Live data from Hacker News

A low budget consumer hardware espionage implant (2018)

ha.cking.ch

61–70 of 99 posts

Re: A low budget consumer hardware espionage implant (2018)

#61

An even easier one would be a modified keyboard. Anyone could fit an esp32 into a keyboard, swap it out, leave it lying around, sniff keystrokes, access with Bluetooth or WiFi, could have it only have the radio on for certain windows in time etc.

The mouse is more commonly swapped in situations with physical access. Without physical access, those non-BlueTooth wireless mice (with their own RF dongle) are vulnerable to remote keystroke injection.

Especially the pre-paired ones. I’m wary of older Logitech Unified dongles, but the newer Bolt platform offers a bit more comfort.

Re: A low budget consumer hardware espionage implant (2018)

#62
post #30

An even easier one would be a modified keyboard. Anyone could fit an esp32 into a keyboard, swap it out, leave it lying around, sniff keystrokes, access with Bluetooth or WiFi, could have it only have the radio on for certain windows in time etc.

Hard part there is getting the wear and tear from oils in your hand to look identical. Although maybe most people don't pay attention to that.

Pop and swap the keycaps

Re: A low budget consumer hardware espionage implant (2018)

#63
post #4

Using SMS as the control protocol seems like a bad idea. You are generating evidence with each command sent that may or may not be stored practically forever by the telcos.

That's assuming you're using it for spying.

A completely honest use of this is to track your car, (or other device with a USB port) in case of theft.

If I had one of the Kias or Hyundais that were easy to steal, I'd totally slip one of these into the car.

Re: A low budget consumer hardware espionage implant (2018)

#64

Earlier quoted context omitted.

No ID is required to buy a pay as you go SIM card in the UK. Just walk into any supermarket or pretty much any corner shop and they will sell you a Sim for a quid at most. (You can also get them for free from the networks directly on their websites, but now they know the address the sim was sent too) Top up credit is the same, ask the counter staff for £x on network Y and once you have paid they will give you a print…

I thought I read you could buy "adult verification cards" by going to a newsstand and presenting ID that is potentially verified by the seller (if you appear underage) but not recorded. Like alcohol or tobacco purchases are in the US.

There were plans for that (And as another kick in the teeth, those porn-passes would expire, want more porn? go buy another pass!), but those plans got shelved because they finally figured out it was a dump idea. Though "we got to protect the kids" does keep popping back up every now and then.

(It wasn't the only way to verify your age, it was "just" meant as a way to prove age to a site without having to share your ID/Credit Card with that site, as not every adult has an ID/Credit Card)

As of right now every pay as you go sim comes with adult filtering enabled, you are then asked to proof your age in a number of ways to the provider to disable the block, this can be by using a credit card, or by popping into one of the providers stores (if they have one), last PAYG provider I unblocked adult content on used AI to guess my age from a selfie and no ID was required (The verification promised to not store my photo after verification, you kinda have to take them at their word for that, but breaking such a promise would land them in trouble with the ICO). I have on at least 2 occasions got the blocked disabled just by having a chat with a customer service agent on the phone, however that was about 5ish years ago, that provider may have changed up their methods in the years since.

Contract plans tend to give you the option when signing up if you want the adult content block or not, because on contract plans the account holder has to be 18 years old to sign up, but they also know that parents will take out contract plans for their kids to get a better deal on the phone/plan so the option is there for the parents to apply it / remove it as they deem fit.

Same goes for the larger fixed line ISPs, during sign up you are asked if you want adult content filtering or not (some will also offer more categories to filter such as gambling, social media, etc etc etc), but its only the larger ISPs that have to do this (iirc its not a legal requirement, but something the industry agreed too to avoid it becoming a legal requirement, however its been that long my memory could be faulting me on that). The smaller ISPs don't have to do so and some of them (A&A for example) pride themselves on not filtering the internet for their customers.

The crazy thing is on all the providers I have used (however I've not tested every provider), the filtering seems to be done pretty much always at the DNS level, change your DNS settings to anything other then the providers and you are able to bypass the parental controls.

Sky iirc (its been a while since I have used them) did do some deep packet inspection on filtered sites, but if the site was hosted behind the likes of cloudflare they only blocked at the DNS level for that site as not to cause any issues with any other sites hosted behind that proxy.

EDIT: Oh one thing I remember from when I had to use Sky for a brief period about 6 months ago, they "somehow" (not actually looked into how they do so, a couple of ways they could do this pop to minds, I just never dug into it.) pass long your filter status to Google and Bing when you do a search, so if you had adult filtering enabled at the ISP level Google would force enable safe-search on their end.

Re: A low budget consumer hardware espionage implant (2018)

#65
post #55

Earlier quoted context omitted.

What is your question?

Where to buy one. The article says they bought it on Aliexpress but there are no sellers.

You did not look hard enough. Use search "GPS tracker charger" to get started. They still exist in there

Re: A low budget consumer hardware espionage implant (2018)

#66

Earlier quoted context omitted.

> So the "quick bug sweeps" you see in the movies are more difficult Isn't that what nonlinear junction detectors are for?

Sure, the question is if you're surprised to get a positive from a USB cable. Wouldn't be surprised to find a diode inside there...

When in doubt, rip it out. If you suspect bugs, then get rid of any suspicious cable you can't prove the provenance of.

Re: A low budget consumer hardware espionage implant (2018)

#67
post #62
post #30

Earlier quoted context omitted.

Hard part there is getting the wear and tear from oils in your hand to look identical. Although maybe most people don't pay attention to that.

Pop and swap the keycaps

Dirty keys on a pristine keyboard is a dead giveaway.

Re: A low budget consumer hardware espionage implant (2018)

#69
post #52

If you have the ability to disassemble your electronics, do so! Do a DDG search for the identifiers on all the chips. You will learn a lot.

Too many plastic enclosures are assemble-only, requiring destruction to disassemble.

The free market did a terrible job incentivizing disassembly... Can't count how many no-screw assemblies have triggered me.

The right-to-repair situation is a joke right now with automotive, consumer electronics, and appliances.

Post reply on HN