131–140 of 159 posts
Earlier quoted context omitted.
Looking at the reviews, it seems that the "GPS" is just a cell tower ID, and the microphone is very quiet.
OK, it's not NSA-level tech, but a $10 hidden mic with location and GSM cellular built into a charging cable, that 95% of us never think twice about is scarey cool.
This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this does for company's cybersecurity practices. A rogue janitor replaces the usb cables on some of the employees of a company that makes $INSERT_SUPER SECRET_TECH$ and done.
While I understand how this could've been fun to 'try out', I can think of nothing but ways that this can be seriously abused. (atm attacks, corporate spying, ...) Can a device like this be used do anything positive toward humanity? Did I misunderstand something? (I'm genuinely curious!) Edited: reworded (honest) question to be less negative.
PoCs are often what lead to security changes. This device just existing will spur research into how to to defeat it which in turn may lead to improved security for all.
Earlier quoted context omitted.
PrintScreen/Upload screenshot to web server/Wait for command Better than that is to just type a PowerShell script that gets all the info immediately and sends it to a server.
You can do all of that without WiFi. How is an attacker with no vision of the screen any more useful than a script that can auto type a command to get remote access?
A device like this packages its own covert communications channel together with the exploit dropper; it provides an entry point to your network (and exfiltration channel) that bypasses all your filtering, logging, scanning, etc.
what's the attack? the website just drones on about a cable that, as far as i can tell, could just broadcast your keypresses over wifi.
Most operating systems trust USB devices completely. You can send keystrokes that open a text editor and type malware that'll do whatever you want, and you can control the attack in real time via wifi. (it couldn't read user keypresses unless they use the cable to plug in their keyboard)
Earlier quoted context omitted.
It looks like this hack uses an esp8266, which supports WiFi. Most likely the chip is booting up its own WiFi network for the phone to connect to, the phone is sending the payload over this network, and running the usb exploit. Some esp family chips should also support Bluetooth.
Okay, so the attacker would need to be within range. Is that a correct understanding?
About a month ago I found a similar device on aliexpress that has GPS and SIM card slot: https://www.aliexpress.com/item/1m-USB-Charging-Data-Cable-f... ?
I wonder how many things like this are in the wild and nobody's noticed.
Earlier quoted context omitted.
>How does a device like this do anything but affect humanity in a negative way? How is the kind of 'research' remotely legal? Here is some advice, whenever you think “there aught to be a law...” there probably shouldn’t be. Planes would be falling out of the sky and high rises would be on fire if everyone had your sense of what types of research should “be allowed”.
> whenever you think “there aught to be a law...” there probably shouldn’t be I actually totally agree (which is the reason for my edited response above, before your comment arrived)... but there must be limits, musn't there? We don't arbitarily allow murder, rape or theft. Looking at the concept of "freedom" is a tricky thing, I've found. At what point does "doing whatever I want" become unacceptable to the very soc…
But the way out of this is actually to make the constraint more orientated on the harm. Several jurisdictions already ban the sale of spy devices. Many have rules about non-consensual recording. Or general privacy rules.
Don't try to ban buidling things unless the other approaches have been tried and failed. The solution to "upskirting" and other non-consensual intrusive photography has been bans on doing that, not a ban on smartphones. There are all sorts of things that you can legally build and tinker with but not market to the public.
(Security researchers are particularly salty about this because you can't get people to take a threat seriously without building a proof-of-concept, but that is in itself a weapon. Often you can't prove a system is insecure without breaking it.)
Earlier quoted context omitted.
>How does a device like this do anything but affect humanity in a negative way? How is the kind of 'research' remotely legal? Here is some advice, whenever you think “there aught to be a law...” there probably shouldn’t be. Planes would be falling out of the sky and high rises would be on fire if everyone had your sense of what types of research should “be allowed”.
Perhaps I'm misunderstanding your comment but the reason planes aren't falling out of the sky and high rises aren't all on fire is because these things are so heavily regulated. Not that I'm a fan of knee-jerk reactive lawmaking, but they struck me as odd examples.
Earlier quoted context omitted.
Ive made and will be giving a talk on what a TSCM team would use. My talk was accepted at CircleCityCon in Indianapolis IN. I've built a tablet capable of intercepting and injecting radio from 20MHz to 1.5GHz. https://ccc2019cfp.busyconf.com/activities/5c3a57314808fac10... https://mobile.twitter.com/CrankyLinuxUser/status/1097884386... Repo: https://gitlab.com/crankylinuxuser/siginttablet
This is awesome and thanks for sharing it, do you know if the circle city con talks are going to be recorded? I'd love to see a walk through of this stuff
You could certainly ask them over twitter. In my experience they return questions in an hour or 2.
About a month ago I found a similar device on aliexpress that has GPS and SIM card slot: https://www.aliexpress.com/item/1m-USB-Charging-Data-Cable-f... ?
Would be even scarier with eSIM, but I suppose it's just a matter of time before we get that.