3 ms·

Given that the device is plugged in, trusted, shows up as a computer, and requires external power, it has all the connections it needs spy on the screen (at min

Given that the device is plugged in, trusted, shows up as a computer, and requires external power, it has all the connections it needs spy on the screen (at minimum) and remote control the victim iPhone without permission in the worst case. (it has video feed, and can emulate USB keyboard and mouse) Yikes!

mtreis86 3y ago
How hackable is it? That could be useful
jjoonathan 3y ago
Integrating everything into USB has been great at physical simplification, but it really opened up the attack surface. First party malware is the worst.
- kibwen 3y ago
  From the photos, this looks like a Lightning cable, not a USB cable.
  - mutex_man 3y ago
    They're referring to the USB protocol, which lightning uses.
- tavavex 3y ago
  Can't wait for the consumer keyboard that saves everything that was typed to it and/or executes things on its own
  - fragmede 3y ago
    usb keyloggers have existed since just after USB came out, and badusb is totally a thing.
    - tavavex 3y ago
      They have, but all of them are "personalized" attacks - as in, a malicious person needs to install these on specifically your computer, without your knowledge. What I was talking about is some kind of device from some noname Chinese manufacturer that presents as harmless, but actually sends off some additional data back home
  - parker_mountain 3y ago
    Yeah, it was sold to schools in the 90s. https://en.wikipedia.org/wiki/AlphaSmart https://en.wikipedia.org/wiki/AlphaSmart
    - tavavex 3y ago
      Oh yeah, I remember reading about the AlphaSmart somewhere! Though it is quite different from an ordinary-keyboard-looking spying device that I tried to describe in my original comment. The AlphaSmart feels like more of a digital typewriter that just had a really primitive data transfer method
- nikau 3y ago
  Not at all. Usbc is just the connector. Running display port graphics over usbc is no less safe than using a bigger display port connector.
  - brookst 3y ago
    Can a rogue displayport peripheral present as a storage device, keyboard, etc?
    - nikau 3y ago
      Answer is "it depends". USB-C always has a usb2 channel available, then 4 lanes that can be display port or thunderbolt or usb2/3 or whatever else. This is why most android phones have options for USB including "charge only".
      - lathiat 3y ago
        Right but a normal DisplayPort or Mini DisplayPort connector doesn’t have USB…
goosedragons 3y ago
It's not THAT weird. Lightning can't carry HDMI at all so even Apple's official adaptor is essentially setting up an Airplay connection over USB and has an ARM SoC to handle it. I'm guessing 3rd parties can't do the same trick without Apple's blessing which results in scary seeming workarounds.
- tymscar 3y ago
  Do you have a source on that? I ask because it’s genuinely such a cool thing but I can’t find anything about it online even though I have seen this mentioned before.
  - cma 3y ago
    https://www.theverge.com/2013/3/1/4055758/why-does-apples-lightning-to-hdmi-adapter-have-an-arm-computer-inside https://www.theverge.com/2013/3/1/4055758/why-does-apples-li...
    - tymscar 3y ago
      Seems to have been debunked.
      - parker_mountain 3y ago
        The premise (low end soc streaming video over usb) is not debunked at all.
- deleted 3y ago
  [deleted]
- kalleboo 3y ago
  > I'm guessing 3rd parties can't do the same trick There are lots of third-party Lightning to HDMI adapters for cheap on Amazon that work as a clone of Apple's with no need for any software. Whatever this cable is doing is out of the ordinary even for knockoffs.
upwardbound 3y ago
Agreed. If you want to prove to yourself that this vulnerability is real, consider that you can replicate the hypothesized malicious device you describe by taking a WiFi Duck https://wifiduck.com/ https://wifiduck.com/ and combining it with a regular lightning-to-HDMI adapter by plugging the WiFi Duck into the extra lightning port on the HDMI adapter. All that would be needed to use this attack on an unsuspecting victim would be to combine the WiFi Duck and the HDMI adapter functionality into a small enough circuit board to fit into the Apple-style white enclosure.
TheHappyOddish 3y ago
Can you pull video and input both emulated keyboard and mouse via a lightning port, all concurrently, or is that theoretical? I was mulling over a (legitimate) project recently and couldn't find any information about them all together.

mtreis86 3y ago

How hackable is it? That could be useful

jjoonathan 3y ago

Integrating everything into USB has been great at physical simplification, but it really opened up the attack surface. First party malware is the worst.

kibwen 3y ago
From the photos, this looks like a Lightning cable, not a USB cable.
- mutex_man 3y ago
  They're referring to the USB protocol, which lightning uses.
tavavex 3y ago
Can't wait for the consumer keyboard that saves everything that was typed to it and/or executes things on its own
- fragmede 3y ago
  usb keyloggers have existed since just after USB came out, and badusb is totally a thing.
  - tavavex 3y ago
    They have, but all of them are "personalized" attacks - as in, a malicious person needs to install these on specifically your computer, without your knowledge. What I was talking about is some kind of device from some noname Chinese manufacturer that presents as harmless, but actually sends off some additional data back home
- parker_mountain 3y ago
  Yeah, it was sold to schools in the 90s. https://en.wikipedia.org/wiki/AlphaSmart https://en.wikipedia.org/wiki/AlphaSmart
  - tavavex 3y ago
    Oh yeah, I remember reading about the AlphaSmart somewhere! Though it is quite different from an ordinary-keyboard-looking spying device that I tried to describe in my original comment. The AlphaSmart feels like more of a digital typewriter that just had a really primitive data transfer method
nikau 3y ago
Not at all. Usbc is just the connector. Running display port graphics over usbc is no less safe than using a bigger display port connector.
- brookst 3y ago
  Can a rogue displayport peripheral present as a storage device, keyboard, etc?
  - nikau 3y ago
    Answer is "it depends". USB-C always has a usb2 channel available, then 4 lanes that can be display port or thunderbolt or usb2/3 or whatever else. This is why most android phones have options for USB including "charge only".
    - lathiat 3y ago
      Right but a normal DisplayPort or Mini DisplayPort connector doesn’t have USB…

goosedragons 3y ago

It's not THAT weird. Lightning can't carry HDMI at all so even Apple's official adaptor is essentially setting up an Airplay connection over USB and has an ARM SoC to handle it. I'm guessing 3rd parties can't do the same trick without Apple's blessing which results in scary seeming workarounds.

tymscar 3y ago
Do you have a source on that? I ask because it’s genuinely such a cool thing but I can’t find anything about it online even though I have seen this mentioned before.
- cma 3y ago
  https://www.theverge.com/2013/3/1/4055758/why-does-apples-lightning-to-hdmi-adapter-have-an-arm-computer-inside https://www.theverge.com/2013/3/1/4055758/why-does-apples-li...
  - tymscar 3y ago
    Seems to have been debunked.
    - parker_mountain 3y ago
      The premise (low end soc streaming video over usb) is not debunked at all.
deleted 3y ago
[deleted]
kalleboo 3y ago
> I'm guessing 3rd parties can't do the same trick There are lots of third-party Lightning to HDMI adapters for cheap on Amazon that work as a clone of Apple's with no need for any software. Whatever this cable is doing is out of the ordinary even for knockoffs.

upwardbound 3y ago

Agreed. If you want to prove to yourself that this vulnerability is real, consider that you can replicate the hypothesized malicious device you describe by taking a WiFi Duck https://wifiduck.com/ https://wifiduck.com/ and combining it with a regular lightning-to-HDMI adapter by plugging the WiFi Duck into the extra lightning port on the HDMI adapter. All that would be needed to use this attack on an unsuspecting victim would be to combine the WiFi Duck and the HDMI adapter functionality into a small enough circuit board to fit into the Apple-style white enclosure.

TheHappyOddish 3y ago

Can you pull video and input both emulated keyboard and mouse via a lightning port, all concurrently, or is that theoretical? I was mulling over a (legitimate) project recently and couldn't find any information about them all together.