I wonder what happens if you fly with one of these.
I would expect nothing, because the security we put ourselves through is nowhere close to sophisticated enough to notice.
O.mg Cable
91–100 of 555 posts
Re: O.mg Cable
#92Earlier quoted context omitted.
That level of miniaturization is far older than Apple's removal of the iPhone headphone jack in 2016, but the related lightning-to-audio jack dongle had a microcontroller with a DAC inside that you'd never think existed due to the form factor.
The Lightning-to-HDMI adapter is also an insane miniaturization. It runs a (very) stripped down version of iOS/darwin (not sure what apple counts it as) that is loaded in about a second when you plug in the phone, establishes a network connection, and streams compressed video frames over the network over USB to the HDMI. That's why when you use the iPhone HDMI adapter, everything looks a little bit compressed. Becaus…
I didn’t know about this! Thank you. Truly nuts:
https://hackaday.com/2019/07/30/apple-lightning-video-adapto...
Re: O.mg Cable
#93See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…
Windows and Mac users are currently easy targets. I don't know of any good defenses there. It's crazy to me that this is true. Does the government pay Microsoft and Apple to keep it this way, or are they just negligent?
It’s not really practical to defend against for most end users.
Keeping a whitelist of known keyboards and mice is really the only defence even on Linux, and unless you work in a data centre that’s probably way overkill.
With a home PC that doesn’t really work though, because in order to authenticate your mouse without some kind of central mouse log on a server you probably need to click a button, which you can’t do without authenticating your mouse.
Re: O.mg Cable
#94Wow! Is the trick that we now have powerful microcomputers small enough to fit into a USB plug? That's pretty incredible technology. How many years ago did this become possible? My IT security training is dated, I am aware of the risks of plugging in a random USB key, but just a cable from a helpful "coworker"? Yikes.
There is already an Arm Cortex M0+ in the end of every USB type C cable for power negotiation. It has a complex codebase and firmware update methods to migrate to new USB specs. Cheap cables don't even support signing so go to town tampering with stock cables if you are so inclined. Also an Attiny85 can fit inside just about anything. My favorite BadUSB hello world is using the Arduino HID library to make a Digispark…
> There is already an Arm Cortex M0+ in the end of every USB type C cable for power negotiation.
Only some of the Type-C cables. Normal 3A ones don't have anything like this.
Re: O.mg Cable
#95See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…
With growing car theft in the US I've been curious about implanting GPS trackers on my own older enthusiast vehicles. There appears to be many options on Amazon but I can't bring myself to trust any of them. Has anyone here gone down that road before?
Re: O.mg Cable
#96Earlier quoted context omitted.
IIRC the funny thing is, the system that provides the codenames is random in order for the system to not leak information about what the code name is for. But since there's no limit to how many times you can request a code name, the system is being abused and users try until they get a good one.
What was the codename for the project to create that system?
Probably “Project Phoenix”.
If you ask any project team to come up with a project name they will probably pick ‘Project Phoenix’.
Re: O.mg Cable
#97Earlier quoted context omitted.
That’s...not what parent typed. Use whatever keyboard you like, but you’ll only get E2EE with an Apple keyboard.
The cable claims that it's a random 3rd party keyboard when it talks to the Mac, the cable claims it's a random non Apple device when it talks to the keyboard, the keyboard falls back to non-encrypted mode as it's not on a product that supports it. Man in the middle is hard to prevent when you need to be compatible with incredibly broken insecure legacy protocols. Apple could maybe go the route that all new Apple key…
I guess the MITM attack could be mitigated in the OS by showing an "encrypted keyboard connection" UI indicator of sorts. Assuming the MITM hardware doesn't exploit a vulnerability in the OS to incorrectly show that indicator. ;)
Re: O.mg Cable
#98Earlier quoted context omitted.
It’s a copy of the NSA ANT Coppermouth cables. That was part of the Snowden leak, so it’s been possible since at least then (the doc itself is circa 2008) if you have a three-letter name and a national security black budget. https://en.m.wikipedia.org/wiki/NSA_ANT_catalog
Why is the NSA so good at coming up with sweet codenames for things? I swear it's someone's full time job there.
Coppermouth is just a combination of two American venomous snakes: the copperhead and the cottonmouth.
Re: O.mg Cable
#99hak5!!!
Such a classic tech podcast. So cool to see them still around.
Re: O.mg Cable
#100See also: C-to-C charger cables with Bluetooth remote activated dual payloads: https://sneaktechnology.com/product/usbninja-custom-type-c-t... I easily modified mine to mimmic Apple Keyboard USB IDs to avoid notifications. Works great! Cellular GPS tracking car charger: https://www.amazon.com/Charger-Locator-Professional-Listenin... Cellular GPS tracking USB charger cable: https://www.ebay.com/itm/223990414124 I have…
When USB came out I was working in the defence sector. We closed the vector off with cages for the PCs with tied looms under desks, epoxy in all the holes we didn’t want people to use and with threat of being in deep shit.
My school had a way to keep peripherals from wandering off, but if all you need to do is swap the cables then I’m not sure that would still work. Wrapping the cables into a wiring loom makes that process slower, assuming the loom is complicated enough. Did you ever use heat shrink? Or locking cable ties?
What the school did was run a steel cable behind the desks, then put a loop of the mouse chord through a steel washer and ran the security cable through all the loops. If you secure both ends you can’t get the cables separated even with slack.
The trick is that the hole in the washer had to be smaller than the connector so you couldn’t fish it back through no matter how much slack you get. That could still work for USB-A, but these days the connectors are getting smaller than the diameter of curvature of the cable, so you’d break it trying to do this. And on many peripherals you could destroy the chord without reducing the value of the device. One could cut the cable and install this Trojan one on many devices these days, the only telltale would be that the cable isn’t routed properly, which might be harder to notice immediately.