111–120 of 159 posts
Earlier quoted context omitted.
You can do all of that without WiFi. How is an attacker with no vision of the screen any more useful than a script that can auto type a command to get remote access?
It's more useful precisely because there's nothing running and no remote access on the OS. Traceless. Norton ain't catch that.
Earlier quoted context omitted.
In secure locations it's common for USB ports to be physically blocked (the ones I've seen with glue/resin).
In super secure locations like a SCIF, a TSCM (technical surveillance countermeasures) team comes through on a regular basis with highly sensitive, expensive portable spectrum analyzers, which would find this really quick.
I'm wondering whether any of the Google security team will use this for their "leaving tradition" [1], or whether it's considered cheating, just too easy. [1]: https://twitter.com/LeaKissner/status/1085624255381827584
I worked on a security team that did this when I left - I taped & signed every USB connection at my desk and checked the signatures every time before I unlocked it.
Earlier quoted context omitted.
It's more useful precisely because there's nothing running and no remote access on the OS. Traceless. Norton ain't catch that.
That's the same as regular fake keyboard usbs. The WiFi has no advantage here
You can also imagine a loop where first you install a keyboard logger and exfiltrate the user's password, then later you want to update the exploit scripts to make use of the password. Or hell, maybe this is a prank product and having a wireless button to rickroll your victim on demand makes you laugh.
With that said, the first person to make a fake USB keyboard had a much bigger and more exciting trick than this incremental change.
[1] https://github.com/exploitagency/ESPloitV2
Edit: Or to put it another way, this is like the NSA's "Cottonmouth" bug, which "will provide air-gap bridging, software persistence capability, 'in-field' re-programmability, and covert communications with a host software implant over USB" [2] but 10 years later and without charging a million dollars for 50 units.
[2] https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS...
Huh, so all it takes is someone to break into your home when you're gone and swap a cable. Seems like privacy doesn't really exist for people who truly need it. Unless they're not using any technology.
Earlier quoted context omitted.
I worked on a security team that did this when I left - I taped & signed every USB connection at my desk and checked the signatures every time before I unlocked it.
I must be out of the loop but, how do you sign USB connections?
Huh, so all it takes is someone to break into your home when you're gone and swap a cable. Seems like privacy doesn't really exist for people who truly need it. Unless they're not using any technology.
Earlier quoted context omitted.
I worked on a security team that did this when I left - I taped & signed every USB connection at my desk and checked the signatures every time before I unlocked it.
I must be out of the loop but, how do you sign USB connections?
Earlier quoted context omitted.
So they have to be close by.
https://www.simplewifi.com/products/parabolic-grid "2.4Ghz wifi antenna extends a 7 degree wide cone, allowing it to perform over large distances up to 8 miles of range."
Also, the 8 mile range is obviously very theoretical, in a direct line from point A to point B with no obstacles.
Earlier quoted context omitted.
In super secure locations like a SCIF, a TSCM (technical surveillance countermeasures) team comes through on a regular basis with highly sensitive, expensive portable spectrum analyzers, which would find this really quick.
If you were designing a modern bug, wouldn't you make it cache data and limit its transmission window to one second a week?
