When Apple inevitably removes all physical ports from some future iteration of iPhone, I wonder if they’ll use the existence of tech like this to market the change as a benefit to security. I’m simultaneously impressed, curious and disturbed.
I still don't understand why they even have usb connection on Iphone. I have not attached a cable to it for years. Wireless charging, bluetooth headset, and all other bluetooth devices. Icloud backup as well as government spyware called CSAM never needed a cable.
O.mg Cable
331–340 of 555 posts
Re: O.mg Cable
#332Earlier quoted context omitted.
I specifically don't recommend laptops that rely on USB C charging for applications where trust is critical -unless- they are running Linux with USBGuard or QubesOS. That said I did make transparent and easily auditable USB type C condoms for one client that really wanted to use USB type C laptops. Systems with security as a strong priority like the Librem 14 use barrel jacks for good reason. I am in fact implying th…
USB C charging happens well below the OS layer, using firmware that often isn't all that good. USBGuard or QubesOS won't help there (but will somewhat mitigate attacks trying to move up the stack)
A tampered USB C to C cable on a conference room table can compromise people all day long.
If the USB C charge ports cut the data pins entirely then great, but I have not seen that be the case on any laptops yet.
Re: O.mg Cable
#333See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…
> Windows and Mac users are currently easy targets. Not true, at least for iPhone / iPad users: - 1. Download Apple Configurator (free to anyone) - 2. Create new config profile - 3. Setup your device in "supervised" mode and apply said profile (the reason for this step is that the "best" config profile options are only available in supervised mode). Config profile items of interest include, but may not be limited to:…
You either ban USB devices entirely or you make users approve on every connection with no white listing.
Re: O.mg Cable
#334Earlier quoted context omitted.
Check out AutoPi. Open source, plugs into your ODBII port so you can not only track your car but also get maintaince alerts etc.
> plugs into your ODBII port Which is usually quite easy to check. It's not a guarantee, but with someone sophisticated enough to crack a modern car there's a good possibility they know to check the OBDII slot.
If they are sophisticated and have time to take the whole car apart then you are SOL anyway as they will find any transmitters with an SDR.
Re: O.mg Cable
#335Earlier quoted context omitted.
Why is the NSA so good at coming up with sweet codenames for things? I swear it's someone's full time job there.
The real answer? Because these people are just like us, geeks, nerds, techies, early adopters. They are just the same people we live and work with. The film Enemy of the State (1998) was science fiction except with the parts where the techy operators were just normal nerds like us. That what was most scary part of the film not the (at the time fantastic) surveillance.
Re: O.mg Cable
#336See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…
Read the reviews on the GPS tracking charger... either the people who bought it couldn't figure out how to use it, or its another scam product from china we see flooding amazon.
So spy tools that spy on the spys.
It is sketchy as all hell and should not be sold.
That said this stuff pops up everywhere.
I just cite it as examples.
Re: O.mg Cable
#337Earlier quoted context omitted.
You are commenting on a forum full of people who build tools and technology for facebook and google and probably palintir and a thousand other facial recognition and thoughtcrime style systems.
Sure, Facebook and Google are pretty evil organisations but they can never match the scope of surveillance of governmental agencies. Facebook and Google need the user to use their services and they say (despite the message being in legalese) what they're going to track. There is consent involved in these organisations, it's a voluntary transaction. The government can (and did) just intrude on everything without conse…
And, also, both Google and Facebook eagerly cooperate with state actors in censorship and other aspects - likely surveillance too. So there's not much difference in that aspect whether you work for the government directly or for somebody who takes marching orders from the government while being formally independent.
Re: O.mg Cable
#338Re: O.mg Cable
#339Earlier quoted context omitted.
Whitelists don't work. As an attacker I just have the bootloaders of my malicious devices advertize the USB IDs of whitelisted devices like Apple Keyboards. The computer has no way of knowing it is not authentic. There is no signing or certification for USB devices. The only solution is a kernel that can place all newly attached USB devices in a queue for manual approval. This is what USBGuard and QubesOS both do. Th…
> It means no one can drive by plug something in when your computer is locked. You will get a popup asking if you want to give some device other than the keyboard you booted with access to behave as a keyboard . Makes me think, what would happen if I plugged this cable, unplugged the keyboard, and power-cycled the computer? Or do a hard power down, then the switcheroo, and then power up? Would USBGuard/QubesOS block…
It won't go unnoticed.
If your computer can reboot itself for updates that should be a cause for concern as it means your FDE is being cached somewhere that can use it unattended. I don't allow such things personally.
You do have to check for any untrusted USB devices at boot on a desktop. No getting around that one as you need to be able to use input devices at boot. Best bet is a PS/2 keyboard but those are getting harder to find.
For a laptop you have a better story as you can trust the internal PS/2 keyboard/mouse then use that to approve USB things fresh as needed and dictate what applications they get access to.
I connect my USB webcam to the one VM that needs it on demand, for instance.
Re: O.mg Cable
#340Earlier quoted context omitted.
It’s not really practical to defend against for most end users. Keeping a whitelist of known keyboards and mice is really the only defence even on Linux, and unless you work in a data centre that’s probably way overkill. With a home PC that doesn’t really work though, because in order to authenticate your mouse without some kind of central mouse log on a server you probably need to click a button, which you can’t do…
There are dongles that only let power through: https://www.amazon.com/PortaPow-3rd-Data-Blocker-Pack/dp/B00... But it's a pain in the neck to always use them and difficult to enforce use in an enterprise setting.
I co-designed some transparent USB C ones for a client that are easy to audit.
Hope to take them to market some day.