Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

O.mg Cable

shop.hak5.org

Post reply on HN
Print view View original

141–150 of 555 posts

Re: O.mg Cable

#141

Post by AtlasBarfed »

fragmede wrote: post #27
cbg0 wrote: post #9

Earlier quoted context omitted.

Are they really breaking into your car just to steal your USB cable or is there other stuff you leave in plain sight?

I'm in San Francisco, so not Seattle, but cars get broken into for the sport of it by this point. A friend's had her window broken and used, gross dog leashes and an old Nokia charger stolen. The lost hours of work to replace the window was the real cost to her dog walking business.

I've never had my car broken into... but most of that was a midwestern city not the coasts, although I've been in San Fran, NYC, and DC.

I have a very messy car. Not rotting food messy, just a lot of clothes and things, often a lot of workout clothes, backup winter clothes, a couple blankets.

Thieves like clean cars. See target, break in, grab, leave. Messy cars are slow, annoying, and induce too much cognitive load.

If I lived in San Fran right now, I would have a shitty car with a lot of clothing in it just for the purposes of covering up things I don't want stolen and being annoying to thieves.

Re: O.mg Cable

#142

Post by hoppla »

progman32 wrote: post #20

As an aside: somewhat ironic that a shop selling gear such as this has such a large 3rd-party javascript footprint. At least some of that js is required for the page to work, as I'm unable to see pictures of the device. I counted 25 3rd party domains in uMatrix. That's quite the attack surface.

I bought something from them once, and they shared my email address with Facebook to do targeted advertising - that was not something I expected they would do.

Re: O.mg Cable

#143

Post by hansjorg »

lostmsu wrote: post #119
lrvick wrote: post #44

See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…

Am I missing something? The worst thing the cable can do is send HID commands, and snoop on traffic between your USB-connectable device and PC?

See for example: https://en.m.wikipedia.org/wiki/DMA_attack

Re: O.mg Cable

#144

Post by lrvick »

hinkley wrote: post #100
hughrr wrote: post #52

Earlier quoted context omitted.

When USB came out I was working in the defence sector. We closed the vector off with cages for the PCs with tied looms under desks, epoxy in all the holes we didn’t want people to use and with threat of being in deep shit.

My school had a way to keep peripherals from wandering off, but if all you need to do is swap the cables then I’m not sure that would still work. Wrapping the cables into a wiring loom makes that process slower, assuming the loom is complicated enough. Did you ever use heat shrink? Or locking cable ties? What the school did was run a steel cable behind the desks, then put a loop of the mouse chord through a steel was…

On most keyboards and mice the cables are not soldered on the inside but just a quick connector.

You can get a female/male versions of this connector placed on either side of an attiny85 for a quick solderless implant no one will ever see.

Then just undo 2 screws, plug your implant inside the mouse/keyboard, screw it back.

To make this harder intentionally strip the screws with a drill, understanding you will never be able to repair that unit again.

Re: O.mg Cable

#146

Post by pa7ch »

lrvick wrote: post #44

See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…

Curious if chromeOS does anything special here to mitigate usb attacks.

Re: O.mg Cable

#147

Post by Workaccount2 »

mikeatlas wrote: post #136
beachy wrote: post #122

Earlier quoted context omitted.

If you want to diy it, Check out ray Ozzie's recent project featured here on HN recently. Very reasonable priced with one up front payment for (10 ?) years of connectivity

https://blues.io/

What service are they using that gives 10 yrs of connectivity for a flat price?

Re: O.mg Cable

#148

Post by Hacktek »

lrvick wrote: post #44

See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…

$600, 3 meter range. wtf? How is OMG Cable able to be so much cheaper and get so much more range?

Re: O.mg Cable

#149

Post by drewzero1 »

lrvick wrote: post #138
tubbs wrote: post #95

Earlier quoted context omitted.

With growing car theft in the US I've been curious about implanting GPS trackers on my own older enthusiast vehicles. There appears to be many options on Amazon but I can't bring myself to trust any of them. Has anyone here gone down that road before?

Check out AutoPi. Open source, plugs into your ODBII port so you can not only track your car but also get maintaince alerts etc.

Depending on how old the enthusiast vehicles are, they probably don't have an OBD-II port (or possibly any port at all). None of mine do, up to the mid 90s.

Re: O.mg Cable

#150

Post by lrvick »

Closi wrote: post #93
e40 wrote: post #80

Earlier quoted context omitted.

Windows and Mac users are currently easy targets. I don't know of any good defenses there. It's crazy to me that this is true. Does the government pay Microsoft and Apple to keep it this way, or are they just negligent?

It’s not really practical to defend against for most end users. Keeping a whitelist of known keyboards and mice is really the only defence even on Linux, and unless you work in a data centre that’s probably way overkill. With a home PC that doesn’t really work though, because in order to authenticate your mouse without some kind of central mouse log on a server you probably need to click a button, which you can’t do…

Whitelists don't work.

As an attacker I just have the bootloaders of my malicious devices advertize the USB IDs of whitelisted devices like Apple Keyboards.

The computer has no way of knowing it is not authentic. There is no signing or certification for USB devices.

The only solution is a kernel that can place all newly attached USB devices in a queue for manual approval.

This is what USBGuard and QubesOS both do. The Linux kernel and udev have native support to hook USB devices early making this easy.

It means no one can drive by plug something in when your computer is locked. You will get a popup asking if you want to give some device other than the keyboard you booted with access to behave as a keyboard .

Also the majority of attacks I have seen in the wild attacking production systems were via endpoint compromises.

If your laptop has remote access to said high value datacenter, then your laptop is a high value target.

Note though that laptops have a nice advantage for this threat model as most have built in PS/2 trackpad and mouse which can let you approve external keyboards/mice etc.

Post reply on HN