14 ms·

See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-type-c-backorder/ htt

• hughrr 5y ago
  When USB came out I was working in the defence sector. We closed the vector off with cages for the PCs with tied looms under desks, epoxy in all the holes we didn’t want people to use and with threat of being in deep shit.
  • lrvick 5y ago
    When I was frequently using things like this on coworkers in red teaming (back when being in an office was a thing) putting my own desktop in a steel cage with a good lock proved effective against retaliation. Then we moved on to attacking the firmware in each others keyboards.
    • hughrr 5y ago
      We just broke the locks on the cages with a screwdriver. Locks only keep honest people honest.
      • xenadu02 5y ago
        Most common locks can be easily picked with a tiny bit of practice. I'm completely incompetent but I can pick any Master lock in 5 minutes or less.
        • lrvick 5y ago
          Which is why you should never use Master Locks. I am pretty decent at lockpicking but I can't pick a Medeco or better in any practical amount of time and very few in the world can. Little bit more money vastly reduces your attack surface.
          • Godel_unicode 5y ago
            > Little bit more money Aren't medeco padlocks like $100, whereas master lock padlocks are less than $20?
            • deleted 5y ago
              [deleted]
            • vdqtp3 5y ago
              What's the value of the asset it's protecting?
        • dekhn 5y ago
          I remember learning how to break master locks back in the 1980s. But I also heard they changed the mechanism after that.
          • danachow 5y ago
            I’m pretty sure they did on a number of models, but it wasn’t for the better
          • lrvick 5y ago
            I went to home depot a couple years ago and bought every model of master lock they sold. Picked all of them in an afternoon. I then taught kids to pick them.
    • ManBlanket 5y ago
      Being in an office is definitely still a thing. Let's be real, vaccinated adults working from home is a privilege. Mostly a white upper middle class one. Always was.
    • gruez 5y ago
      >putting my own desktop in a steel cage with a good lock proved effective against retaliation. >Then we moved on to attacking the firmware in each others keyboards. In what world is hacking keyboard firmware easier than lockpicking?
      • Forge36 5y ago
        Harder to spot visibly?
      • jimmySixDOF 5y ago
        and what's this site we are on's name again ?
      • michaelt 5y ago
        I once saw a PC security case where instead of the lock cylinder retracting a bolt, it turned a screw thread and opened the case by about half a millimeter. It took the guy unlocking it a good fifty turns to get the PC out of it. And there were two - one on each side. What's more, it was a tubular lock, so if you were single-pin picking you'd have to pick it 5 times per rotation. Nothing that would stand up to a battery powered angle grinder, of course.
        • lrvick 5y ago
          I don't know anyone that would SPP a tubular lock in the field. $40 for tools designed to pick all pins at once and make a "key" with some quick impressioning motions. Some do have spool pins. In those cases you will need manual fiddling to pick it once then you have a key to keep spinning. Still, sounds like an interesting design. Link?
          • michaelt 5y ago
            I was under the impression impressioning relied on all the lock's springs and driver pins being identical, and that better tubular locks avoided that? I looked for a picture of the case but couldn't find one. I was in that college CAD lab... quite a long time ago.
    • infogulch 5y ago
      Since this has generated some discussion on locks and picking, there's been some interesting developments on "unpickable locks" that sidestep the tolerance problem by decoupling setting the pins from testing them. I.e. pins are tested all at once after they are physically decoupled from the key & keyway, eliminating state space reduction attacks (aka picking one pin at a time) leaving only brute force. One such effort features locks made by Stuff Made Here sent to Lock Picking Lawyer. According to LPL the locks are theoretically sound and he did not attempt to pick them, but these particular implementations had a couple (easily fixable) bypasses. Made for interesting videos on both sides: Stuff Made Here describes the design in detail: TWO Unpickable (?) Locks for Lock Picking Lawyer! - https://www.youtube.com/watch?v=2A2NY29iQdI https://www.youtube.com/watch?v=2A2NY29iQdI Lock Picking Lawyer reviews them and performs some bypasses: [1299] Unpickable Locks From Stuff Made Here - https://www.youtube.com/watch?v=Ecy1FBdCRbQ https://www.youtube.com/watch?v=Ecy1FBdCRbQ
      • minism 5y ago
        Thanks for sharing, fascinating stuff.
      • infogulch 5y ago
        Whelp it seems I recalled incorrectly this time, because LPL did pick the second one open, via a weakness in the design that he believes can be patched. I don't think my sentiment was totally off base, but clearly my statement about not being picked was factually incorrect.
  • hinkley 5y ago
    My school had a way to keep peripherals from wandering off, but if all you need to do is swap the cables then I’m not sure that would still work. Wrapping the cables into a wiring loom makes that process slower, assuming the loom is complicated enough. Did you ever use heat shrink? Or locking cable ties? What the school did was run a steel cable behind the desks, then put a loop of the mouse chord through a steel washer and ran the security cable through all the loops. If you secure both ends you can’t get the cables separated even with slack. The trick is that the hole in the washer had to be smaller than the connector so you couldn’t fish it back through no matter how much slack you get. That could still work for USB-A, but these days the connectors are getting smaller than the diameter of curvature of the cable, so you’d break it trying to do this. And on many peripherals you could destroy the chord without reducing the value of the device. One could cut the cable and install this Trojan one on many devices these days, the only telltale would be that the cable isn’t routed properly, which might be harder to notice immediately.
    • hughrr 5y ago
      All the cables were terminated inside the box and strapped every 1 inch with cable ties. Nothing was exposed that could be disconnected other than the monitor IEC lead.
    • lrvick 5y ago
      On most keyboards and mice the cables are not soldered on the inside but just a quick connector. You can get a female/male versions of this connector placed on either side of an attiny85 for a quick solderless implant no one will ever see. Then just undo 2 screws, plug your implant inside the mouse/keyboard, screw it back. To make this harder intentionally strip the screws with a drill, understanding you will never be able to repair that unit again.
      • IIsi50MHz 5y ago
        Seems there are special drill bits for removing stripped screws…
        • 5y ago
  • max-ibel 5y ago
    That's hard if your laptop relies on USB-C for charging...
    • lrvick 5y ago
      I specifically don't recommend laptops that rely on USB C charging for applications where trust is critical -unless- they are running Linux with USBGuard or QubesOS. That said I did make transparent and easily auditable USB type C condoms for one client that really wanted to use USB type C laptops. Systems with security as a strong priority like the Librem 14 use barrel jacks for good reason. I am in fact implying those that allow use of macbooks at coffee shops to directly access production systems at FAANG and fintech companies are taking a very inappropriate risk :-P
      • pgeorgi 5y ago
        USB C charging happens well below the OS layer, using firmware that often isn't all that good. USBGuard or QubesOS won't help there (but will somewhat mitigate attacks trying to move up the stack)
        • lrvick 5y ago
          The problem is not the charging. The problem is that a fake charger cable can run an HID attack over the +/- pins before it does a pass through to the power negotiation MCU for charging. A tampered USB C to C cable on a conference room table can compromise people all day long. If the USB C charge ports cut the data pins entirely then great, but I have not seen that be the case on any laptops yet.
          • dolmen 5y ago
            Because few want USB-C ports dedicated to charging. The point of USB-C if flexibility. "One port to rule them all".
• e40 5y ago
  Windows and Mac users are currently easy targets. I don't know of any good defenses there. It's crazy to me that this is true. Does the government pay Microsoft and Apple to keep it this way, or are they just negligent?
  • Closi 5y ago
    It’s not really practical to defend against for most end users. Keeping a whitelist of known keyboards and mice is really the only defence even on Linux, and unless you work in a data centre that’s probably way overkill. With a home PC that doesn’t really work though, because in order to authenticate your mouse without some kind of central mouse log on a server you probably need to click a button, which you can’t do without authenticating your mouse.
    • lrvick 5y ago
      Whitelists don't work. As an attacker I just have the bootloaders of my malicious devices advertize the USB IDs of whitelisted devices like Apple Keyboards. The computer has no way of knowing it is not authentic. There is no signing or certification for USB devices. The only solution is a kernel that can place all newly attached USB devices in a queue for manual approval. This is what USBGuard and QubesOS both do. The Linux kernel and udev have native support to hook USB devices early making this easy. It means no one can drive by plug something in when your computer is locked. You will get a popup asking if you want to give some device other than the keyboard you booted with access to behave as a keyboard . Also the majority of attacks I have seen in the wild attacking production systems were via endpoint compromises. If your laptop has remote access to said high value datacenter, then your laptop is a high value target. Note though that laptops have a nice advantage for this threat model as most have built in PS/2 trackpad and mouse which can let you approve external keyboards/mice etc.
      • TeMPOraL 5y ago
        > It means no one can drive by plug something in when your computer is locked. You will get a popup asking if you want to give some device other than the keyboard you booted with access to behave as a keyboard . Makes me think, what would happen if I plugged this cable, unplugged the keyboard, and power-cycled the computer? Or do a hard power down, then the switcheroo, and then power up? Would USBGuard/QubesOS block the new device, even though it's the one it just booted with? (I think finding your computer rebooted would fly under the radar of most of the users - they'd blame it on automatic updates or intermittent power failure.) On that note, I wonder how small you could go with a MITM device to attach between victim's peripheral and their computer. Could you pack enough useful features in a dongle that would not be immediately noticeable by most users?
• tubbs 5y ago
  With growing car theft in the US I've been curious about implanting GPS trackers on my own older enthusiast vehicles. There appears to be many options on Amazon but I can't bring myself to trust any of them. Has anyone here gone down that road before?
  • CobaltFire 5y ago
    I second this, and hope someone has some advice/input.
  • chillaxtian 5y ago
    AirTag
    • spiderfarmer 5y ago
      Doesn’t work as it notifies the person traveling with it.
      • hultner 5y ago
        Of you hide it well enough? I can think of some creative spots in a car, like behind the dash, in the door, inside of the a seat, etc.
        • kube-system 5y ago
          If the thief has an iPhone, they will see this: https://sm.mashable.com/mashable_pk/image/default/uploads252fcard252fimage252f1619248252f4a25b7aa-439d-4334-9c_jz6u.jpg https://sm.mashable.com/mashable_pk/image/default/uploads252...
      • giarc 5y ago
        I thought it only chirped if the owner clicked that option in "Find My" app.
        • callesgg 5y ago
• lostmsu 5y ago
  Am I missing something? The worst thing the cable can do is send HID commands, and snoop on traffic between your USB-connectable device and PC?
  • hansjorg 5y ago
    See for example: https://en.m.wikipedia.org/wiki/DMA_attack https://en.m.wikipedia.org/wiki/DMA_attack
  • lrvick 5y ago
    They could do lots of things: - Keylogging - Manipulate USB Power negotiation to cook your hardware - Sniff traffic from other USB devices on the same internal hub. - Log your location - Log screen lock/unlock times/habits via voltage draw and permitted device type enumeration - Install malware via keyboard emulation - Sound exfiltration by emulating USB speakers - Screenshot by emulating a USB/thunderbolt external monitor - Mouse movement/click injection to prevent screen locking - Exfiltrate data to hidden internal flash memory
  • at-fates-hands 5y ago
    You can actually do quite a lot with it, in terms of getting data and dropping various payloads: There is also an editor and parser for Duckyscript – the scripting language used by the Rubber Ducky offensive USB drive – which acts as a virtual keyboard and launches keystroke injection attacks. That alone opens up a wide array of custom payloads for the O.MG cable. There also appear to be attack payloads for Windows and Ubuntu systems. In April 2019, when the video was released, MG and the team of hackers working on the embedded cable were also developing extra functions such as detecting user activity/inactivity. According to the Hak5 listing, they also appear to have cracked another key problem: USB enumeration. https://nakedsecurity.sophos.com/2019/10/02/omg-evil-lightning-cable-hits-prime-time/ https://nakedsecurity.sophos.com/2019/10/02/omg-evil-lightni...
  • blablabla123 5y ago
    USB has been littered with bugs. I never got why this didn't get more news coverage but at least it was possible to read memory from USB. Personally for me it's also a reason that I switched to USB-C that there are less people around with USB-C cables. https://security.stackexchange.com/questions/118854/attacks-via-physical-access-to-usb-dma https://security.stackexchange.com/questions/118854/attacks-...
• pa7ch 5y ago
  Curious if chromeOS does anything special here to mitigate usb attacks.
  • lrvick 5y ago
    They do nothing.
  • staticassertion 5y ago
    You need to explicitly mount (in your ChromeOS settings) any USB devices to the Linux system. Other than that I'm not aware of any specific mitigations.
    • grepfru_it 5y ago
      So if I plug in a usb keyboard or mouse, they do not work until I activate them in settings? Sounds like an easy way for grandma to buy Dell over Google
      • staticassertion 5y ago
        In the Linux environment specifically. The average user is not using the Linux environment, it has to be enabled in developer settings.
• Hacktek 5y ago
  $600, 3 meter range. wtf? How is OMG Cable able to be so much cheaper and get so much more range?
• SavantIdiot 5y ago
  Read the reviews on the GPS tracking charger... either the people who bought it couldn't figure out how to use it, or its another scam product from china we see flooding amazon.
  • lrvick 5y ago
    When we audited it as best we could tell it was phoning home to some central Chinese server if you put a sim in it. So spy tools that spy on the spys. It is sketchy as all hell and should not be sold. That said this stuff pops up everywhere. I just cite it as examples.
• traceroute66 5y ago
  > Windows and Mac users are currently easy targets. Not true, at least for iPhone / iPad users: - 1. Download Apple Configurator (free to anyone) - 2. Create new config profile - 3. Setup your device in "supervised" mode and apply said profile (the reason for this step is that the "best" config profile options are only available in supervised mode). Config profile items of interest include, but may not be limited to: - "Allow USB accessories while device is locked" - "Allow pairing with non-configurator hosts" - "Allow putting into recovery mode from an unpaired device"
  • lrvick 5y ago
    If the USB device is not permitted to enumerate when the device is locked, then the payload just fires when enumeration happens after unlock. You either ban USB devices entirely or you make users approve on every connection with no white listing.