O.mg Cable • Hacker News Board

Re: O.mg Cable

#11

Post by dylan604 » Thu, Sep 02, 2021, 5:15 PM UTC

NamTaf wrote: post #8

Eiriksmal wrote: post #3

Wow! Is the trick that we now have powerful microcomputers small enough to fit into a USB plug? That's pretty incredible technology. How many years ago did this become possible? My IT security training is dated, I am aware of the risks of plugging in a random USB key, but just a cable from a helpful "coworker"? Yikes.

It’s a copy of the NSA ANT Coppermouth cables. That was part of the Snowden leak, so it’s been possible since at least then (the doc itself is circa 2008) if you have a three-letter name and a national security black budget. https://en.m.wikipedia.org/wiki/NSA_ANT_catalog

Was it actually something Snowden released, or part of the second leaker's data that got attributed to Snowden?

Re: O.mg Cable

#12

Post by reilly3000 » Thu, Sep 02, 2021, 5:16 PM UTC

It was my firm belief that many of the angry mobs at vote counting offices around the 2020 elections were cover for planting these types of devices. That is very much out of the Roger Stone playbook. The lack of anomalies has shaken that belief… but I do hope that the existence of these types of devices is included in security training for future polling staff.

Re: O.mg Cable

#13

Post by mmastrac » Thu, Sep 02, 2021, 5:17 PM UTC

Can you write custom code for this thing? I actually have some non-nefarious use cases...

Re: O.mg Cable

#14

Post by varikin » Thu, Sep 02, 2021, 5:17 PM UTC

fragmede wrote: post #6

Eiriksmal wrote: post #3

Wow! Is the trick that we now have powerful microcomputers small enough to fit into a USB plug? That's pretty incredible technology. How many years ago did this become possible? My IT security training is dated, I am aware of the risks of plugging in a random USB key, but just a cable from a helpful "coworker"? Yikes.

That level of miniaturization is far older than Apple's removal of the iPhone headphone jack in 2016, but the related lightning-to-audio jack dongle had a microcontroller with a DAC inside that you'd never think existed due to the form factor.

Just for reference, here are a couple breakdowns of how impressive the iPhone headphone jack is. It is impressive how good it is and how tiny it is.

https://www.ifixit.com/News/8448/apple-audio-adapter-teardow...

https://www.kenrockwell.com/apple/lightning-adapter-audio-qu...

Re: O.mg Cable

#15

Post by shepherdjerred » Thu, Sep 02, 2021, 5:18 PM UTC

cbg0 wrote: post #9

aabajian wrote: post #2

I live in Seattle and have had my car broken into three times. Each time, they steal my iPhone's USB cable. I wonder, could they add cellular connectivity to this cable and use it as a GPS locator?

Are they really breaking into your car just to steal your USB cable or is there other stuff you leave in plain sight?

Lightning cables are expensive, and Apple is definitely encouraging car theft by not including them in the box anymore.

edit: this was a joke and it got appropriately downvoted. I regret nothing.

Re: O.mg Cable

#16

Post by sushisource » Thu, Sep 02, 2021, 5:18 PM UTC

NamTaf wrote: post #8

Eiriksmal wrote: post #3

Wow! Is the trick that we now have powerful microcomputers small enough to fit into a USB plug? That's pretty incredible technology. How many years ago did this become possible? My IT security training is dated, I am aware of the risks of plugging in a random USB key, but just a cable from a helpful "coworker"? Yikes.

It’s a copy of the NSA ANT Coppermouth cables. That was part of the Snowden leak, so it’s been possible since at least then (the doc itself is circa 2008) if you have a three-letter name and a national security black budget. https://en.m.wikipedia.org/wiki/NSA_ANT_catalog

Why is the NSA so good at coming up with sweet codenames for things? I swear it's someone's full time job there.

Re: O.mg Cable

#17

Post by fragmede » Thu, Sep 02, 2021, 5:19 PM UTC

flixic wrote: post #5

Took me a moment to realise, but this is for keyboards, not iPhones. I don't think (?) anybody can access anything from an iPhone using an evil cable (using publicly-known attacks).

The boot rom of iPhone 8 and older have a publicly known exploit. If you plugged your phone in to charge, and then it spontaneously rebooted, how much forensic digging could you actually do?

How much are you willing to bet that there's not a private exploit against newer iPhones? Not in terms of dollars, but in terms of private data that Apple's iPhone that you're renting from them has access to.

Re: O.mg Cable

#18

Post by girishso » Thu, Sep 02, 2021, 5:22 PM UTC

ttul wrote: post #7

flixic wrote: post #5

Took me a moment to realise, but this is for keyboards, not iPhones. I don't think (?) anybody can access anything from an iPhone using an evil cable (using publicly-known attacks).

I’m kind of surprised that Apple doesn’t encrypt keystrokes between its keyboards and the host machine, given than they have the capability to enable the keyboard to authenticate the host using PKI. Maybe this is on their todo list.

So we can’t use third party keyboards with Apple devices? No thanks.

Re: O.mg Cable

#19

Post by deelowe » Thu, Sep 02, 2021, 5:22 PM UTC

shepherdjerred wrote: post #15

cbg0 wrote: post #9

Earlier quoted context omitted.

Are they really breaking into your car just to steal your USB cable or is there other stuff you leave in plain sight?

Lightning cables are expensive, and Apple is definitely encouraging car theft by not including them in the box anymore. edit: this was a joke and it got appropriately downvoted. I regret nothing.

A cable that costs $20 - $30 retail NEW doesn't seem worth risking jail time over.

Re: O.mg Cable

#20

Post by progman32 » Thu, Sep 02, 2021, 5:24 PM UTC

As an aside: somewhat ironic that a shop selling gear such as this has such a large 3rd-party javascript footprint. At least some of that js is required for the page to work, as I'm unable to see pictures of the device. I counted 25 3rd party domains in uMatrix. That's quite the attack surface.