Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WiFi Hides Inside a USB Cable

hackaday.com

Post reply on HN
Print view View original

91–100 of 159 posts

Re: WiFi Hides Inside a USB Cable

#91

Post by SlowRobotAhead »

cmroanirgo wrote: post #90
itissid wrote: post #3

This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this does for company's cybersecurity practices. A rogue janitor replaces the usb cables on some of the employees of a company that makes $INSERT_SUPER SECRET_TECH$ and done.

While I understand how this could've been fun to 'try out', I can think of nothing but ways that this can be seriously abused. (atm attacks, corporate spying, ...) Can a device like this be used do anything positive toward humanity? Did I misunderstand something? (I'm genuinely curious!) Edited: reworded (honest) question to be less negative.

>How does a device like this do anything but affect humanity in a negative way? How is the kind of 'research' remotely legal?

Here is some advice, whenever you think “there aught to be a law...” there probably shouldn’t be.

Planes would be falling out of the sky and high rises would be on fire if everyone had your sense of what types of research should “be allowed”.

Re: WiFi Hides Inside a USB Cable

#92

Post by SlowRobotAhead »

ars wrote: post #81
rhema wrote: post #28

Would a high voltage loop, for breaking components, be a good solution to an attack like this? Like, fry the electronic components to verify it's just plain metal on the insides?

A USB C cable has active electronics inside it, they are used to define the wire gauge on the conductors and the length of the cable.

Right. Also the Apple cords have an entire ARM micro in them for cable authentication.

Re: WiFi Hides Inside a USB Cable

#93

Post by strictnein »

Animats wrote: post #88

Naomi Wu reported on those last August.[1] There's one on Amazon that uses GSM, but it's 2G.[2] [1] https://twitter.com/realsexycyborg/status/103190315541447884... [2] https://www.amazon.com/Jiusion-Listening-Surveillance-Quad-b...

This is a couple levels past just a simple audio recording device.

It's a remote control rubber ducky and more.

Re: WiFi Hides Inside a USB Cable

#94

Post by wmf »

cheerlessbog wrote: post #83
DaiPlusPlus wrote: post #35

Earlier quoted context omitted.

On Windows XP this would display a “new device: keyboard connected” balloon and the Safely Remove Device icon would immediately set-off my spidersense - it’s unfortunate that newer releases of Windows hide those notifications by default and the only clue that something might be wrong would be hearing the generic device connected sound multiple times in quick succession which many users might think was their sound-car…

How would you approve the keyboard without using the keyboard? Anyway since we are assuming physical access, they could just swap out your keyboard for one that works normally until you go for lunch, then starts typing for itself..

The OS could display a random sequence of keys that you have to press to enable the keyboard. If the evil cable can't see the screen it wouldn't know what keys to transmit.

This is not a serious suggestion since it would be annoying to most people.

Re: WiFi Hides Inside a USB Cable

#95

Post by cmroanirgo »

SlowRobotAhead wrote: post #91
cmroanirgo wrote: post #90

Earlier quoted context omitted.

While I understand how this could've been fun to 'try out', I can think of nothing but ways that this can be seriously abused. (atm attacks, corporate spying, ...) Can a device like this be used do anything positive toward humanity? Did I misunderstand something? (I'm genuinely curious!) Edited: reworded (honest) question to be less negative.

>How does a device like this do anything but affect humanity in a negative way? How is the kind of 'research' remotely legal? Here is some advice, whenever you think “there aught to be a law...” there probably shouldn’t be. Planes would be falling out of the sky and high rises would be on fire if everyone had your sense of what types of research should “be allowed”.

> whenever you think “there aught to be a law...” there probably shouldn’t be

I actually totally agree (which is the reason for my edited response above, before your comment arrived)... but there must be limits, musn't there? We don't arbitarily allow murder, rape or theft.

Looking at the concept of "freedom" is a tricky thing, I've found. At what point does "doing whatever I want" become unacceptable to the very society that bred that behaviour? What should that society do to curtail behaviours that are actively destructive against it?

As an individual in society, shouldn't I make some stand (as feeble as it might be), against what I (personally) think as exceedingly disruptive and that goes against the "common good"?

By the downvotes I've received, it seems that my voice is very much unwanted - which seems to show how it "me" that is the outcast in this situation, and not this builder of spyware. To me this is ironic (but irrefutable), despite the honest question of the purpose of this device which has been popularised on a well known 'tinkering' site.

Re: WiFi Hides Inside a USB Cable

#96

Post by dtornabene »

crankylinuxuser wrote: post #76
tomatotomato37 wrote: post #72

Earlier quoted context omitted.

Completely out of scope of anything but superpower espionage, but that got me wondering if you could do something useful with a nanoscale mechanical computer built the same way they do those microchip gyroscopes. The simplest would be a mechanical timer for toggling power only when there's no countermeasure scan going on, but I wonder if there are other clever things you could do if you had a nationstate budget

Ive made and will be giving a talk on what a TSCM team would use. My talk was accepted at CircleCityCon in Indianapolis IN. I've built a tablet capable of intercepting and injecting radio from 20MHz to 1.5GHz. https://ccc2019cfp.busyconf.com/activities/5c3a57314808fac10... https://mobile.twitter.com/CrankyLinuxUser/status/1097884386... Repo: https://gitlab.com/crankylinuxuser/siginttablet

This is awesome and thanks for sharing it, do you know if the circle city con talks are going to be recorded? I'd love to see a walk through of this stuff

Re: WiFi Hides Inside a USB Cable

#97

Post by SlowRobotAhead »

cmroanirgo wrote: post #95
SlowRobotAhead wrote: post #91

Earlier quoted context omitted.

>How does a device like this do anything but affect humanity in a negative way? How is the kind of 'research' remotely legal? Here is some advice, whenever you think “there aught to be a law...” there probably shouldn’t be. Planes would be falling out of the sky and high rises would be on fire if everyone had your sense of what types of research should “be allowed”.

> whenever you think “there aught to be a law...” there probably shouldn’t be I actually totally agree (which is the reason for my edited response above, before your comment arrived)... but there must be limits, musn't there? We don't arbitarily allow murder, rape or theft. Looking at the concept of "freedom" is a tricky thing, I've found. At what point does "doing whatever I want" become unacceptable to the very soc…

I don’t know how to reply without being too snarky. Is your position that we shouldn’t “allow” someone to build a wifi module hidden in a USB cable, because we don’t allow rape and murder?

I’ll let someone else see if they can help you out. But I think you need to take a BIG step back and ask yourself this “have I solved all the problems in my own life” and if the answer is no, stop thinking so much about what other people should be “allowed” to do. Worry about self. Take up the position that my right to swing my fiat ends at your nose.

Re: WiFi Hides Inside a USB Cable

#98

Post by DaiPlusPlus »

cheerlessbog wrote: post #83
DaiPlusPlus wrote: post #35

Earlier quoted context omitted.

On Windows XP this would display a “new device: keyboard connected” balloon and the Safely Remove Device icon would immediately set-off my spidersense - it’s unfortunate that newer releases of Windows hide those notifications by default and the only clue that something might be wrong would be hearing the generic device connected sound multiple times in quick succession which many users might think was their sound-car…

How would you approve the keyboard without using the keyboard? Anyway since we are assuming physical access, they could just swap out your keyboard for one that works normally until you go for lunch, then starts typing for itself..

> How would you approve the keyboard without using the keyboard?

On laptops the built-in mouse and keyboard would be "trusted".

On desktops and servers, I can think of a couple of strategies:

* Always trust keyboards only when plugged into certain USB ports (e.g. ports on the front of the computer highly visible to the computer's operator) * Mutual keyboard/host authentication and encryption.

Re: WiFi Hides Inside a USB Cable

#99

Post by DaiPlusPlus »

wmf wrote: post #94
cheerlessbog wrote: post #83

Earlier quoted context omitted.

How would you approve the keyboard without using the keyboard? Anyway since we are assuming physical access, they could just swap out your keyboard for one that works normally until you go for lunch, then starts typing for itself..

The OS could display a random sequence of keys that you have to press to enable the keyboard. If the evil cable can't see the screen it wouldn't know what keys to transmit. This is not a serious suggestion since it would be annoying to most people.

No more annoying than Bluetooth pairing PINs or iOS's passcode-to-use-USB prompts. If the keyboard has secure stateful memory (e.g. for a client-certificate or client-secret) then the user would only have to enter it once.

Re: WiFi Hides Inside a USB Cable

#100

Post by cmroanirgo »

SlowRobotAhead wrote: post #97
cmroanirgo wrote: post #95

Earlier quoted context omitted.

> whenever you think “there aught to be a law...” there probably shouldn’t be I actually totally agree (which is the reason for my edited response above, before your comment arrived)... but there must be limits, musn't there? We don't arbitarily allow murder, rape or theft. Looking at the concept of "freedom" is a tricky thing, I've found. At what point does "doing whatever I want" become unacceptable to the very soc…

I don’t know how to reply without being too snarky. Is your position that we shouldn’t “allow” someone to build a wifi module hidden in a USB cable, because we don’t allow rape and murder? I’ll let someone else see if they can help you out. But I think you need to take a BIG step back and ask yourself this “have I solved all the problems in my own life” and if the answer is no, stop thinking so much about what other…

I think I've inadvertantly pressed some buttons, which I do apologise for - whole heartedly! The written language is a very imperfect thing to get right. I'm not trying to bait anyone in words.

Ironically, I do try to "let it be" and to not be a hypocrite in my day to day life. However, we are imperfect beings, and we all make mistakes (well, at least I do!).

I recognise the engineering and technical expertise of this device... but all through it's design phase and it's production, was there ever a purpose other than spyware? Was it ever meant to be anything other than nefarious?

For it's when someone can say to me "Oh, it's a really good thing because x,y,z" then I'll have learnt something new about the rich tapestry of life -- and I ask this because I don't understand, & not because I'm trying to lord it over anyone.

Again, apologies.

Post reply on HN