4 ms·

USB-C cable CT scan reveals sinister active electronics

26 points by toss1 2y ago

FrustratedMonky 2y ago
Isn't the only reason for this, nefarious? What purpose does this serve except for something bad. Is there any justifiable reason?
- fragmede 2y ago
  yes but is the person they're using it on good or bad, making the purpose something good? killing is bad, but if I'm a hitman that only takes contracts to kill bad people, does that make me a good guy?
  - FrustratedMonky 2y ago
    I think problem with this is it is on amazon for anyone to buy. The pagers were targeted. They manipulated the supply chain to get them into the hands of the bad guys. This USB connector is general public. Everyone could have one.
talldayo 2y ago
> The good news is that these cables are expensive, with prices starting at $119.99 for the most basic version. So, you don’t have to be worried about someone spreading this malicious hardware to provide widespread chaos among the public at large. That's pretty damn cheap as far as hardware-enabled exploits go, and it looks like the keylogger-enabled "Elite" version is just $199.99. If the basic one is limited to spoofed keyboard and mouse inputs, I'm temted to order one just to mess around with people...
- 14 2y ago
  Made me think about my first iPad. Back when they first came out and none of my friends had seen one. I was already into jailbreaking so had Cydia and all the best apps. I put on a screen record function which did so secretly. My buddy comes by one day and was like that thing looks cool. I said ya man it is awesome try it out. Had my secret screen record going and said try facebook man look how cool it is on that. He logs in and I record his password. Logs out and hands it back and I quietly watch what he typed and log into his facebook and changed his profile picture to something funny and made a dumb status. This was back before 2fa was a thing so it was easy. The funny part was when he realized he was not mad as we were long time friends but he was so sad I got his long time password he had used for years. It was fun to mess with him. But now days I would be worried about the legality of using one of these devices to steal someones password. I would not want to take the risk myself.
mannyv 2y ago
This title is clickbait. They didn't scan a random USB cable, they scanned an OMG cable, which is designed to hide a bunch of pen testing stuff.
- toss1 2y ago
  It's the actual headline shortened to the HN 80-char limit The point of the article is not that it is a random cable, but that the pen-testing cable would pass normal 2D x-ray analysis, and required a CT scan to really identify anything abnormal.
  - bravetraveler 2y ago
    Knife is infinitely more accessible and equally effective, no? Protecting a cable I'm motivated to investigate doesn't even register as a priority. If it is: electrical tape. Once I cleared it, I may as well use it. Either I have a legitimate concern and should consider my cable source... or seek psychological help. Who's scanning Red Team cables and coming out surprised? This seems more demonstrative (read: advertising, perhaps fear-mongering) than practical. Needlessly aggrandizing in presentation. It's the kind of thing you solve without expense or effort, lest it snowball. Easier - and arguably better - to replace an untrustworthy cable than get the absolute truth. I don't send DCOPs out with the tester, splicer, and so on. I tell them to get a replacement cable. Once I have a reason to suspect it, that is - the foundation of this article is shaky.
    - fragmede 2y ago
      The foundation of this article is a tweet from Lumafield who are the people behind https://www.scanofthemonth.com/ https://www.scanofthemonth.com/ where they CT scan an object a month as advertisement for their CT scanning service so if we're talking about CT scans of objects showing things, the article was quite successful.
      - bravetraveler 2y ago
        Yes, I agree - advertising with a silly premise I'm not discounting the effectiveness so much, just really trying to assert it's closer to bait than the other poster would admit. The invoice - for the cable - told them the same thing as the scanner, lol. We're talking so it worked, sure. Bait... or more kindly, advertising - I said it first! :P
noman-land 2y ago
The O.MG cables are indeed $200 but the EvilCrow cables are $25 dollars and have a programmable ESP32-S3 inside. This has wifi, bluetooth, and a ton of other stuff.
ysleepy 2y ago
A chip inside a USB-C cable isn't that special, high-end thunderbolt cables have (active) signal shaping chips in both ends. Example tear down of an Apple thunderbolt 4 cable: https://youtu.be/LBWnb0ZIlEA?t=276 https://youtu.be/LBWnb0ZIlEA?t=276

26 points by toss1 2y ago

Isn't the only reason for this, nefarious? What purpose does this serve except for something bad. Is there any justifiable reason?

fragmede 2y ago
yes but is the person they're using it on good or bad, making the purpose something good? killing is bad, but if I'm a hitman that only takes contracts to kill bad people, does that make me a good guy?
- FrustratedMonky 2y ago
  I think problem with this is it is on amazon for anyone to buy. The pagers were targeted. They manipulated the supply chain to get them into the hands of the bad guys. This USB connector is general public. Everyone could have one.

talldayo 2y ago

> The good news is that these cables are expensive, with prices starting at $119.99 for the most basic version. So, you don’t have to be worried about someone spreading this malicious hardware to provide widespread chaos among the public at large. That's pretty damn cheap as far as hardware-enabled exploits go, and it looks like the keylogger-enabled "Elite" version is just $199.99. If the basic one is limited to spoofed keyboard and mouse inputs, I'm temted to order one just to mess around with people...

14 2y ago
Made me think about my first iPad. Back when they first came out and none of my friends had seen one. I was already into jailbreaking so had Cydia and all the best apps. I put on a screen record function which did so secretly. My buddy comes by one day and was like that thing looks cool. I said ya man it is awesome try it out. Had my secret screen record going and said try facebook man look how cool it is on that. He logs in and I record his password. Logs out and hands it back and I quietly watch what he typed and log into his facebook and changed his profile picture to something funny and made a dumb status. This was back before 2fa was a thing so it was easy. The funny part was when he realized he was not mad as we were long time friends but he was so sad I got his long time password he had used for years. It was fun to mess with him. But now days I would be worried about the legality of using one of these devices to steal someones password. I would not want to take the risk myself.

mannyv 2y ago

This title is clickbait. They didn't scan a random USB cable, they scanned an OMG cable, which is designed to hide a bunch of pen testing stuff.

toss1 2y ago
It's the actual headline shortened to the HN 80-char limit The point of the article is not that it is a random cable, but that the pen-testing cable would pass normal 2D x-ray analysis, and required a CT scan to really identify anything abnormal.
- bravetraveler 2y ago
  Knife is infinitely more accessible and equally effective, no? Protecting a cable I'm motivated to investigate doesn't even register as a priority. If it is: electrical tape. Once I cleared it, I may as well use it. Either I have a legitimate concern and should consider my cable source... or seek psychological help. Who's scanning Red Team cables and coming out surprised? This seems more demonstrative (read: advertising, perhaps fear-mongering) than practical. Needlessly aggrandizing in presentation. It's the kind of thing you solve without expense or effort, lest it snowball. Easier - and arguably better - to replace an untrustworthy cable than get the absolute truth. I don't send DCOPs out with the tester, splicer, and so on. I tell them to get a replacement cable. Once I have a reason to suspect it, that is - the foundation of this article is shaky.
  - fragmede 2y ago
    The foundation of this article is a tweet from Lumafield who are the people behind https://www.scanofthemonth.com/ https://www.scanofthemonth.com/ where they CT scan an object a month as advertisement for their CT scanning service so if we're talking about CT scans of objects showing things, the article was quite successful.
    - bravetraveler 2y ago
      Yes, I agree - advertising with a silly premise I'm not discounting the effectiveness so much, just really trying to assert it's closer to bait than the other poster would admit. The invoice - for the cable - told them the same thing as the scanner, lol. We're talking so it worked, sure. Bait... or more kindly, advertising - I said it first! :P

noman-land 2y ago

The O.MG cables are indeed $200 but the EvilCrow cables are $25 dollars and have a programmable ESP32-S3 inside. This has wifi, bluetooth, and a ton of other stuff.

ysleepy 2y ago

A chip inside a USB-C cable isn't that special, high-end thunderbolt cables have (active) signal shaping chips in both ends. Example tear down of an Apple thunderbolt 4 cable: https://youtu.be/LBWnb0ZIlEA?t=276 https://youtu.be/LBWnb0ZIlEA?t=276