lucideer · 4 years ago

Not sure about GPS but it includes remote access via WiFi, and some of the cables on offer quote "Long Range WiFi (2 KM+)"

cbg0 · 4 years ago

Are they really breaking into your car just to steal your USB cable or is there other stuff you leave in plain sight?

voiper1 · 4 years ago

Sounds like now you should be worried if they "leave" your iPhone USB cable, they might have switched it with one that hacks you.

PeterisP · 4 years ago

Do you mean something like this - https://www.aliexpress.com/item/1005001759023561.html ? You'd just have to look for a version with the proper connector that you need, that particular example is microUSB but there are similar cables for iPhone.

baybal2 · 4 years ago

I think you need to consider an armoured Mercedes

fragmede · 4 years ago

That level of miniaturization is far older than Apple's removal of the iPhone headphone jack in 2016, but the related lightning-to-audio jack dongle had a microcontroller with a DAC inside that you'd never think existed due to the form factor.

NamTaf · 4 years ago

It’s a copy of the NSA ANT Coppermouth cables. That was part of the Snowden leak, so it’s been possible since at least then (the doc itself is circa 2008) if you have a three-letter name and a national security black budget.

https://en.m.wikipedia.org/wiki/NSA_ANT_catalog

dylan604 · 4 years ago

In the leaks that happened around the time of Snowden's revelations, there were DVI/monitor cables that had transmitters that would broadcast the decrypted signal so that someone with the receiver nearby could "share" the screen. No software installed for security software to find. Just a cable that could be installed by the cleaning crew after hours.

moonchild · 4 years ago

See also http://tomu.im/.

5faulker · 4 years ago

Seems to be very tech-involved though.

lrvick · 4 years ago

There is already an Arm Cortex M0+ in the end of every USB type C cable for power negotiation.

It has a complex codebase and firmware update methods to migrate to new USB specs. Cheap cables don't even support signing so go to town tampering with stock cables if you are so inclined.

Also an Attiny85 can fit inside just about anything.

My favorite BadUSB hello world is using the Arduino HID library to make a Digispark toggle caps lock randomly with maybe 10 lines of code. Drives people nuts.

city41 · 4 years ago

On a similar note, as I understand it skimmers placed on ATM machines and the like are now so small they are almost impossible to detect.

kybernetikos · 4 years ago

> How many years ago did this become possible?

I don't know, but I do know that back in 2013 you could get an ARM computer running linux and a webserver with wifi and 16Gb storage in a space the size of an SD card. That is still a bit too big to fit inside a USB plug without being obvious, but not by much. https://hackaday.com/2013/08/12/hacking-transcend-wifi-sd-ca...

Fitting the electronics inside the usb plug itself has been used for years in slimline usb memory sticks and in tiny readers for micro-sd too.

I expect that this has been possible for nearly 10 years, but maybe just not commercially viable for consumers for most of that.

baybal2 · 4 years ago

> now have powerful microcomputers small enough to fit into a USB plug

Like 20 years ago? 32 bit micros were actually not that far behind low end CPUs until they start to fall off dramatically in the 90, and post-90nm age because perf was good enough.

After nineties, CPU improvements were guided as much by software getting worse, slower, and more shoddily written, than genuine need for more raw computing power.

janekm · 4 years ago

Not just the microcontroller but also the wifi radio and antenna... But a USB-A socket is pretty big anyway. This isn't too different from the tiny wireless mouse dongles that have been around for a few decades.

andai · 4 years ago

In 2008 we had USB flash drives which extended only two millimeters beyond the laptop when you plugged them in, and Wifi dongles in the same form factor.

ttul · 4 years ago

I’m kind of surprised that Apple doesn’t encrypt keystrokes between its keyboards and the host machine, given than they have the capability to enable the keyboard to authenticate the host using PKI.

Maybe this is on their todo list.

fragmede · 4 years ago

The boot rom of iPhone 8 and older have a publicly known exploit. If you plugged your phone in to charge, and then it spontaneously rebooted, how much forensic digging could you actually do?

How much are you willing to bet that there's not a private exploit against newer iPhones? Not in terms of dollars, but in terms of private data that Apple's iPhone that you're renting from them has access to.

VenTatsu · 4 years ago

These are more general purpose than just those attacks, the author of the firmware has demo videos of cables attached to Android and iOS devices that when the payload runs they open the system browser and loads a specific page. Depending on what you can do with a web page at any given time on those devices it could be a springboard.

You could also do some passive/active data gathering. On Windows when you plug in an iOS device, if the device trusts the computer it will allow it to access all the photos and videos on the device. The cable it self could then start grabbing those images and sending them over the WiFi link. I don't know if these cables support that, but the concept is valid.

SavantIdiot · 4 years ago

Hak5 makes some great stuff, but yeah: how hard would it be to swap the vote counters USB sticks with Hak5 BashBunnies loaded with exfiltration software if their protocols suck to begin with? I really hope there are root of trust procedures.

mhh__ · 4 years ago

The only true defense is a paper and pencil (why pencil: Disappearing ink).

fredley · 4 years ago

They sell a programmer for it, so probably!

VenTatsu · 4 years ago

The product pages mention custom payloads, in some of the images it looks like some variant of the DuckyScript used in some of the other hak5 products. It likely depends on if what you want to do is supported or if it would need changes to the firmware to accomplish.

Natsu · 4 years ago

You can get pictures if you enable scripts for a couple of shopify domains, but it just looks like an ordinary USB cable, which is kind of the point.

moron4hire · 4 years ago

How is that ironic? Seems more in-character. Selling a device to steal data, they also extract data from whomever is visiting the site.

foxfluff · 4 years ago

It threw a modal at me after enabling scripts and scrolling a bit. Yeah, not reading further.

hoppla · 4 years ago

I bought something from them once, and they shared my email address with Facebook to do targeted advertising - that was not something I expected they would do.

Arrath · 4 years ago

Mine is too, I can only come up with prank ideas.

I do wonder how thoroughly they vet their customers, and what silly things I could get up to with one.

rkagerer · 4 years ago

Couple legitimate uses could be to test a driver or "port mirror" for debugging. (It does more than just keylog... eg. logs raw HID reports)

yreg · 4 years ago

I'd be afraid to prank someone with a tool like this. It seems like it would be easy to unintentionally hack said friend or at least make them believe that you might have hacked them.

hughrr · 4 years ago

When USB came out I was working in the defence sector. We closed the vector off with cages for the PCs with tied looms under desks, epoxy in all the holes we didn’t want people to use and with threat of being in deep shit.

e40 · 4 years ago

Windows and Mac users are currently easy targets. I don't know of any good defenses there.

It's crazy to me that this is true. Does the government pay Microsoft and Apple to keep it this way, or are they just negligent?

tubbs · 4 years ago

With growing car theft in the US I've been curious about implanting GPS trackers on my own older enthusiast vehicles. There appears to be many options on Amazon but I can't bring myself to trust any of them. Has anyone here gone down that road before?

lostmsu · 4 years ago

Am I missing something? The worst thing the cable can do is send HID commands, and snoop on traffic between your USB-connectable device and PC?

pa7ch · 4 years ago

Curious if chromeOS does anything special here to mitigate usb attacks.

Hacktek · 4 years ago

$600, 3 meter range. wtf? How is OMG Cable able to be so much cheaper and get so much more range?

SavantIdiot · 4 years ago

Read the reviews on the GPS tracking charger... either the people who bought it couldn't figure out how to use it, or its another scam product from china we see flooding amazon.

traceroute66 · 4 years ago

> Windows and Mac users are currently easy targets.

Not true, at least for iPhone / iPad users:

   - 1. Download Apple Configurator (free to anyone)
   - 2. Create new config profile
   - 3. Setup your device in "supervised" mode and apply said profile (the reason for this step is that the "best" config profile options are only available in supervised mode).

   - "Allow USB accessories while device is locked"
   - "Allow pairing with non-configurator hosts"
   - "Allow putting into recovery mode from an unpaired device"

kortex · 4 years ago

Challenge accepted. Any time you have physical access (especially HID), you have the potential for exploits.

I couldn't find much for parallel port hax (in 5 min googling), but I'm sure it's been done. Probably too old to be documented on the shallow web.

https://www.quora.com/Can-a-computer-be-hacked-through-a-PS-...

SavantIdiot · 4 years ago

That's because it isn't a cable, it is a computer.

In the 1980's I worked with CAD/CAM software that required hardware dongles on parallel ports as an anti-piracy measure. That probably could have been exploitable: e.g., instead of returning the security response, cram a ton of data and cause buffer overrun on their 80286 + DOS5 application and smash the stack. It would be fun to go back in time and see just how vulnerable that software was.

folmar · 4 years ago

Sure it can. In the golden days of parport we've used parallel port device autodetection based on Device ID. There was a lot of place in the plug to use for a microcontroller in the end of the parport times.

lrvick · 4 years ago

I can assure you keyloggers still work very well at most major companies.

Maybe in a couple more decades they will have begun to use basic defenses already available.

andix · 4 years ago

Even if 2FA prevents you from logging in, you still get A LOT of information from a keylogger.

You know the content of all the emails this user writes. You know the websites they visit. Based on the 2FA auth key they use, you may find out what kind of system it is.

A great start for social engineering. The target user writes an email to someone and the day afterwards you can fake call them and pretend to be the recipient of the email (you have all the information). If you're lucky they wrote an email to management and now you can pass orders in this call.

kag0 · 4 years ago

Totally unrelated to this cable, but since you mention it...

I've been trying to build web/single page applications using new ES modules and no build tool, so all dependencies are pulled from their creator/CDN rather than bundled locally. Would this set off flags for a no-script user?

shadilay · 4 years ago

Is that USB-PD compatible?

OJFord · 4 years ago

I would expect nothing, because the security we put ourselves through is nowhere close to sophisticated enough to notice.

StrLght · 4 years ago

Most likely nothing in most countries. At least that's what my experience was with something way more suspicious – pouch with a lead layer, I use it for transporting film so it won't get damaged by xrays. Around 60% of the times no-one even says anything about it despite the bag looking like a huge square on their screens.

I don't think transport security people would care about any small tech stuff until something happens inflight because of it.

nebula8804 · 4 years ago

Was very fortunate to meet Darren, Shannon, and Patrick Norton at Defcon in 2019.

It was surreal to see them and even though I probably acted all nervous around them (still kinda had a crush on Shannon even after all these years) they were beyond nice and friendly.

They were super busy selling their kits (these OMG cables were being sold unofficially as well lol) but they took the time to chat about the history of Hak5(TechTV in the case of Patrick) and to take pics. All around a superb bunch of folks.

Its crazy to think they have been doing Hak5 for like what 15-16 years now?! So many great memories all thanks to their hard work.

fredley · 4 years ago

Buy your own cables, and as you unwrap them, secure a tamper seal around them in some way. Commit the tamper seal codes to memory. Only then can you be absolutely sure.

etskinner · 4 years ago

You could do that, but then you'd need to forgo USB Power Delivery, Qualcomm quick charging, etc.

One thing I've heard other comments mention here is a USB condom (USB data blocker). It's just a male to female adapter with only the power lines patched through, not data lines.

judge2020 · 4 years ago

I can't find any on Google that specifically are made without the data lane. Maybe these magnetic ones don't do data[0]. Could also try burning the data lanes on the lightning part of the cable[0] (although you might have issues if it's a lightning-to-C cable, I would guess it uses the data lanes for power negotiation).

0: https://www.alibaba.com/product-detail/3-in-1-cable-led-ligh...

1: https://nyansatan.github.io/lightning/

not1ofU · 4 years ago

Somethink like this, it is adapter with data lanes removed, for charging in public places. There are other tools like the ones listed on the hak5 site also. https://maltronics.com/products/usb-protector The guy running the site also has a youtube channel focused on security related tech news https://www.youtube.com/c/Seytonic/featured.

knodi123 · 4 years ago

That's the port that Square uses for transmitting data. ;-)

https://stackoverflow.com/questions/2181476/bandwidth-from-h...

rmdashrfstar · 4 years ago

Ignorance is bliss

clb92 · 4 years ago

Wait until you learn that some phones have serial access through the headphone jack.[1][2] I don't know much about it yet, but I assume it can be exploited in some way, under some circumstances.

[1] DOWN THE RABBIT HOLE AND BACK OUT AGAIN: SERIAL OVER HEADPHONE JACK https://hackaday.com/2016/10/21/down-the-rabbit-hole-and-bac...

[2] A better audio jack console cable for Google Nexus devices http://www.pabr.org/consolejack/consolejack.en.html

rout39574 · 4 years ago

I think you are missing nothing.

SavantIdiot · 4 years ago

I have a number of hak5 products to see what they fuss is about and to learn what kinds of attacks to worry about being used on me! In some cases they are not really usable anymore, like the WiFiPineapple, which is largely useless due to WPA2 being ubiquitous (yes, you can hack WPA2 but I don't feel like paying for a ton of AWS lamda functions to get on my neighbors wifi). They teach you about how things work from an entirely different point of view. BashBunny is my favorite and it still works, but who plugs in random USB sticks these days? I've never used it but I learned a lot more about USB!

sophacles · 4 years ago

The same people that buy lockpicks buy these:

* enthusiasts

* professional security people (blue team, pentesters)

* criminals

in the last 2 cases, they buy them because it's cheaper than making it themself.

WaitWaitWha · 4 years ago

Yes, penetration testers, red teams, blue teams, auditors, and a myriad of other security conscious roles take advantage of these tools.

> What prevents a malicious actor from buying and using these tools?

Nothing.

What prevents any actor from buying <insert any items here> and using it maliciously? A significantly deeper question. I rather promote this.

burnished · 4 years ago

I think the only thing you are missing is that most people most of the time don't want to hurt or bother others and that much of society functioning relies on this.

Cause nothing stopping you from buying any of that, at what looks like very reasonable rates.

agitator · 4 years ago

If anything, by making devices like this accessible to the public, the end result is safer devices for everyone.

Without products like this you have criminals, a small amount of enthusiasts/researchers, and government sponsored actors exploiting vulnerabilities. If you put it out in the open, much like open source software, everyone can do it, but there's more pressure to fix blatant vulnerabilities.

ShakataGaNai · 4 years ago

Hak5 isn't breaking any new grounds with their technology. They just make it a little easier to get/use and a little sleeker. Can someone abuse this? Sure. People misuse all sorts of handy tools all the time. Knives? Staplers? 2x4s? Hammers? All have been used to kill people - doesn't make them inherently bad.

The difference is most people know about those other things and don't know about the things that hak5 sells. They don't even know it's possible, let alone it exists and is usable.

Recently the lock picking lawyer got a USB drive lock in the mail and while he picked the lock, he refused the plug in the drive. People mocked him saying that he was silly for not simply plugging in the drive into a VM or special purpose computer. The next time around he brought out a USB Killer. https://www.youtube.com/watch?v=ctByXhte_-A ex: https://usbkill.com/ .

If you don't know a random cable or USB drive can be dangerous, you're likely to be the person who picks one up off the ground and uses it. Or worse, see one sitting unattended in a coffee shop or airport and decide you need a quick boost.

What's being sold is educational just as it is dangerous. Terrible people are going to find a way to do terrible things. The least you can do is educate yourself to make it harder for them.

lrvick · 4 years ago

I buy this stuff, but I run a security consulting company.

I also make my own stuff like this from time to time. A lot of it is pretty easy. I could teach a class of people to make a badusb device from scratch, code and all, in an hour. Any USB capable microcontroller will do. Should we ban those too?

Bad actors have had more sophisticated hardware at their disposal for decades.

Just look at teardowns of credit card skimmers.

Hak5 is not helping those people. They are helping white hats catch up and helping spread awareness how easy this stuff is.

While your mind is adjusting to this, I encourage you to put "crown vic fleet keys" in Amazon and buy yourself keys to the police cars in your area.

The global state of security is a joke and we need people helping onboard whitehats to help teach people to do better.

fortran77 · 4 years ago

Judging from the people who I see at DEFCON who follow the "Hak5" people, it's mostly kids and not professionals.

ryanSrich · 4 years ago

I run a company that builds security awareness training software. While we don’t do any hands on hardcore stuff that this hardware would be used for, I still have an interest in keeping up with it, understanding it, and working that understanding into our training curriculums.

system2 · 4 years ago

I still don't understand why they even have usb connection on Iphone. I have not attached a cable to it for years. Wireless charging, bluetooth headset, and all other bluetooth devices. Icloud backup as well as government spyware called CSAM never needed a cable.

saltyfamiliar · 4 years ago

Would they really need many resources to take legal action? What you're describing is illegal. They could simply call the police if they found you out.

prox · 4 years ago

That would be shooting yourself in the foot really. Hackers hacking hackers?

coding123 · 4 years ago

Yes I had that thought too. However I was glad to learn of it's existence so at least I know what is scarily possible.

blondin · 4 years ago

yep.

chrome is now showing me a new "you added this to your cart" feature on my new tab page. it says i have added that product to my "cart".

that page is obviously doing something but i can't say anything evil.

8fingerlouie · 4 years ago

Hak5 is legitimate. They sell all kinds of pentesting equipment, and most of it is good. It's mostly just small ARM linux "boxes" with some Bash scripts on top, though things like the WiFi Pineapple will (attempt) to break wifi passwords for you (https://shop.hak5.org/collections/sale/products/wifi-pineapp...)

For lack of a better use (just a hobby for me), i use a Screen Crap (https://shop.hak5.org/collections/sale/products/screen-crab) along with a Key Croc (https://shop.hak5.org/collections/sale/products/key-croc) for a poor mans KVM to my headless server :)

I don't know about the omg.lol page :)

puzzlingcaptcha · 4 years ago

The quoted price refers to https://en.m.wikipedia.org/wiki/File:NSA_COTTONMOUTH-I.jpg (although admittedly for 50 units. Bargain!)

distortedsignal · 4 years ago

It can also do keystroke injection.