Live data from Hacker News

O.mg Cable

shop.hak5.org

331–340 of 555 posts

Re: O.mg Cable

#331

When Apple inevitably removes all physical ports from some future iteration of iPhone, I wonder if they’ll use the existence of tech like this to market the change as a benefit to security. I’m simultaneously impressed, curious and disturbed.

I still don't understand why they even have usb connection on Iphone. I have not attached a cable to it for years. Wireless charging, bluetooth headset, and all other bluetooth devices. Icloud backup as well as government spyware called CSAM never needed a cable.

I use the USB connection every day to do iOS development. A high bandwidth reliable wired link is a very nice thing to have for dev.

Re: O.mg Cable

#332
post #180

Earlier quoted context omitted.

I specifically don't recommend laptops that rely on USB C charging for applications where trust is critical -unless- they are running Linux with USBGuard or QubesOS. That said I did make transparent and easily auditable USB type C condoms for one client that really wanted to use USB type C laptops. Systems with security as a strong priority like the Librem 14 use barrel jacks for good reason. I am in fact implying th…

USB C charging happens well below the OS layer, using firmware that often isn't all that good. USBGuard or QubesOS won't help there (but will somewhat mitigate attacks trying to move up the stack)

The problem is not the charging. The problem is that a fake charger cable can run an HID attack over the +/- pins before it does a pass through to the power negotiation MCU for charging.

A tampered USB C to C cable on a conference room table can compromise people all day long.

If the USB C charge ports cut the data pins entirely then great, but I have not seen that be the case on any laptops yet.

Re: O.mg Cable

#333
post #44

See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…

> Windows and Mac users are currently easy targets. Not true, at least for iPhone / iPad users: - 1. Download Apple Configurator (free to anyone) - 2. Create new config profile - 3. Setup your device in "supervised" mode and apply said profile (the reason for this step is that the "best" config profile options are only available in supervised mode). Config profile items of interest include, but may not be limited to:…

If the USB device is not permitted to enumerate when the device is locked, then the payload just fires when enumeration happens after unlock.

You either ban USB devices entirely or you make users approve on every connection with no white listing.

Re: O.mg Cable

#334
post #138

Earlier quoted context omitted.

Check out AutoPi. Open source, plugs into your ODBII port so you can not only track your car but also get maintaince alerts etc.

> plugs into your ODBII port Which is usually quite easy to check. It's not a guarantee, but with someone sophisticated enough to crack a modern car there's a good possibility they know to check the OBDII slot.

They come with extension cables. You can always plug it in under the dash and leave the exposed one disconnected.

If they are sophisticated and have time to take the whole car apart then you are SOL anyway as they will find any transmitters with an SDR.

Re: O.mg Cable

#335

Earlier quoted context omitted.

Why is the NSA so good at coming up with sweet codenames for things? I swear it's someone's full time job there.

The real answer? Because these people are just like us, geeks, nerds, techies, early adopters. They are just the same people we live and work with. The film Enemy of the State (1998) was science fiction except with the parts where the techy operators were just normal nerds like us. That what was most scary part of the film not the (at the time fantastic) surveillance.

Maybe they are like you, but they are definitely not like me.

Re: O.mg Cable

#336
post #44

See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…

Read the reviews on the GPS tracking charger... either the people who bought it couldn't figure out how to use it, or its another scam product from china we see flooding amazon.

When we audited it as best we could tell it was phoning home to some central Chinese server if you put a sim in it.

So spy tools that spy on the spys.

It is sketchy as all hell and should not be sold.

That said this stuff pops up everywhere.

I just cite it as examples.

Re: O.mg Cable

#337

Earlier quoted context omitted.

You are commenting on a forum full of people who build tools and technology for facebook and google and probably palintir and a thousand other facial recognition and thoughtcrime style systems.

Sure, Facebook and Google are pretty evil organisations but they can never match the scope of surveillance of governmental agencies. Facebook and Google need the user to use their services and they say (despite the message being in legalese) what they're going to track. There is consent involved in these organisations, it's a voluntary transaction. The government can (and did) just intrude on everything without conse…

In theory, yes. In practice, if you'll try to avoid any interaction with sites affiliated with Google, Facebook or feeding surveillance data to them, you'll quickly discover that the internet became very small and much less usable than before. You don't need to use Facebook or search on Google to be tracked by them. Google owns one of the largest ad networks in existence, so if you visit any site that has ads or analytics trackers, the data about it will go to Google. Any site featuring Facebook social button may feed the data to Facebook. If you write to somebody with @gmail address Google knows about it. And so on, and so forth. For a highly technically skilled person, it might be possible to avoid interactions with Big Tech while being able to still using modern technology, but it won't be easy. For a normal person without deep technical background it's pretty much hopeless unless they avoid using the internet entirely. Of course, using the internet is "voluntary", but this is a very weak consolation.

And, also, both Google and Facebook eagerly cooperate with state actors in censorship and other aspects - likely surveillance too. So there's not much difference in that aspect whether you work for the government directly or for somebody who takes marching orders from the government while being formally independent.

Re: O.mg Cable

#339
post #150

Earlier quoted context omitted.

Whitelists don't work. As an attacker I just have the bootloaders of my malicious devices advertize the USB IDs of whitelisted devices like Apple Keyboards. The computer has no way of knowing it is not authentic. There is no signing or certification for USB devices. The only solution is a kernel that can place all newly attached USB devices in a queue for manual approval. This is what USBGuard and QubesOS both do. Th…

> It means no one can drive by plug something in when your computer is locked. You will get a popup asking if you want to give some device other than the keyboard you booted with access to behave as a keyboard . Makes me think, what would happen if I plugged this cable, unplugged the keyboard, and power-cycled the computer? Or do a hard power down, then the switcheroo, and then power up? Would USBGuard/QubesOS block…

If you rebooted my computer you would be greeted with a full disk decryption prompt which requires a smartcard and a pin to unlock.

It won't go unnoticed.

If your computer can reboot itself for updates that should be a cause for concern as it means your FDE is being cached somewhere that can use it unattended. I don't allow such things personally.

You do have to check for any untrusted USB devices at boot on a desktop. No getting around that one as you need to be able to use input devices at boot. Best bet is a PS/2 keyboard but those are getting harder to find.

For a laptop you have a better story as you can trust the internal PS/2 keyboard/mouse then use that to approve USB things fresh as needed and dictate what applications they get access to.

I connect my USB webcam to the one VM that needs it on demand, for instance.

Re: O.mg Cable

#340
post #93

Earlier quoted context omitted.

It’s not really practical to defend against for most end users. Keeping a whitelist of known keyboards and mice is really the only defence even on Linux, and unless you work in a data centre that’s probably way overkill. With a home PC that doesn’t really work though, because in order to authenticate your mouse without some kind of central mouse log on a server you probably need to click a button, which you can’t do…

There are dongles that only let power through: https://www.amazon.com/PortaPow-3rd-Data-Blocker-Pack/dp/B00... But it's a pain in the neck to always use them and difficult to enforce use in an enterprise setting.

And there are people who have disguised badusb attacks as those dongles. Works every time.

I co-designed some transparent USB C ones for a client that are easy to audit.

Hope to take them to market some day.

Post reply on HN