71–80 of 159 posts
Earlier quoted context omitted.
Perhaps, but it could start a fire. You might consider plugging into a power supply and measuring if there is any current draw.
USB type A male-to-female inline ammeters are really cheap, and accurate to 0.1W. I got one for ten bucks.
Earlier quoted context omitted.
In secure locations it's common for USB ports to be physically blocked (the ones I've seen with glue/resin).
In super secure locations like a SCIF, a TSCM (technical surveillance countermeasures) team comes through on a regular basis with highly sensitive, expensive portable spectrum analyzers, which would find this really quick.
Earlier quoted context omitted.
In secure locations it's common for USB ports to be physically blocked (the ones I've seen with glue/resin).
In super secure locations like a SCIF, a TSCM (technical surveillance countermeasures) team comes through on a regular basis with highly sensitive, expensive portable spectrum analyzers, which would find this really quick.
Earlier quoted context omitted.
USB type A male-to-female inline ammeters are really cheap, and accurate to 0.1W. I got one for ten bucks.
How do you know THAT doesn’t have a surveillance device inside?
This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this does for company's cybersecurity practices. A rogue janitor replaces the usb cables on some of the employees of a company that makes $INSERT_SUPER SECRET_TECH$ and done.
>I mean someone can just replace the cables in my house and my phones and computer would become infected. Only if you leave your computer unlocked and unattended. If it's attended, obviously you'll see something's going on and pull the plug on the computer and probably investigate further. If your computer is locked (which is a good habit to have when leaving your workstation, the faked keyboard can't do.
I think OP is saying that these cables could be swapped out while you’re away.
As for “seeing that something is going on”, I really don’t think anyone worth half their salt would allow for such a scenario... authors of such implants aren’t exactly registering the device with the OS.
Earlier quoted context omitted.
In super secure locations like a SCIF, a TSCM (technical surveillance countermeasures) team comes through on a regular basis with highly sensitive, expensive portable spectrum analyzers, which would find this really quick.
Completely out of scope of anything but superpower espionage, but that got me wondering if you could do something useful with a nanoscale mechanical computer built the same way they do those microchip gyroscopes. The simplest would be a mechanical timer for toggling power only when there's no countermeasure scan going on, but I wonder if there are other clever things you could do if you had a nationstate budget
My talk was accepted at CircleCityCon in Indianapolis IN. I've built a tablet capable of intercepting and injecting radio from 20MHz to 1.5GHz.
https://ccc2019cfp.busyconf.com/activities/5c3a57314808fac10...
https://mobile.twitter.com/CrankyLinuxUser/status/1097884386...
Earlier quoted context omitted.
So they have to be close by.
https://www.simplewifi.com/products/parabolic-grid "2.4Ghz wifi antenna extends a 7 degree wide cone, allowing it to perform over large distances up to 8 miles of range."
It’s just crazy to me that plugging my Crapbook Pro into a USB-C power brick could do all sorts of bad to my computer when all I need is power.
Can someone confirm for me? This needs a nearby wifi network that is either open or has credentials too, correct? The video appeared to have it connect directly to the phone or to the network they both were on.
It looks like this hack uses an esp8266, which supports WiFi. Most likely the chip is booting up its own WiFi network for the phone to connect to, the phone is sending the payload over this network, and running the usb exploit. Some esp family chips should also support Bluetooth.
If you can do this for kicks, imagine what you can do with a budget.
It's basically what the NSA's ANT catalogue had in their COTTONMOUTH devices, among others [1] [1]: https://en.wikipedia.org/wiki/NSA_ANT_catalog