them (still kinda had a crush on Shannon even after all these years) they were beyond nice and friendly. They were super busy selling their kits (these OMG cables were being sold unofficially as well lol) but they took the time to chat about the history of Hak5(TechTV in the case of Patrick) and to take pics. All around a superb bunch of folks. Its crazy to think they have been doing Hak5 for like what 15-16 years now?! So many great memories all thanks to their hard work.
  - SavantIdiot 5y ago
    I've been going to DefCon for many years and the hak5 merch booth is the first stop for all newcomers (myself included). Long lines and people handing over fists-full of cash.
    - nebula8804 5y ago
      I did my part and purchased something. :P Seems like they get a big chunk of their yearly revenue from Defcon sales. Makes sense as I bet a lot of hackers might just want to do an in person transaction and this is the perfect opportunity to do so.
      - SavantIdiot 5y ago
        Totally! Cash only, no CC trail or delivery address. I lived in Charlotte NC for a brief period and I bought some lock picks from a "spy outlet" store in a mall. They scanned my driver's license and said they needed to keep it on file for a year. This was ... 1992 maybe? Yikes today.
deleted 5y ago
[deleted]
lmilcin 5y ago
The trick is, you can't buy this particular one because you just don't know what it does exactly. I have tried to make a cable like that in the past be the best I got was to hide the electronics in what looked like a bead. Unfortunately, this only really works with USB-B devices where users are already used to having beads on the cable which for practical purposes limits attacks to printers and older scanners.
jmartrican 5y ago
We can't even trust our own cables. How do we combat this type of attack vector?
- fredley 5y ago
  Buy your own cables, and as you unwrap them, secure a tamper seal around them in some way. Commit the tamper seal codes to memory. Only then can you be absolutely sure.
pdimitar 5y ago
Can somebody recommend good charging cables with the data lanes disabled? Would put my mind at ease when I'm traveling.
- etskinner 5y ago
  You could do that, but then you'd need to forgo USB Power Delivery, Qualcomm quick charging, etc. One thing I've heard other comments mention here is a USB condom (USB data blocker). It's just a male to female adapter with only the power lines patched through, not data lines.
  - sva_ 5y ago
    If you have a powerbank with you (which may be empty), you could also charge the powerbank using the untrusted power source, and at the same time charge the phone via powerbank to "sanitize" the source. This way you could still benefit from quickcharging.
    - dolmen 5y ago
      Do you have references for powerbanks that support QuickCharge?
      - pdimitar 5y ago
        Most of them do nowadays. I used both Anker and Xiaomi and both were excellent.
    - pdimitar 5y ago
      Yep, this is what I usually end up doing while traveling. The battery doesn't care about the data lane even if the charger is somehow malicious, and my devices get pure juice.
  - rsync 5y ago
    I can vouch for usb condoms. Not only do they allow safe use of Arbitrary power ports but they also allow me to charge my phone from my laptop without syncing for updating things…
strife25 5y ago
hak5!!! Such a classic tech podcast. So cool to see them still around.
umvi 5y ago
I don't get what these can be used for. Is the idea to swap it out with your victim's iPhone charging cable and use it to exfiltrate photos and stuff from the iPhone?
sudobash1 5y ago
This is one reason I prefer good old 3.5mm audio jacks in my phone. I have no fear of putting any headphones or adapter in that port.
- knodi123 5y ago
  That's the port that Square uses for transmitting data. ;-) https://stackoverflow.com/questions/2181476/bandwidth-from-headphone-microphone-jack https://stackoverflow.com/questions/2181476/bandwidth-from-h...
- rmdashrfstar 5y ago
  Ignorance is bliss
- clb92 5y ago
  Wait until you learn that some phones have serial access through the headphone jack.[1][2] I don't know much about it yet, but I assume it can be exploited in some way, under some circumstances. [1] DOWN THE RABBIT HOLE AND BACK OUT AGAIN: SERIAL OVER HEADPHONE JACK https://hackaday.com/2016/10/21/down-the-rabbit-hole-and-back-out-again-serial-over-headphone-jack/ https://hackaday.com/2016/10/21/down-the-rabbit-hole-and-bac... [2] A better audio jack console cable for Google Nexus devices http://www.pabr.org/consolejack/consolejack.en.html http://www.pabr.org/consolejack/consolejack.en.html
huhtenberg 5y ago
HOLY mother of external linking! This page pulls stuff off 44 domains!
annoyingnoob 5y ago
That is just evil.
at-fates-hands 5y ago
I would advise a trip to MG's own site that has a lot more technical information on the cable: https://mg.lol/blog/ https://mg.lol/blog/ Its kind of cool to see someone I've been following for years and seeing the whole dev cycle of this product. His exploding USB drive was pretty cool and came before this idea: https://mg.lol/blog/mr-self-destruct/ https://mg.lol/blog/mr-self-destruct/
tr33house 5y ago
Just visiting this created a Cart on my chrome new tab page for Hak 5. Must be a new feature on Google Chrome. Just FYI
_RPL5_ 5y ago
Who buys this stuff? Other things in the shop: > Screen Crab: This covert inline screen grabber sits between HDMI devices - like a computer and monitor, or console and television - to quietly capture screenshots. Perfect for sysadmins, pentesters and anyone wanting to record what's on a screen. > Shark Jack: This portable network attack tool is a pentesters best friend optimized for social engineering engagements and opportunistic wired network auditing. Out-of-the-box it's armed with an ultra fast nmap payload, providing quick and easy network reconnaissance. > Key Croc: The Key Croc by Hak5 is a keylogger armed with pentest tools, remote access and payloads that trigger multi-vector attacks when chosen keywords are typed. It's the ultimate key-logging pentest implant. They say "pentesters." What prevents a malicious actor from buying and using these tools? I think I am missing something here.
- rout39574 5y ago
  I think you are missing nothing.
- SavantIdiot 5y ago
  I have a number of hak5 products to see what they fuss is about and to learn what kinds of attacks to worry about being used on me! In some cases they are not really usable anymore, like the WiFiPineapple, which is largely useless due to WPA2 being ubiquitous (yes, you can hack WPA2 but I don't feel like paying for a ton of AWS lamda functions to get on my neighbors wifi). They teach you about how things work from an entirely different point of view. BashBunny is my favorite and it still works, but who plugs in random USB sticks these days? I've never used it but I learned a lot more about USB!
  - deleted 5y ago
    [deleted]
- sophacles 5y ago
  The same people that buy lockpicks buy these: * enthusiasts * professional security people (blue team, pentesters) * criminals in the last 2 cases, they buy them because it's cheaper than making it themself.
haswell 5y ago
When Apple inevitably removes all physical ports from some future iteration of iPhone, I wonder if they’ll use the existence of tech like this to market the change as a benefit to security. I’m simultaneously impressed, curious and disturbed.
- system2 5y ago
  I still don't understand why they even have usb connection on Iphone. I have not attached a cable to it for years. Wireless charging, bluetooth headset, and all other bluetooth devices. Icloud backup as well as government spyware called CSAM never needed a cable.
  - tcoff91 5y ago
    I use the USB connection every day to do iOS development. A high bandwidth reliable wired link is a very nice thing to have for dev.
    - system2 5y ago
      They can sell developer phones if needed. The percentage of developers probably is not even 0.001%
  - Minenash 5y ago
    I still use the 3.5mm headphone jack over Bluetooth, because of the price of Bluetooth headphones, and also not having to ever worry about battery life. The only downside for me is that I can't use the headphones, and charge and walk around, but that's a lot less annoying then the other things. And with Bluetooth, there tends to be brief pauses (<1sec) where I can't hear anything. I also use my phone as my computers webcam. It's way better wired than the wifi for me (which honestly shouldn't be true, but). I almost never use wireless charging, because it takes longer to charge, is everyday inefficient, and most people don't own wireless chargers. And even if they do, it's never in as many places as normal chargers. On an old phone, I ruined the port and had to only use wireless charging, and it was so annoying. And app development is so much nicer when you have a USB connection. When I lost the ability to do so, coding was a good amount more work
soheil 5y ago
> "self destruct" features that involve wiping the onboard flash memory Had an entirely different image in mind.
soheil 5y ago
One thing cables are good at is being long enough to act as great antenna. It makes sense the wifi range is 2KM.
soheil 5y ago
Other than state against state actors what are legitimate use cases for this type of spying?
soheil 5y ago
I'd be more than a little nervous ordering one of these cables from a company that its sole job is creating spyware. If they're okay with spying on their customers' customers why wouldn't they spy on just their customers too?
nicewarmvalley 5y ago
But will it charge my phone?
EastSmith 5y ago
Not sure why the data industrial complex is net yet giving cables for free around malls, schools, etc.
CultMember002 5y ago
We should not allow the Fed to stifle innovation and technological progress. If we are not willing to take risks, then we will never be able to reach out true potential of becoming a truly advanced space faring civilization and a multi-planetary species. The NHTSA does not have the technological capability to understand advanced AI used in Autopilot and Full Self Driving and they should stop their interference immediately. I have a Tesla and I bought the Full Self Driving package. I believe it is far more valuable than the current price. I am willing to pay 30 times more for Full Self Driving.
zbentley 5y ago
Yet another reaffirmation that physical access is game over. "But the case is locked!" Are the peripherals? Even if the case connectors are locked away behind a bird-box/knockout, if someone left one of these dangling unplugged off of the keyboard, do you think your field technician won't unlock the box and plug it right back in?
xwdv 5y ago
I fantasize all the time about buying stuff like this and using it for nefarious purposes. Unfortunately the only real legit use for it is boring security work. The best way to use this while avoiding big legal trouble would be to stalk a single target that would never have any idea they are being stalked and doesn’t have much resources to come after you legally. Maybe an ex-girlfriend or something.
- saltyfamiliar 5y ago
  Would they really need many resources to take legal action? What you're describing is illegal. They could simply call the police if they found you out.
  - xwdv 5y ago
    Gotta prove it.
geniium 5y ago
This is crazy! Everyone can be James Bond today
icedistilled 5y ago
After looking at that product page and seeing how something that looks innocuous can be so insidious, does anyone else wonder just a bit whether the page is not so innocent and visiting it may have been a mistake.
- prox 5y ago
  That would be shooting yourself in the foot really. Hackers hacking hackers?
- coding123 5y ago
  Yes I had that thought too. However I was glad to learn of it's existence so at least I know what is scarily possible.
- blondin 5y ago
  yep. chrome is now showing me a new "you added this to your cart" feature on my new tab page. it says i have added that product to my "cart". that page is obviously doing something but i can't say anything evil.
- 8fingerlouie 5y ago
  Hak5 is legitimate. They sell all kinds of pentesting equipment, and most of it is good. It's mostly just small ARM linux "boxes" with some Bash scripts on top, though things like the WiFi Pineapple will (attempt) to break wifi passwords for you (https://shop.hak5.org/collections/sale/products/wifi-pineapple https://shop.hak5.org/collections/sale/products/wifi-pineapp...) For lack of a better use (just a hobby for me), i use a Screen Crap (https://shop.hak5.org/collections/sale/products/screen-crab https://shop.hak5.org/collections/sale/products/screen-crab) along with a Key Croc (https://shop.hak5.org/collections/sale/products/key-croc https://shop.hak5.org/collections/sale/products/key-croc) for a poor mans KVM to my headless server :) I don't know about the omg.lol page :)
adam0c 5y ago
that opening line of needing a million dollar budget LOL if anyone follows @_MG_ you'll know that this has been a very long project thats really not been that expensive the dude dropped a load around defcon then hak5 came in and said hey we can charge and arm and a leg for these...
- puzzlingcaptcha 5y ago
  The quoted price refers to https://en.m.wikipedia.org/wiki/File:NSA_COTTONMOUTH-I.jpg https://en.m.wikipedia.org/wiki/File:NSA_COTTONMOUTH-I.jpg (although admittedly for 50 units. Bargain!)
Ansil849 5y ago
The product description does a really poor job of explaining what this is to someone who has never heard of it. It's just a wink-wink-nudge-nudge reference to some DEFCON talk. Can someone explain what this is? Is it a hardware keylogger?
- distortedsignal 5y ago
  It can also do keystroke injection.
londons_explore 5y ago
These are normally made with something like an esp32 squeezed into the plug. To exfiltrate data by WiFi, there is a neat way to get data out... Just have the esp32 connect to all unencrypted WiFi networks in turn and send the data out via a DNS tunnel. Then the attacker can provide their own WiFi network, but it will also work with airplane WiFi, cafe WiFi, guest networks, etc. And obviously with DNS tunnelling it works against WiFi networks that require a 'sign in' after connection, even without signing in.
dehrmann 5y ago
I feel like there are some clever uses for this that aren't even security related.
peter_retief 5y ago
Scary that this is available to almost anyone now!
ElectricMind 5y ago
War is peace. Freedom is slavery. Ignorance is strength — George Orwell, 1984.
adolph 5y ago
Reminds me of the 2013 blog post of Panic in which they discover the lightening to hdmi “adapter” was in fact a small computer performing transcoding to HDMI. It was much larger and bulkier than 0.mg, but another example of a hidden computer in a place where one might expect just some simple wires. https://panic.com/blog/the-lightning-digital-av-adapter-surprise/ https://panic.com/blog/the-lightning-digital-av-adapter-surp...
anonu 5y ago
This is incredible. I remember in the early days of the web getting a copy of the Anarchist Cookbook. One idea was to glue the phosphorus material from a match stick to the spinning portion of a floppy disk. Of course that was a n00b level hack. We've come a long way since then...
TYFirst 5y ago
OMG!

1690 points by fredley 5y ago

You should use a data blocker when using an unknown USB cable to charge your phone. Occasionally described as a USB condom. Simply a Male to Female USB adaptor with the data wires not passed through.

shadilay 5y ago
Is that USB-PD compatible?
- gumby 5y ago
  I have not seen one that is. You can block data access and revert to USB 2-level power "negotiation" with a couple of passives and that is all I've seen anyone do. I did look into designing one a few years ago. The PD negotiation is quite complicated (and is done through the signaling lines, so you have to manipulate them yet block all other uses). That was early days for USB C -- there may be better chip support for doing that today.
- mschuster91 5y ago
  The "USB condoms" I know are USB2/3 only which means there isn't any form of PD negotiation anyway, and the oldschool Qualcomm Quickcharge and Apple's negotiation won't work either as these depend on D+/D-. A decent USB-C condom would also have to cut not just the USB2 D+/D- line, but also the USB3 SS and SBU lines... the really interesting thing is the CC wires, since without these you can't have reversible connectors, but not cutting them leaves an avenue for attackers (e.g. putting an USB-C port into JTAG mode). And on top of that USB-C PD 1 used the Vbus line with an overlaid HF signal. That means a decent USB-C condom will need: - a low-pass on the Vbus line to block PD1 - cut D+/D-, SS, SBU - cut CC1/CC2 and insert an as-dumb-as-possible controller chip to handle plug orientation
  - megous 5y ago
    You don't need orientation handling if you've cut all the other signals, so... Power negotiation is also not a big problem. Just use a correct resistor on the CC pin and you can make the phone use up to 5V/3A, which is plenty for any smartphone. You'd have to make sure to use a 5V/15W capable power source, though.
    - mschuster91 5y ago
      > You'd have to make sure to use a 5V/15W capable power source, though. ... which precisely is something I cannot make sure on a device where I'm tempted to use a USB condom, and it won't be useful at all for laptops.
      - shapefrog 5y ago
        I actually learnt a lot from these comments, so my thanks - USB-C is still just a mirrage on the horizion for me, so not something I have considered deeply.
      - megous 5y ago
        So use Sink.Default instead, and live with 5W, that all USB power sources support. Security is inconvenient.
  - PeterisP 5y ago
    What I hear from you is that a decent USB-C-condom needs to be a smart "MITM" device that has sufficient internal logic to proxy the power negotiation between devices at both ends.
deleted 5y ago
[deleted]

aabajian 5y ago

I live in Seattle and have had my car broken into three times. Each time, they steal my iPhone's USB cable. I wonder, could they add cellular connectivity to this cable and use it as a GPS locator?

lucideer 5y ago
Not sure about GPS but it includes remote access via WiFi, and some of the cables on offer quote "Long Range WiFi (2 KM+)"
- Y_Y 5y ago
  Why can't all my devices have 2km WiFi‽
  - VenTatsu 5y ago
    The cables have 2km WiFi with a directional antenna (presumably on the other end), you could probably get similar range out of most of your devices if your bases station had a directional antenna, but that eliminates much of the value for many WiFi applications.
  - megous 5y ago
    Because you'd share bandwidth with 100k other people in a city. You'd be glad for the days of dialup.
cbg0 5y ago
Are they really breaking into your car just to steal your USB cable or is there other stuff you leave in plain sight?
- shepherdjerred 5y ago
  Lightning cables are expensive, and Apple is definitely encouraging car theft by not including them in the box anymore. edit: this was a joke and it got appropriately downvoted. I regret nothing.

Eiriksmal 5y ago

Wow! Is the trick that we now have powerful microcomputers small enough to fit into a USB plug? That's pretty incredible technology. How many years ago did this become possible? My IT security training is dated, I am aware of the risks of plugging in a random USB key, but just a cable from a helpful "coworker"? Yikes.

fragmede 5y ago
That level of miniaturization is far older than Apple's removal of the iPhone headphone jack in 2016, but the related lightning-to-audio jack dongle had a microcontroller with a DAC inside that you'd never think existed due to the form factor.
- varikin 5y ago
  Just for reference, here are a couple breakdowns of how impressive the iPhone headphone jack is. It is impressive how good it is and how tiny it is. https://www.ifixit.com/News/8448/apple-audio-adapter-teardown https://www.ifixit.com/News/8448/apple-audio-adapter-teardow... https://www.kenrockwell.com/apple/lightning-adapter-audio-quality.htm https://www.kenrockwell.com/apple/lightning-adapter-audio-qu...
  - duped 5y ago
    It would be more impressive if they could fit it inside the phone.
    - 1-more 5y ago
      remember project aria? Apple actually did that and everyone got mad!
    - ChuckNorris89 5y ago
      Funny enough, that shouldn't be a challenge for Apple since the world's slimmest smartphone ever made actually has a headphone jack[1], so Apple excuse of not enough space inside the phone is horse shit to force everyone into the Airpods ecosystem. [1]https://youtu.be/Ijssm6Qv5nE https://youtu.be/Ijssm6Qv5nE

flixic 5y ago

Took me a moment to realise, but this is for keyboards, not iPhones. I don't think (?) anybody can access anything from an iPhone using an evil cable (using publicly-known attacks).

ttul 5y ago
I’m kind of surprised that Apple doesn’t encrypt keystrokes between its keyboards and the host machine, given than they have the capability to enable the keyboard to authenticate the host using PKI. Maybe this is on their todo list.
- girishso 5y ago
  So we can’t use third party keyboards with Apple devices? No thanks.
  - mikestew 5y ago
    That’s...not what parent typed. Use whatever keyboard you like, but you’ll only get E2EE with an Apple keyboard.
    - VenTatsu 5y ago
      The cable claims that it's a random 3rd party keyboard when it talks to the Mac, the cable claims it's a random non Apple device when it talks to the keyboard, the keyboard falls back to non-encrypted mode as it's not on a product that supports it. Man in the middle is hard to prevent when you need to be compatible with incredibly broken insecure legacy protocols. Apple could maybe go the route that all new Apple keyboards only work with new Macs and iOS devices, but that would mean that they can't work with any existing Apple hardware or third party systems.
      - amatecha 5y ago
        I guess the MITM attack could be mitigated in the OS by showing an "encrypted keyboard connection" UI indicator of sorts. Assuming the MITM hardware doesn't exploit a vulnerability in the OS to incorrectly show that indicator. ;)

reilly3000 5y ago

It was my firm belief that many of the angry mobs at vote counting offices around the 2020 elections were cover for planting these types of devices. That is very much out of the Roger Stone playbook. The lack of anomalies has shaken that belief… but I do hope that the existence of these types of devices is included in security training for future polling staff.

upearly4 5y ago
I vote (so to speak) for paper ballots and voter ID. Of course in that case, Roger Stone's guy would have won handily.
- vajrabum 5y ago
  Be nice if convicted felon Roger Stone or his guy had ever presented evidence of that in a court room. In federal court it's sanctionable for a lawyer to lie to the court. Did you notice that Sidney Powell, the former guy's attorney, was sanctioned and referred to the bar for disciplinary action for providing fraudulent information in court in connection with a 2021 presidential election related lawsuit? Not a good look for someone who claims to have been cheated.
SavantIdiot 5y ago
Hak5 makes some great stuff, but yeah: how hard would it be to swap the vote counters USB sticks with Hak5 BashBunnies loaded with exfiltration software if their protocols suck to begin with? I really hope there are root of trust procedures.
mhh__ 5y ago
The only true defense is a paper and pencil (why pencil: Disappearing ink).

mmastrac 5y ago

Can you write custom code for this thing? I actually have some non-nefarious use cases...

fredley 5y ago
They sell a programmer for it, so probably!
- mmastrac 5y ago
  Interesting. I'm not sure if that is for pre-programmed payloads or not
  - fredley 5y ago
    As was posted in a separate thread, you might look at http://tomu.im/ http://tomu.im/ too
    - mmastrac 5y ago
      Those are pretty cool. One of the big use-cases for me is small-form-factor USB-passthru sniffing, however. I don't think any of the Tomu devices have that but would definitely be an option if so.
VenTatsu 5y ago
The product pages mention custom payloads, in some of the images it looks like some variant of the DuckyScript used in some of the other hak5 products. It likely depends on if what you want to do is supported or if it would need changes to the firmware to accomplish.

progman32 5y ago

As an aside: somewhat ironic that a shop selling gear such as this has such a large 3rd-party javascript footprint. At least some of that js is required for the page to work, as I'm unable to see pictures of the device. I counted 25 3rd party domains in uMatrix. That's quite the attack surface.

Natsu 5y ago
You can get pictures if you enable scripts for a couple of shopify domains, but it just looks like an ordinary USB cable, which is kind of the point.
deleted 5y ago
[deleted]
moron4hire 5y ago
How is that ironic? Seems more in-character. Selling a device to steal data, they also extract data from whomever is visiting the site.
foxfluff 5y ago
It threw a modal at me after enabling scripts and scrolling a bit. Yeah, not reading further.
- MaxikCZ 5y ago
  Oh why thank you. Yes, I just landed on your page for the first time, looking around to see what you got there. What? If only I give you my email adress you will send me info about your page on a weekly basis as if I were the most interested person? And I have no guarantee you wont share my adress further? That sounds like an amazing deal! Let me sign up right now, before I even can read a paragraph on your page, I feel like I will definetly not regret it. -- Seriously, how do these modals still have high enough conversion rate to justify their existence?
hoppla 5y ago
I bought something from them once, and they shared my email address with Facebook to do targeted advertising - that was not something I expected they would do.

auslegung 5y ago

I want to need one of these things. Pranks on my friends are difficult with a lockdown and permanent wfh status, so I’d need a better reason. Can anyone think of non evil uses? My imagination is stunted I guess.

Arrath 5y ago
Mine is too, I can only come up with prank ideas. I do wonder how thoroughly they vet their customers, and what silly things I could get up to with one.
rkagerer 5y ago
Couple legitimate uses could be to test a driver or "port mirror" for debugging. (It does more than just keylog... eg. logs raw HID reports)
yreg 5y ago
I'd be afraid to prank someone with a tool like this. It seems like it would be easy to unintentionally hack said friend or at least make them believe that you might have hacked them.

lrvick 5y ago

See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-type-c-backorder/ https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listening-Surveillance/dp/B077WBM93S/ref=mp_s_a_1_11?crid=21J4EPAOUWOLZ https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 https://www.ebay.com/itm/223990414124 I have been making, collecting, and testing toys like this for more than a decade. It is a race to the bottom on price now. Your best defense for USB code execution attacks is use Linux with USBGuard or QubesOS with the default USB quarantine VM. Windows and Mac users are currently easy targets. I don't know of any good defenses there.

hughrr 5y ago
When USB came out I was working in the defence sector. We closed the vector off with cages for the PCs with tied looms under desks, epoxy in all the holes we didn’t want people to use and with threat of being in deep shit.
- lrvick 5y ago
  When I was frequently using things like this on coworkers in red teaming (back when being in an office was a thing) putting my own desktop in a steel cage with a good lock proved effective against retaliation. Then we moved on to attacking the firmware in each others keyboards.
  - hughrr 5y ago
    We just broke the locks on the cages with a screwdriver. Locks only keep honest people honest.
    - xenadu02 5y ago
      Most common locks can be easily picked with a tiny bit of practice. I'm completely incompetent but I can pick any Master lock in 5 minutes or less.

rkagerer 5y ago

This makes me miss older, simpler protocols. Sure, a parallel cable could also be compromised to snoop but at least it couldn't pretend to be some other device or install rootkits.

kortex 5y ago
Challenge accepted. Any time you have physical access (especially HID), you have the potential for exploits. I couldn't find much for parallel port hax (in 5 min googling), but I'm sure it's been done. Probably too old to be documented on the shallow web. https://www.quora.com/Can-a-computer-be-hacked-through-a-PS-2-port-via-A-V-switch https://www.quora.com/Can-a-computer-be-hacked-through-a-PS-...
SavantIdiot 5y ago
That's because it isn't a cable, it is a computer. In the 1980's I worked with CAD/CAM software that required hardware dongles on parallel ports as an anti-piracy measure. That probably could have been exploitable: e.g., instead of returning the security response, cram a ton of data and cause buffer overrun on their 80286 + DOS5 application and smash the stack. It would be fun to go back in time and see just how vulnerable that software was.
folmar 5y ago
Sure it can. In the golden days of parport we've used parallel port device autodetection based on Device ID. There was a lot of place in the plug to use for a microcontroller in the end of the parport times.

deleted 5y ago

[deleted]

andix 5y ago

Does it work like a normal USB Cable, so can you still charge your phone with it and connect it to the PC? Couldn't find this information. If yes, you can just switch someones cable in his bag and attack him with that. We need to be very careful in the future with our cables...

rntksi 5y ago

I remember about decades ago that keyloggers would be very scary and powerful because your only defense was your password, and you couldn't know someone was logging in at the same time as you if you were not aware of it. Nowadays, with 2FA and all the big companies doing extra security check up when they see something wrong with the login patterns ... I don't see the use of keyloggers anymore.

lrvick 5y ago
I can assure you keyloggers still work very well at most major companies. Maybe in a couple more decades they will have begun to use basic defenses already available.
andix 5y ago
Even if 2FA prevents you from logging in, you still get A LOT of information from a keylogger. You know the content of all the emails this user writes. You know the websites they visit. Based on the 2FA auth key they use, you may find out what kind of system it is. A great start for social engineering. The target user writes an email to someone and the day afterwards you can fake call them and pretend to be the recipient of the email (you have all the information). If you're lucky they wrote an email to management and now you can pass orders in this call.

lisper 5y ago

I'm not sure what is scarier, the existence of this cable, or the amount of Javascript that this site tries to run when you visit it. According to my NoScript plugin, it's loading Javascript from at least 17 different domains.

kag0 5y ago
Totally unrelated to this cable, but since you mention it... I've been trying to build web/single page applications using new ES modules and no build tool, so all dependencies are pulled from their creator/CDN rather than bundled locally. Would this set off flags for a no-script user?
- judge2020 5y ago
  If they use pure noscript with scripts disabled globally, then yes, it’ll just be unable to load the one first-party script.
- lisper 5y ago
  The more domains you load JS from, the more entities have control over what happens on that page, and the higher the risk that one of those entities is trying to do something nefarious. So yes, loading all the scripts from one place will set off fewer alarm bells, at least for me.

throwawayswede 5y ago

I wonder what happens if you fly with one of these.

OJFord 5y ago
I would expect nothing, because the security we put ourselves through is nowhere close to sophisticated enough to notice.
- throwawayswede 5y ago
  I'm pretty sure this would look kind of weird under xrays. They probably see thousands of cables and it'd be pretty easy to spot the difference.
  - VenTatsu 5y ago
    Standard Apple cables already have a chip inside, and USB 3.1 cables are also supposed to have chips inside. I would also assume they are not paying enough attention to even notice, there is no regulation against them so there is no reason to even train to notice differences in USB cables. > They probably see thousands of cables and it'd be pretty easy to spot the difference. If anything seeing thousands of cables will make them less likely to notice anything, change blindness is a real problem in jobs like that.
  - Arrath 5y ago
    They see thousands of cables and probably don't give any a second glance for the bare few seconds they gaze at each bag, an extra IC or two in the connector or not. The sheer volume of bags that get run through those x-ray machines in a shift, and the time given to look at each one precludes too much fine grained inspection, especially for something as minor as cables. Airport security is pretty dismal at detecting actual weapons or contraband, why should they be any better at noticing a slightly different cable?
  - OJFord 5y ago
    Yes, perhaps. And so the day (after) someone brings down a plane with a non-standard cable, they'll start looking for cables that 'look kind of weird'.

notorandit 5y ago

Oh My God!

post_break 5y ago

Been a follower of Hak5 since way back in the day. Even crashed at the hak house with Darren a long time ago. Cool to see them here since they actually hack stuff haha.

nebula8804 5y ago
Was very fortunate to meet Darren, Shannon, and Patrick Norton at Defcon in 2019. It was surreal to see them and even though I probably acted all nervous around them (still kinda had a crush on Shannon even after all these years) they were beyond nice and friendly. They were super busy selling their kits (these OMG cables were being sold unofficially as well lol) but they took the time to chat about the history of Hak5(TechTV in the case of Patrick) and to take pics. All around a superb bunch of folks. Its crazy to think they have been doing Hak5 for like what 15-16 years now?! So many great memories all thanks to their hard work.
- SavantIdiot 5y ago
  I've been going to DefCon for many years and the hak5 merch booth is the first stop for all newcomers (myself included). Long lines and people handing over fists-full of cash.
  - nebula8804 5y ago
    I did my part and purchased something. :P Seems like they get a big chunk of their yearly revenue from Defcon sales. Makes sense as I bet a lot of hackers might just want to do an in person transaction and this is the perfect opportunity to do so.
    - SavantIdiot 5y ago
      Totally! Cash only, no CC trail or delivery address. I lived in Charlotte NC for a brief period and I bought some lock picks from a "spy outlet" store in a mall. They scanned my driver's license and said they needed to keep it on file for a year. This was ... 1992 maybe? Yikes today.

deleted 5y ago

[deleted]

lmilcin 5y ago

The trick is, you can't buy this particular one because you just don't know what it does exactly. I have tried to make a cable like that in the past be the best I got was to hide the electronics in what looked like a bead. Unfortunately, this only really works with USB-B devices where users are already used to having beads on the cable which for practical purposes limits attacks to printers and older scanners.

jmartrican 5y ago

We can't even trust our own cables. How do we combat this type of attack vector?

fredley 5y ago
Buy your own cables, and as you unwrap them, secure a tamper seal around them in some way. Commit the tamper seal codes to memory. Only then can you be absolutely sure.

pdimitar 5y ago

Can somebody recommend good charging cables with the data lanes disabled? Would put my mind at ease when I'm traveling.

etskinner 5y ago
You could do that, but then you'd need to forgo USB Power Delivery, Qualcomm quick charging, etc. One thing I've heard other comments mention here is a USB condom (USB data blocker). It's just a male to female adapter with only the power lines patched through, not data lines.
- sva_ 5y ago
  If you have a powerbank with you (which may be empty), you could also charge the powerbank using the untrusted power source, and at the same time charge the phone via powerbank to "sanitize" the source. This way you could still benefit from quickcharging.
  - dolmen 5y ago
    Do you have references for powerbanks that support QuickCharge?
    - pdimitar 5y ago
      Most of them do nowadays. I used both Anker and Xiaomi and both were excellent.
  - pdimitar 5y ago
    Yep, this is what I usually end up doing while traveling. The battery doesn't care about the data lane even if the charger is somehow malicious, and my devices get pure juice.
- rsync 5y ago
  I can vouch for usb condoms. Not only do they allow safe use of Arbitrary power ports but they also allow me to charge my phone from my laptop without syncing for updating things…

strife25 5y ago

hak5!!! Such a classic tech podcast. So cool to see them still around.

umvi 5y ago

I don't get what these can be used for. Is the idea to swap it out with your victim's iPhone charging cable and use it to exfiltrate photos and stuff from the iPhone?

sudobash1 5y ago

This is one reason I prefer good old 3.5mm audio jacks in my phone. I have no fear of putting any headphones or adapter in that port.

knodi123 5y ago
That's the port that Square uses for transmitting data. ;-) https://stackoverflow.com/questions/2181476/bandwidth-from-headphone-microphone-jack https://stackoverflow.com/questions/2181476/bandwidth-from-h...
rmdashrfstar 5y ago
Ignorance is bliss
clb92 5y ago
Wait until you learn that some phones have serial access through the headphone jack.[1][2] I don't know much about it yet, but I assume it can be exploited in some way, under some circumstances. [1] DOWN THE RABBIT HOLE AND BACK OUT AGAIN: SERIAL OVER HEADPHONE JACK https://hackaday.com/2016/10/21/down-the-rabbit-hole-and-back-out-again-serial-over-headphone-jack/ https://hackaday.com/2016/10/21/down-the-rabbit-hole-and-bac... [2] A better audio jack console cable for Google Nexus devices http://www.pabr.org/consolejack/consolejack.en.html http://www.pabr.org/consolejack/consolejack.en.html

huhtenberg 5y ago

HOLY mother of external linking! This page pulls stuff off 44 domains!

annoyingnoob 5y ago

That is just evil.

at-fates-hands 5y ago

I would advise a trip to MG's own site that has a lot more technical information on the cable: https://mg.lol/blog/ https://mg.lol/blog/ Its kind of cool to see someone I've been following for years and seeing the whole dev cycle of this product. His exploding USB drive was pretty cool and came before this idea: https://mg.lol/blog/mr-self-destruct/ https://mg.lol/blog/mr-self-destruct/

tr33house 5y ago

Just visiting this created a Cart on my chrome new tab page for Hak 5. Must be a new feature on Google Chrome. Just FYI

_RPL5_ 5y ago

Who buys this stuff? Other things in the shop: > Screen Crab: This covert inline screen grabber sits between HDMI devices - like a computer and monitor, or console and television - to quietly capture screenshots. Perfect for sysadmins, pentesters and anyone wanting to record what's on a screen. > Shark Jack: This portable network attack tool is a pentesters best friend optimized for social engineering engagements and opportunistic wired network auditing. Out-of-the-box it's armed with an ultra fast nmap payload, providing quick and easy network reconnaissance. > Key Croc: The Key Croc by Hak5 is a keylogger armed with pentest tools, remote access and payloads that trigger multi-vector attacks when chosen keywords are typed. It's the ultimate key-logging pentest implant. They say "pentesters." What prevents a malicious actor from buying and using these tools? I think I am missing something here.

rout39574 5y ago
I think you are missing nothing.
SavantIdiot 5y ago
I have a number of hak5 products to see what they fuss is about and to learn what kinds of attacks to worry about being used on me! In some cases they are not really usable anymore, like the WiFiPineapple, which is largely useless due to WPA2 being ubiquitous (yes, you can hack WPA2 but I don't feel like paying for a ton of AWS lamda functions to get on my neighbors wifi). They teach you about how things work from an entirely different point of view. BashBunny is my favorite and it still works, but who plugs in random USB sticks these days? I've never used it but I learned a lot more about USB!
- deleted 5y ago
  [deleted]
sophacles 5y ago
The same people that buy lockpicks buy these: * enthusiasts * professional security people (blue team, pentesters) * criminals in the last 2 cases, they buy them because it's cheaper than making it themself.

haswell 5y ago

When Apple inevitably removes all physical ports from some future iteration of iPhone, I wonder if they’ll use the existence of tech like this to market the change as a benefit to security. I’m simultaneously impressed, curious and disturbed.

system2 5y ago
I still don't understand why they even have usb connection on Iphone. I have not attached a cable to it for years. Wireless charging, bluetooth headset, and all other bluetooth devices. Icloud backup as well as government spyware called CSAM never needed a cable.
- tcoff91 5y ago
  I use the USB connection every day to do iOS development. A high bandwidth reliable wired link is a very nice thing to have for dev.
  - system2 5y ago
    They can sell developer phones if needed. The percentage of developers probably is not even 0.001%
- Minenash 5y ago
  I still use the 3.5mm headphone jack over Bluetooth, because of the price of Bluetooth headphones, and also not having to ever worry about battery life. The only downside for me is that I can't use the headphones, and charge and walk around, but that's a lot less annoying then the other things. And with Bluetooth, there tends to be brief pauses (<1sec) where I can't hear anything. I also use my phone as my computers webcam. It's way better wired than the wifi for me (which honestly shouldn't be true, but). I almost never use wireless charging, because it takes longer to charge, is everyday inefficient, and most people don't own wireless chargers. And even if they do, it's never in as many places as normal chargers. On an old phone, I ruined the port and had to only use wireless charging, and it was so annoying. And app development is so much nicer when you have a USB connection. When I lost the ability to do so, coding was a good amount more work

soheil 5y ago

> "self destruct" features that involve wiping the onboard flash memory Had an entirely different image in mind.

soheil 5y ago

One thing cables are good at is being long enough to act as great antenna. It makes sense the wifi range is 2KM.

soheil 5y ago

Other than state against state actors what are legitimate use cases for this type of spying?

soheil 5y ago

I'd be more than a little nervous ordering one of these cables from a company that its sole job is creating spyware. If they're okay with spying on their customers' customers why wouldn't they spy on just their customers too?

nicewarmvalley 5y ago

But will it charge my phone?

EastSmith 5y ago

Not sure why the data industrial complex is net yet giving cables for free around malls, schools, etc.

CultMember002 5y ago

We should not allow the Fed to stifle innovation and technological progress. If we are not willing to take risks, then we will never be able to reach out true potential of becoming a truly advanced space faring civilization and a multi-planetary species. The NHTSA does not have the technological capability to understand advanced AI used in Autopilot and Full Self Driving and they should stop their interference immediately. I have a Tesla and I bought the Full Self Driving package. I believe it is far more valuable than the current price. I am willing to pay 30 times more for Full Self Driving.

zbentley 5y ago

Yet another reaffirmation that physical access is game over. "But the case is locked!" Are the peripherals? Even if the case connectors are locked away behind a bird-box/knockout, if someone left one of these dangling unplugged off of the keyboard, do you think your field technician won't unlock the box and plug it right back in?

xwdv 5y ago

I fantasize all the time about buying stuff like this and using it for nefarious purposes. Unfortunately the only real legit use for it is boring security work. The best way to use this while avoiding big legal trouble would be to stalk a single target that would never have any idea they are being stalked and doesn’t have much resources to come after you legally. Maybe an ex-girlfriend or something.

saltyfamiliar 5y ago
Would they really need many resources to take legal action? What you're describing is illegal. They could simply call the police if they found you out.
- xwdv 5y ago
  Gotta prove it.

geniium 5y ago

This is crazy! Everyone can be James Bond today

icedistilled 5y ago

After looking at that product page and seeing how something that looks innocuous can be so insidious, does anyone else wonder just a bit whether the page is not so innocent and visiting it may have been a mistake.

prox 5y ago
That would be shooting yourself in the foot really. Hackers hacking hackers?
coding123 5y ago
Yes I had that thought too. However I was glad to learn of it's existence so at least I know what is scarily possible.
blondin 5y ago
yep. chrome is now showing me a new "you added this to your cart" feature on my new tab page. it says i have added that product to my "cart". that page is obviously doing something but i can't say anything evil.
8fingerlouie 5y ago
Hak5 is legitimate. They sell all kinds of pentesting equipment, and most of it is good. It's mostly just small ARM linux "boxes" with some Bash scripts on top, though things like the WiFi Pineapple will (attempt) to break wifi passwords for you (https://shop.hak5.org/collections/sale/products/wifi-pineapple https://shop.hak5.org/collections/sale/products/wifi-pineapp...) For lack of a better use (just a hobby for me), i use a Screen Crap (https://shop.hak5.org/collections/sale/products/screen-crab https://shop.hak5.org/collections/sale/products/screen-crab) along with a Key Croc (https://shop.hak5.org/collections/sale/products/key-croc https://shop.hak5.org/collections/sale/products/key-croc) for a poor mans KVM to my headless server :) I don't know about the omg.lol page :)

adam0c 5y ago

that opening line of needing a million dollar budget LOL if anyone follows @_MG_ you'll know that this has been a very long project thats really not been that expensive the dude dropped a load around defcon then hak5 came in and said hey we can charge and arm and a leg for these...

puzzlingcaptcha 5y ago
The quoted price refers to https://en.m.wikipedia.org/wiki/File:NSA_COTTONMOUTH-I.jpg https://en.m.wikipedia.org/wiki/File:NSA_COTTONMOUTH-I.jpg (although admittedly for 50 units. Bargain!)

Ansil849 5y ago

The product description does a really poor job of explaining what this is to someone who has never heard of it. It's just a wink-wink-nudge-nudge reference to some DEFCON talk. Can someone explain what this is? Is it a hardware keylogger?

distortedsignal 5y ago
It can also do keystroke injection.

londons_explore 5y ago

These are normally made with something like an esp32 squeezed into the plug. To exfiltrate data by WiFi, there is a neat way to get data out... Just have the esp32 connect to all unencrypted WiFi networks in turn and send the data out via a DNS tunnel. Then the attacker can provide their own WiFi network, but it will also work with airplane WiFi, cafe WiFi, guest networks, etc. And obviously with DNS tunnelling it works against WiFi networks that require a 'sign in' after connection, even without signing in.

dehrmann 5y ago

I feel like there are some clever uses for this that aren't even security related.

peter_retief 5y ago

Scary that this is available to almost anyone now!

ElectricMind 5y ago

War is peace. Freedom is slavery. Ignorance is strength — George Orwell, 1984.

adolph 5y ago

Reminds me of the 2013 blog post of Panic in which they discover the lightening to hdmi “adapter” was in fact a small computer performing transcoding to HDMI. It was much larger and bulkier than 0.mg, but another example of a hidden computer in a place where one might expect just some simple wires. https://panic.com/blog/the-lightning-digital-av-adapter-surprise/ https://panic.com/blog/the-lightning-digital-av-adapter-surp...

anonu 5y ago

This is incredible. I remember in the early days of the web getting a copy of the Anarchist Cookbook. One idea was to glue the phosphorus material from a match stick to the spinning portion of a floppy disk. Of course that was a n00b level hack. We've come a long way since then...

TYFirst 5y ago

OMG!