Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We X-Rayed a Suspicious FTDI USB Cable

eclypsium.com

Post reply on HN
Print view View original

81–88 of 88 posts

Re: We X-Rayed a Suspicious FTDI USB Cable

#81

Post by ChrisMarshallNY »

jamesy0ung wrote: post #80
HPsquared wrote: post #68

Earlier quoted context omitted.

It'd be a cool physical demonstration at a cybersecurity roadshow. A concern: with all this computing onboard, does this mean a malicious USB-C cable could record screen and keystroke? Often the keyboard receiver is plugged into the monitor's USB hub and so screen and HID are both going along a single cable ... Which also does power delivery. Such cables are a definite "sales category" and could be a target for suppl…

I doubt you are going to fit a chip fast enough to snoop Thunderbolt traffic inside of a usb-c plug

Today, but maybe not much longer.

It is possible that the tech exists, but isn't yet at a point that it can be easily mass-produced, which means "spy cables" may actually be available, from Q-types.

Re: We X-Rayed a Suspicious FTDI USB Cable

#82

Post by araes »

amarant wrote: post #44
ChrisMarshallNY wrote: post #21

To be fair, this story is basically an ad, but a pretty good one, and many featured HN stories are really marketing. Personally, I don’t mind marketing stuff, if it’s interesting and relevant (like this). But the fact that most comms cables, these days, have integrated chips, makes for a dangerous trust landscape. That’s something that we’ve known for quite some time. BTW: I “got it right,” but not because of the che…

I also got it right, but for the entirely wrong reasons! I assumed the "suspicious" cable was a spy cable, and then guessed that the bigger integrated circuit was probably responsible for doing secret spy stuff, while the smaller circuit up top was all that was needed for ordinary cable work. Turns out the cables do basically the same thing (no fancy spying!), and one is just cheaper.

Similar reasoning, don't know if it's "wrong" reasoning.

The large chip looks like it's purposely placed to intercept every single incoming signal, and then route them through afterward. Just because they're "experts" does not mean they notice issues that a "naive" observer might have noticed. Get lost in the trees.

It looks like a big chip for doing "secret spy stuff".

Re: We X-Rayed a Suspicious FTDI USB Cable

#83

Post by sandworm101 »

dotancohen wrote: post #58
sandworm101 wrote: post #49

Earlier quoted context omitted.

That tangle is not strain relief. Those wires are buried in injection-molded plastic. Pull on them and those loops will not stretch as they are in solid plastic. What they will do is potentially result in unwanted cross-talk between wires as loops start acting as antennas.

Thank you. If I may, is injection molded plastic not solid plastic? To many potential voids?

It is solid, which is why the wires cannot move. Molding the thing as one unit overtop the electronics is cheaper than making many parts to clamp over them as a box. A solid block is also generally better for strength and thermal.

Re: We X-Rayed a Suspicious FTDI USB Cable

#84

Post by phatskat »

baby_souffle wrote: post #24
mschuster91 wrote: post #11

Earlier quoted context omitted.

> I want to make a persistent implant/malware that survives OS reinstalls. You want to look into something called "Windows Platform Binary Table" [1]. Figure out a way to reflash the BIOS or the UEFI firmware for your target device ad-hoc and there you have your implant. [1] https://news.ycombinator.com/item?id=19800807

> You want to look into something called "Windows Platform Binary Table" [1]. Is this how various motherboard manufacturers are embedding their system control software? I was helping a family friend with some computer issues and we could not figure out where the `armoury-crate` (asus software for controlling RGB leds on motherboard :() program kept coming from

Have your friend grab https://github.com/seerge/g-helper which can disable armory crate. It’s also a lot lighter on your system - I was having constant gradual frame drops (games would start find and performance would slowly degrade) until I tried this and used the option to disable the AC processes.

Re: We X-Rayed a Suspicious FTDI USB Cable

#85

Post by pseudohadamard »

Yoric wrote: post #57
DeathArrow wrote: post #53

Earlier quoted context omitted.

Probably there is someone somewhere trying to make Linux boot on a thunderbolt cable.

Or Doom.

Was going to say the same thing. With way more processing power you could output the video over USB-C/TB at one end and connect a keyboard at the other.

Re: We X-Rayed a Suspicious FTDI USB Cable

#86

Post by krater23 »

hex4def6 wrote: post #63

I'm failing to see the smoking gun here. There are two ways you could interpret "counterfeit". 1. Fake IC (identifies as FTDI 232 IC), fake cable (FTDI logo on it) 2. Real IC, fake cable (eg, I buy the FTDI IC and make the cable, and sell it as an "official" FTDI cable). (1) is I assume what they mean in this instance., but you could argue (2) is also possible. However, they make no mention of the packaging both call…

They only wanted to say 'Hey look, we have borrowed a x-ray mashine'

Re: We X-Rayed a Suspicious FTDI USB Cable

#87

Post by wolrah »

HPsquared wrote: post #68
nkrisc wrote: post #61

Earlier quoted context omitted.

It would be a pretty amusing demonstration to plug in the cable to a display, then pretend to plug the other end into an imaginary computer sitting nearby and have something boot up on the display.

It'd be a cool physical demonstration at a cybersecurity roadshow. A concern: with all this computing onboard, does this mean a malicious USB-C cable could record screen and keystroke? Often the keyboard receiver is plugged into the monitor's USB hub and so screen and HID are both going along a single cable ... Which also does power delivery. Such cables are a definite "sales category" and could be a target for suppl…

> A concern: with all this computing onboard, does this mean a malicious USB-C cable could record screen and keystroke?

Keystrokes: Easily. At least for USB 3 and 4, USB 1/2 data is a physically separate channel that just happens to almost always be packaged alongside the faster stuff, so the lower speed stuff like input devices is easy to intercept. I don't know if Thunderbolt does the same or not, normally USB-C alternate modes still keep the USB 2.0 signals available but Thunderbolt might be an exception.

Screen: Probably not modern video modes in a purely stealthy cable formfactor *YET*, at least not using COTS parts, but it wouldn't surprise me to find the secret squirrel types either already have it or are working on it.

Post reply on HN