3 ms·
O.mg Cable
- nathanaldensr 3y ago"Teehee, this is totally for research and security teams!"
- logiczilla 3y agoThis looks useful for showing a demo to management folks. The fact that it's readily available just makes it even better for scaring them.
- Terr_ 3y agoThat kind of depends on how your "management folks" react to "being scared." Not everybody survives after telling unexpected or inconvenient truths to the monarch.
- mozman 3y agoAs a manager I bought and distributed these to senior ICs to demonstrate how much work someone could put into compromising you
- nubinetwork 3y agohttps://news.ycombinator.com/item?id=21946511 https://news.ycombinator.com/item?id=21946511 https://news.ycombinator.com/item?id=28394035 https://news.ycombinator.com/item?id=28394035 https://news.ycombinator.com/item?id=36080629 https://news.ycombinator.com/item?id=36080629
- ubertaco 3y agoMan, Hak5 is such a solid throwback. One of the last good things on what ZDTV got morphed into.
- reaperman 3y agoI think a partial solution to this is when a USB device connects it should need permission to perform certain categories of actions. Like Safari asks the user “this website would like to know your location”, MacOS could tell users when they plug in their phone to charge off their laptop: “The device you just connected wants to be a keyboard. Allow?” Yes, it would still spoof the apple Magic Keyboard or whatever, but you’d need to allow the keyboard to be a keyboard every time you connect it. If you plug in something that should definitely not be a keyboard, you can investigate the cable by swapping out with a known good cable.
- iamevn 3y agohow do I validate my keyboard initially? how do I validate my mouse initially? something would need special treatment that would be an attack surface.
- reaperman 3y agoYou can't validate your keyboard. But you can confirm that you keyboard is a keyboard and not a storage device or network interface or whatever. And that your webcam is also not a keyboard. It's a defense against the OMG cable which attacks you when you connect known-good items. If Logitech or Apple peripherals are counterfeited it will provide less benefit.
- thekombustor 3y agoI think what he meant was, how do you accept the keyboard prompt if this is the initial keyboard connected to the system? Same goes for mouse. A bit of a chicken and egg problem, unless you blindly accept the first keyboard plugged into the system, which defeats the point.
- yencabulator 3y agoShowing a PIN on the screen, to type in, helps a long way. But what if I replace the USB cable for your keyboard? (Or replace the whole keyboard, but that's more noticeable.) Most people would just re-authenticate their keyboard immediately, because this stuff sucks enough that we don't even blink when we need to redo a Bluetooth pairing because the planets changed their alignment again.
- throwawaymobule 3y agoDon't know about macos, but USBguard exists for Linux. I tried it for a while, and found it too annoying to continue. https://usbguard.github.io/ https://usbguard.github.io/
- 3y ago