10 ms·
Investigating an “evil” RJ45 dongle
- ChrisArchitect 2y agoRelated: Cheap rj45 ethernet to USB adapter contains malware https://news.ycombinator.com/item?id=42679498 https://news.ycombinator.com/item?id=42679498
- TiredOfLife 2y agoDon't give clicks to grifters.
- gus_massa 2y agoIn cases like this I prefer more context , like > Discussion in HN of the article debunked here: > httpwhatever
- baq 2y agoRJ45 nazi here: these should be called 8P8C I’ll show myself out
- leptons 2y agoTIL. After maybe 25 years of using this connector, I've never heard it called 8P8C. I knew Ethernet has used other physical layers including coax, which I used to run between Amigas way back in the day. But, today I finally learned about 8P8C.
- SAI_Peregrinus 2y agoRJ45 isn't even actually the same connector, at least not in the original FCC naming. That was an 8P8C keyed modular connector. RJ45 connectors had only two of the positions connected to wires (one phone line) an internal resistor between two of the other positions, and a keying bar that stuck out of the plug so they wouldn't even go into the unkeyed 8P8C jacks we use for Ethernet. So I'll still call them RJ45 connectors. Because nobody has time to say "8P8C unkeyed modular connector" every time!
- necovek 2y agoWeren't phone lines something like RJ11 or RJ12? FWIW, TIL about 8P8C.
- SAI_Peregrinus 2y agoYes, and RJ45. It used to be defined by the US FCC[1] in 47 CFR Part 68 Subpart F. Along with others, like RJ31X, RJ38, etc. The "RJxxy" numbers were the Universal Service Order Codes (USOCs), the `y` value described the use (e.g. W for wall-mounted jacks). Pages 143 & 144 of the PDF (403 & 404 of the print version) have the electrical connection diagram and the USOCs, pages 125-129 (385 -389 print) have the mechanical drawings. The unkeyed 8p8c connector we use today is also in there (pdf pgs 103-113), but the RJ45 series used the keyed connector! It's RJ31X & RJ38X that used the unkeyed 8-position series jack & 8-position plug we call RJ45 today (pdf pages 137-138). [1] https://web.archive.org/web/20170705131407/http://www.tscm.com/FCC47CFRpart68.pdf https://web.archive.org/web/20170705131407/http://www.tscm.c...
- necovek 2y agoThanks, it's funny how these things happen with language!
- Brian_K_White 2y agoSimilarly, it's DE9 not DB9
- SAI_Peregrinus 2y agoYep, and these days ribbon cables are rare, instead we have Flexible Flat Cables or Flexible Printed Circuits. Ribbon cables are the old cables like IDE hard drives used, with insulation displacement connectors, while FFCs and FPCs are much thinner and use integral connection schemes (tinned pads on the cable itself get clamped by some sort of connector on a PCB).
- formerly_proven 2y ago
- geerlingguy 2y agoHeh I think anyone who studies for the Network+ ends up debating every time RJ45 is mentioned whether to make this comment or not haha
- polpo 2y agoI don't mind calling the connector an RJ45, but calling this thing an "RJ45 dongle" makes my eye twitch. It's an Ethernet dongle - RJ45 can be used for a lot of other things. For example I've seen "RJ45 dongles" that convert USB to RS232 serial for the console ports on a lot of networking equipment.
- dtgriscom 2y agohttps://studiohub.com/ https://studiohub.com/
- sgerenser 2y agoAt least they didn’t call it a wired WiFi dongle.
- Brian_K_White 2y agoI now have Forest Whitaker Eye.
- RyJones 2y agoI did wired WiFi for CES one year. Made having our iot devices on WiFi on the floor much better than other vendors. It’s a long boring story but it was a fun hack.
- _shantaram 2y agoSpill!
- upvota 2y agoI’m actually really interested: I have a piece of stage lighting, that has a 2.4 GHz Wi-Fi controller. I’d love to convert this to wired Wi-Fi. Can you share what is necessary to achieve this hack? Can I “just” run antenna cable between router and controller? Or what kind of radio physics needs to be understood?
- adrian_b 2y ago
- daneel_w 2y agoDon't show yourself out. Stay and remind people. It's important, since these two aren't interchangeable in both directions.
- SAI_Peregrinus 2y agoOr RJ31X or RJ38X, both of which did use the 8P8C modular connector in its unkeyed configuration.
- immibis 2y agoPlease don't call yourself an "RJ45 nazi" as it devalues the problem of actual nazis
- poisonborz 2y agoTLDR: it is not "evil"
- walrus01 2y agoOn the general topic of USB to 1000BASE-T (and now 2.5 GBaseT) dongles, for people who care about performance, it's good to know about the distinction between those that are USB devices and those that are PCI-Express devices. Basically, what do you get if you hotplug it into a laptop running a current linux kernel and do "sudo lsusb -v" vs "sudo lspci -v"? The ones that are native PCIE devices offer much better performance, up to 2.5 GBASET line rate, and will communicate with the host over the implementation of thunderbolt over USB. The ones that are USB only might work okay, but there's a reason they're cheap. Of course a cheaper laptop also won't have any implementation of thunderbolt on it, so that's something to consider as well.
- Tijdreiziger 2y agoCould you elaborate on why the USB ones are worse? Per Wikipedia, USB 3.0 (from 2008) can reach 5 Gbit/s, so (naively?) one would expect them to reach 2.5 GbE line rate easily, right?
- ComputerGuru 2y agoUSB doesn’t provide any DMA (until USB 4) and requires more host cpu resources to meet the same bandwidth. It also has less consistent performance by virtue of the USB protocol itself.
- black3r 2y agoat least for Gigabit speeds, the CPU usage is negligible if the device and the driver are communicating through CDC-NCM protocol, but yeah it's a significant hit if you're using CDC-ECM...,
- mianos 2y agoI am confused by this, I worked on a Linux USB driver that used DMA in 2003.
- ComputerGuru 2y ago
- throeurir 2y agoSo many wtf here. If anything this proves it is backdoored network card 1) downloading Windows exe files from Chinese forums 2) the USB storage provided by network card can still contain malware, 3) or can be accidentally booted from 4) it has universal USB controller, so can become any HID device: keyboard, mouse...
- avidiax 2y agoIt proves it might be possible to backdoor it. Maybe. I don't know of any modern systems that will execute anything on a newly inserted drive, nor boot from an external drive in the default configuration. So we are missing a couple of things. First, a vulnerability in the OS/system. Second, an implementation of that vulnerability in a device like this. Should this design be phased out? Perhaps. There is relatively little difference between not populating the flash memory part of the board and a proper network-only implementation.
- gruez 2y ago>2) the USB storage provided by network card can still contain malware, That seems unlikely given that "malware" is signed by Microsoft Windows Hardware Compatibility Publisher. https://news.ycombinator.com/item?id=42680282 https://news.ycombinator.com/item?id=42680282
- nothacking_ 2y ago> 1) downloading Windows exe files from Chinese forums VMs exist. I highly doubt the author daily drives windows XP. > 2) the USB storage provided by network card can still contain malware Well yes, but so can any other drivers. Downloading from the manufactures website isn't any more secure. Even signed drivers have been caught doing nasty stuff. > 3) or can be accidentally booted from True, but again this is quite a convoluted, noticeable, and unreliable way to compromize a system. Just injecting a handful of keystrokes will do it, and once the dead is done, the device can hide all evidence of malicious intent. > 4) it has universal USB controller, so can become any HID device: keyboard, mouse... This isn't wtf: a lot of devices nowadays are just microcontrollers hooked up to a USB connector. Quite a few normal USB drives can be reprogrammed to act as keyboards, and be used to get up to all sorts of shenanigans, including ones made outside of China.
- klik99 2y ago"If you want to try it, be aware that it requires Intel Pentium 166MHz or above." Made me laugh. Fun article, also really love the genre of "bored smart person goes too deep on something that the end result is obvious by common sense but proving it requires surprising amount of ingenuity and scrappiness"
- er4hn 2y agoDon't forget `I was ready to head over to the Dark Web (amazon.com) and purchase one of the dongles just to dump the contents of the memory chip.`
- fishstock25 2y agoTotally agree. And a great example that truth is complicated, expensive and uncomfortable. It's much easier to postulate an evil nation-state entity with a bad plan (without evidence) than to dig through the thicket of this article. It's much cheaper as well, certainly in terms of time and knowhow. And it's also much more comfortable to claim you're the victim and have uncovered a conspiracy, rather than realize this was just the result of the patchwork typical of engineering. Kudos to the author.
- klik99 2y agoYeah, the insane takes spread faster but it takes more time and resources to look into it than just come to conclusions early. The worst thing is this creates an environment where most people are either completely credulous and buy into everything or completely incredulous and think everything is unfounded. It's just exhausting to have a healthy level of skepticism these days, and maybe 1 out of 1000 times (number source: from thin air) something that sounds insane actually has some truth to it.
- fishstock25 2y agoYeah, for a substantial fraction of people, this case will stick to their minds as "oh the chinese .. again" It's both sad and scary. It was even submitted to HN. Flagged by now, but still. Many people won't have read this follow-up, especially since it doesn't come as a 1-sentence TL;DR..
- Reason077 2y agoAll USB-to-Ethernet adapters are pretty evil in my experience. Always terrible performance, often slower than WiFi.
- batrat 2y agoOld custom software, old hardware, vendor wants all the $ for an upgrade, we refuse to pay. I took 10 desktop pc's($500 each) replaced servers ($20k each), one usb to ethernet dongle in every pc b/c we needed 2 network ports and we had this laying around, USB3 to GB, slap virtualization with USB passthrough. They work for 5+ years, gigabit speed, 24/7 with no problems. People should have more faith in dongles. Not all are bad.
- formerly_proven 2y agoRTL8156B does line-rate 2.5 Gbit/s no problem, most USB-C docks with network have a RTL8153B in them and that does line rate as well. Even mildly dodgy first-generation stuff like AX88179 generally works. I.M.H.O. these USB dongles are actually preferable to the much more expensive Thunderbolt dongles praised below, because a) they work on regular USB ports as well b) they do not require Thunderbolt c) they use less power and d) they don't force a highly ventilated cooling mode on certain host systems. And, fwiw, at least some Thunderbolt docks actually used USB NICs connected to the internal USB controller, which was hooked up over PCIe.
- radicality 2y agoI don’t remember the exact issues, but I remember seeing years ago my old Intel MacBook had noticeably higher cpu usage when connected to and using a Pluggable dock which had a Realtek Ethernet chipset. Switching to WiFi reduced cpu usage. AFAIK had something to do with bad and/or lack of hardware processing in the Realtek chipset so it had to do it on the cpu. Now I never trust anything with Realtek in it, and if buying anything with an Ethernet port, I try to make sure it’s not Realtek. Is this still valid concern, or is Realtek better now?
- daneel_w 2y ago
- FuriouslyAdrift 2y agoAre there "evil" USB ethernet dongles? Of course there are...(just not this one) https://hak5.org/products/lan-turtle https://hak5.org/products/lan-turtle
- gruez 2y agoThe article admits this explicitly: >Malicious hardware has plenty of precedent: it’s been used by intelligence agencies and private pentesters alike. Heck, a bit over a decade ago, I built an evil plasma globe for work. Still, we weren’t here to debate whether a malicious RJ45-to-USB adapter could be made. The important question was whether in this particular instance — as the poster put it — “the Chinese were at it again”.
- nayuki 2y agoYeah, I found the link to the evil plasma globe ( https://lcamtuf.coredump.cx/plasma_globe/ https://lcamtuf.coredump.cx/plasma_globe/ ) to be a more interesting read than the article itself.
- speed_spread 2y agoNot to mention the evil ethernet patch cable: https://imgur.com/Gpgj7w7 https://imgur.com/Gpgj7w7
- deleted 2y ago[deleted]
- nayuki 2y agoAh, it's the Etherkiller prank from the good old days. http://www.fiftythree.org/etherkiller/ http://www.fiftythree.org/etherkiller/
- bisrig 2y agoI'm not sure what the current state of the art is, but for the longest time it was pretty common for USB peripheral ICs to have small flash devices attached to them in order to be able to store VID/PID and other USB config information, so that the device is enumerated correctly when it's plugged in and can be associated with the correct driver etc. And depending on when the device was designed, 512kB might have been the smallest size that was readily available via supply chain. It would not have been strange to use a device like that to store 10s of bytes! The ISO thing is a little bit weird, but to be honest it's a creative way to try to evade corporate IT security policies restricting mass storage USB devices. I think optical drives use a different device class that probably evades most restrictions, so if you enumerate as a complex device that's a combo optical drive/network adapter, you might be able to install your own driver even on computers where "USB drives" have been locked out!
- extraduder_ire 2y agoFor a time, windows would more readily run an autorun from a disc than from a usb stick. Even if that disc was in an emulated usb disk drive.
- myself248 2y agoAnd the "u3" flash drives that did this were a hot commodity for a little while! Then came the iODD and the IsoStick...
- stavros 2y agoThat's because there was malware that spread via autorun, which is rather harder to do with read-only media, even if it's emulated.
- immibis 2y agoWhen the system was designed, the way to get a CD to an end user was to spend at least in the range of ten thousand dollars to get discs mastered and pressed, and then convince physical stores to sell them for you. As well as being a lot of effort, there'd be a clear paper trail. You couldn't just burn one and leave it in a parking lot.
- bentcorner 2y agoI actually really appreciate USB devices that masquerade as a storage device to provide their own drivers. I suppose in this day and age the "right" thing to do is to upload a bunch of stuff to microsoft servers so that it downloads whatever is needed upon getting plugged in, but I've observed enough stuff needing manually installed drivers to know that this isn't as apparently easy as it may appear to be. (For example, I very often need to download vendor-specific ADB drivers) Anyways, I think it's clever for peripherals to help you bootstrap, and having the drivers baked into the device makes things a little easier instead of trying to find a canonical download source.
- necovek 2y agoI appreciate them working out-of-the-box on Linux even more. And they mostly do, with Linux being the best PnP (Plug'n'Play — remember that with Windows 95? :) OS today. But multiple modes of operation really made it harder for to configure devices like those 4G/LTE USB dongles: they will either present as USB storage, or one type of serial device or a CDC-ACM modem device (or something of the sort), requiring a combination of the tools + vendor-specific AT commands to switch it into the right mode. Ugh, just get me back those simple devices that do the right thing OOB.
- dylan604 2y ago> (Plug'n'Play — remember that I remember it as Plug-n-Pray
- teaearlgraycold 2y agoI only know that phrase thanks to the Computer Man song that I’ve seen on YouTube.
- ChocolateGod 2y ago> with Linux being the best PnP as long as it isn't wireless or bluetooth
- 2y ago
- niklasbuschmann 2y ago@lcamtuf: It's Igor Pavlov, not Ivan Pavlov
- MartijnBraam 2y agoI came across the tweet about this "Evil" dongle and instantly recognized it as the exact same thing I worked on before... It's not evil, it's just annoying. https://blog.brixit.nl/making-a-usb-ethernet-adapter-work-sr9700/ https://blog.brixit.nl/making-a-usb-ethernet-adapter-work-sr... In my case I disabled the SPI flash module to have it not appear as a CD drive, the author of this post actually found some documentation about the SPI being optional. Funnily enough this post now also gives you all the tooling to make an actual evil RJ45 dongle by reflashing one :D
- stavros 2y agoHm, why does shorting CS and S0 make it not work?
- nick__m 2y agoI have no idea about S0 but CS is usually chip select. It should be sufficient to short it to prevent the chip from being selected. However CS is frequently inverted and you would have to pull it up to prevent the chip selection, so maybe S0 is always high and inhibit CS
- stavros 2y agoThat makes sense, thank you.
- cozzyd 2y agoSO (MISO) should generally be high impedance if not selected... I suspect this causes SO to always output the same value and the Ethernet controller must expect some magic
- nick__m 2y agoThanks you for refreshing my memory, I learn about that in college twenty-something years ago but never used that knowledge!
- 2y ago
- dlcarrier 2y agoA harmful connection to the Ethernet port would be extremely difficult. A harmful connection to a USB port is extremely easy. Call it what it is: an "Evil" USB dongle that happens to also have an Ethernet socket.
- slipperybeluga 2y ago[dead]
- Fokamul 2y agoBrought to you by Epcyber CEO. All their trainings are OSINT on China. Of course this company is full of clickers, using just automated tools.
- PoppinFreshDo 2y ago[dead]
- YaBa 2y agoEmbedded storage was actually very common some decades ago, remember seeing it in a lot of devices, mostly 3G USB Modems, there was even a AT command to enable/disable it. Seems that the origin of the "chinese hack" theory can be just resumed to: younger people not being used to this kind of old stuff.
- JKCalhoun 2y ago"It is already possible for an assassin to send someone an e-mail with an innocent-looking attachment. When the receiver downloads the attachment, the electrical current and molecular structure of the central processing unit is altered, causing it to blast apart like a large hand grenade.” I feel like that might have been what took out a neighbor down the street. Sorry, I got distracted by the newspaper clipping in the article and had to laugh.
- Lammy 2y ago> The English-language product brief implies that “SR” stands for “Supereal”; that brand name comes up in the context of counterfeit FTDI FT232RL chips that plagued the industry some time ago. This wording is misleading because it implies the fake chips were the plague. The fake chips worked fine, and it was FTDI's official driver that intentionally ruined peoples' working hardware when they detected the fakes and changed their PID to 0000 so they would no longer be recognized: http://www.rei-labs.net/changing-ftdi-pid/ http://www.rei-labs.net/changing-ftdi-pid/
- technothrasher 2y ago> The fake chips worked fine Some of them did. I had some that did weird things with the CBUS pins.
- hashishen 2y agoas someone with no connection to this can you elaborate?
- Nexxxeh 2y agoThey were also a plague because they introduced uncertainty and had spread and contaminated devices across a wide range of devices. Silently counterfeited devices are not OK.
- Lammy 2y agoThey wouldn't have had to pretend if FTDI would have let them be a second source. I am sympathetic toward wanting to have the support of an already-widely-distributed driver rather than get stuck in the chicken vs egg of being unable to break in to a market because no current software supports your design.
- sephamorr 2y agoWhat's so odd about this is that they add the flash ($), but skip the magnetics! It just has series capacitors and I don't think the jack has integrated magnetics since it's small and it wouldn't make sense to have a series cap as well.
- wrigby 2y agoWow, good eye. You can see the PCB is designed to take either magnetics or series caps, but the caps would have to be DNP’ed. I would actually be really angry to discover a USB Ethernet dongle I bought didn’t have magnetics built in.
- adrian_b 2y agoThere are cases when a USB Ethernet dongle without transformers can be dangerous. For example, I use a USB Ethernet dongle to connect my router to a cable modem provided by the ISP. The ground of the cable modem is at the potential of the shield of the coaxial cable, which comes from far away and the voltage difference between the coaxial cable and the ground of my apartment is big enough to give you a serious shock if you would touch an exposed metal part (normally there are no such exposed metal parts). So it is essential for the USB Ethernet dongle to provide insulation between the incoming Ethernet cable and the USB port that is connected to the router, which is grounded at the home ground.
- immibis 2y agoDo you have to wear thick rubber gloves to plug in the cable?
- adrian_b 2y agoWith well-made Ethernet cables, even when they are shielded, it is easy to not touch any conductor (the good shielded RJ-45 connectors have plastic sleeves covering the metal). On the other hand, I would have to be careful if I would want to disconnect and reconnect the coaxial TV cable that comes from the ISP, where the threaded coaxial connectors have a metal part. This is how I have learned that the potential difference between the coaxial cable ground and my ground is big enough to cause a shock :-)
- urbandw311er 2y ago> If you want to try it, be aware that it requires Intel Pentium 166MHz or above. :-D
- itomato 2y agoFor me the takeaway is that Weekly World News still sways minds.
- benbojangles 2y agoI think there is also sometimes similar suggestion towards the SPI chip underneath the OrangePi Zero 2W pcb as the producer suggests it is just a micro linux installation to test the function of the board without having to install a full sd card OS. Perhaps somebody would like to investigate that.