If you can do this for kicks, imagine what you can do with a budget.
It's basically what the NSA's ANT catalogue had in their COTTONMOUTH devices, among others [1]
WiFi Hides Inside a USB Cable
21–30 of 159 posts
Re: WiFi Hides Inside a USB Cable
#22The construction of this device is quite impressive, in that it fits entirely inside a USB plug The level of miniaturisation is not all that impressive, these have been around for a while: https://www.amazon.com/Edimax-EW-7811Un-150Mbps-Raspberry-Su... There's no mention of using the rest of the cable as the antenna, since in my experience the above tiny adapters have an equally tiny antenna and thus poor reception.
Impressive for someone like me, whose not that close to the tech!
Re: WiFi Hides Inside a USB Cable
#23Does it just connect to the first WiFi which is t password protected? I’m assuming it’s useless if there’s no open WiFi about?
I'm guessing it goes something like:
- The cable is inserted into the victims computer - The electronics inside the cable creates a WiFi network - The attacker uses a separate computer to connect to this WiFi network - Transmit the payloads to the victim - ??? - Profit
Re: WiFi Hides Inside a USB Cable
#24This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this does for company's cybersecurity practices. A rogue janitor replaces the usb cables on some of the employees of a company that makes $INSERT_SUPER SECRET_TECH$ and done.
How? I've never seen a device, certainly not a PC, that will just randomly connect to any router it sees without some sort of user input.
It looks like it could be a variant of this squashed down to fit in the connector of a cable.
https://github.com/spacehuhn/wifi_ducky
If it is, then the computer doesn't connect to a router at all. The USB cable could make itself available as a network that you remotely connect to then execute commands. The cable then types out your commands as it imitates a USB keyboard. Have you ever seen a device or PC that randomly trusts a USB keyboard you plug into it?
Re: WiFi Hides Inside a USB Cable
#25I guess even some sort of "signed device protocol" will not work. An attacker can just create a device that guesses the device identifier (or whatever is used to create the signature). Then, the attacker device can just keep guessing until it gets it right. Chances are, some serial number or similar will be used for this, so continuous guessing is feasible.
Will the solution to this, then, be to have some sort of "smart card enabled device"? For example, assuming TOFU, you manually accept all device's public keys (and all devices, including cables and stuff will have one of these). Then, the computer will have to verify all actions done by those devices by sending a challenge for each action. But this seems impractical and inefficient...
Perhaps physical security is the only way for this...
Re: WiFi Hides Inside a USB Cable
#26so... that could be useful to penetrate secure facilities, like nuclear weapons bunkers/reactors. A worker is sent a cable as a "gift" or has one substituted in by mail intercept for an actual order. Attacker waits outside in a van and controls things over wifi.
Re: WiFi Hides Inside a USB Cable
#27That hardware solution sans wifi could offer some interesting security solutions such as trusted bridge between any computer and your mobile phone. Can't wait to see this torn down and hacked.
Re: WiFi Hides Inside a USB Cable
#28Would a high voltage loop, for breaking components, be a good solution to an attack like this? Like, fry the electronic components to verify it's just plain metal on the insides?
Re: WiFi Hides Inside a USB Cable
#29This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this does for company's cybersecurity practices. A rogue janitor replaces the usb cables on some of the employees of a company that makes $INSERT_SUPER SECRET_TECH$ and done.
How? I've never seen a device, certainly not a PC, that will just randomly connect to any router it sees without some sort of user input.
Doable with an ESP chip, monitoring for open WiFi network and connects to whatever is available. Then you could have it await further instructions from a C&C.
That wouldn't need further actions from the victim.
Re: WiFi Hides Inside a USB Cable
#30Does it just connect to the first WiFi which is t password protected? I’m assuming it’s useless if there’s no open WiFi about?
It creates a wifi hotspot and the attacker can connect to that using another device from a distance. They can then do stuff via the USB port, for example send key presses.
So they have to be close by.