WiFi Hides Inside a USB Cable

https://hackaday.com/2019/02/18/wifi-hides-inside-a-usb-cable/

by glax • 7 years ago

384 153 7 years ago

hackaday.com

userbinator2• 7 years ago

The construction of this device is quite impressive, in that it fits entirely inside a USB plug

The level of miniaturisation is not all that impressive, these have been around for a while:

https://www.amazon.com/Edimax-EW-7811Un-150Mbps-Raspberry-Su...

There's no mention of using the rest of the cable as the antenna, since in my experience the above tiny adapters have an equally tiny antenna and thus poor reception.

tyingq3• 7 years ago

It says there's a microcontroller as well.

userbinator2• 7 years ago

The ones in those tiny dongles have one too.

gumby2• 7 years ago

There's a microcontroller in the connector at each end of your USB Type C cables.

snazz2• 7 years ago

It’s still impressive. It looks really close to the official Apple one and I wouldn’t think twice about plugging an iOS thingy into my computer with it. The only telltale might be how the coating feels (the Apple ones have a specific rubberized texture), but that wouldn’t be enough to prevent me from plugging it in.

Edit: stupid me, he probably just replaced the USB-A side of a legit Apple one. Ignore the part about the coating.

AceJohnny2• 7 years ago

* home manufacture.

mehrdadn2• 7 years ago

There's no mention of using the rest of the cable as the antenna, since in my experience the above tiny adapters have an equally tiny antenna and thus poor reception.

Not sure how far you were from your router but I bought one of these and it worked quite fine through walls.

m-p-32• 7 years ago

I have this adapter, works well with a router two levels above.

refurb• 7 years ago

Impressive for someone like me, whose not that close to the tech!

itissid• 7 years ago

This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this does for company's cybersecurity practices.

A rogue janitor replaces the usb cables on some of the employees of a company that makes $INSERT_SUPER SECRET_TECH$ and done.

TylerE• 7 years ago

How? I've never seen a device, certainly not a PC, that will just randomly connect to any router it sees without some sort of user input.

snazz2• 7 years ago

My understanding is that it allows an attacker connected to it via WiFi to mess with the plugged-in computer using USB (pretending to be a keyboard).

See the Twitter video: https://mg.lol/blog/omg-cable/

muthdra5• 7 years ago

Any PC may randomly connect to any router it sees if it firmly believes that is the same router the user allowed it to connect last time.

blihp• 7 years ago

Via the microcontroller embedded with the wifi adapter in the cable. It can effectively operate as a separate computer which uses the host PC parasitically for power and I/O.

ecpottinger• 7 years ago

Who needs access to a router, just sniffing for passwords this would work.

Put in the right machine and you can see every company memo as it is written.

arcaneman922• 7 years ago

It looks like it could be a variant of this squashed down to fit in the connector of a cable. https://github.com/spacehuhn/wifi_ducky

If it is, then the computer doesn't connect to a router at all. The USB cable could make itself available as a network that you remotely connect to then execute commands. The cable then types out your commands as it imitates a USB keyboard. Have you ever seen a device or PC that randomly trusts a USB keyboard you plug into it?

m-p-32• 7 years ago

Doable with an ESP chip, monitoring for open WiFi network and connects to whatever is available. Then you could have it await further instructions from a C&C.

That wouldn't need further actions from the victim.

emmelaich• 7 years ago

'How' is DHCP.

That's one. Apparently there are least 28 more ways to use usb to attack a machine.

https://www.bleepingcomputer.com/news/security/heres-a-list-...

deathanatos2• 7 years ago

I think the device featured in the article "merely" appears as a keyboard to the victim machine. The attack can then transmit keystrokes over WiFi. (This is still sufficiently dangerous. Essentially, it's "open terminal, download evil.exe, execute evil.exe, minimize/close" and escalate from there. So, not something you want to happen.)

That said, if you click the link next to BadUSB, they detail attacks whereby the device pretends to be a USB Ethernet adapter instead. And while you're right that stuff typically wants user input prior to connecting to WiFi networks, I don't think anything prompts before connecting to wired networks. The onboard WiFi could even make it appear to work, so as to not arouse suspicion (by simply bridging the pretend-ethernet to the WiFi), but now your attack has a MitM and a keyboard…

Needless to say, you don't want random USB devices getting plugged into your machine.

rwmj• 7 years ago

In secure locations it's common for USB ports to be physically blocked (the ones I've seen with glue/resin).

walrus015• 7 years ago

In super secure locations like a SCIF, a TSCM (technical surveillance countermeasures) team comes through on a regular basis with highly sensitive, expensive portable spectrum analyzers, which would find this really quick.

C1sc0cat• 7 years ago

I have seen in the UK solder used to physically block usb ports on laptops - this was QinetiQ (the bit that remained as civilservants).

Of course they equipped the laptop with a cd burner

gruez2• 7 years ago

I mean someone can just replace the cables in my house and my phones and computer would become infected.

Only if you leave your computer unlocked and unattended. If it's attended, obviously you'll see something's going on and pull the plug on the computer and probably investigate further. If your computer is locked (which is a good habit to have when leaving your workstation, the faked keyboard can't do.

cced• 7 years ago

So you bring all your cables with you everywhere you go?

I think OP is saying that these cables could be swapped out while you’re away.

As for “seeing that something is going on”, I really don’t think anyone worth half their salt would allow for such a scenario... authors of such implants aren’t exactly registering the device with the OS.

cmroanirgo3• 7 years ago

While I understand how this could've been fun to 'try out', I can think of nothing but ways that this can be seriously abused. (atm attacks, corporate spying, ...)

Can a device like this be used do anything positive toward humanity?

Did I misunderstand something? (I'm genuinely curious!)

Edited: reworded (honest) question to be less negative.

SlowRobotAhead3• 7 years ago

How does a device like this do anything but affect humanity in a negative way? How is the kind of 'research' remotely legal?

Here is some advice, whenever you think “there aught to be a law...” there probably shouldn’t be.

Planes would be falling out of the sky and high rises would be on fire if everyone had your sense of what types of research should “be allowed”.

deadbunny• 7 years ago

Can a device like this be used do anything positive toward humanity?

PoCs are often what lead to security changes. This device just existing will spur research into how to to defeat it which in turn may lead to improved security for all.

ImprovedSilence• 7 years ago

Or just sell you generic looking cables that have all these funzies inside on amazon/new egg/your favorite online store!

jchrisa• 7 years ago

If you can do this for kicks, imagine what you can do with a budget.

NamTaf• 7 years ago

It's basically what the NSA's ANT catalogue had in their COTTONMOUTH devices, among others [1]

[1] https://en.wikipedia.org/wiki/NSA_ANT_catalog

nyolfen• 7 years ago

http://www.nsaplayset.org/turnipschool

jayflux• 7 years ago

Does it just connect to the first WiFi which is t password protected? I’m assuming it’s useless if there’s no open WiFi about?

quickthrower2• 7 years ago

It creates a wifi hotspot and the attacker can connect to that using another device from a distance. They can then do stuff via the USB port, for example send key presses.

megaremote• 7 years ago

So they have to be close by.

simongr3dal• 7 years ago

I'm guessing it goes something like:

- The cable is inserted into the victims computer - The electronics inside the cable creates a WiFi network - The attacker uses a separate computer to connect to this WiFi network - Transmit the payloads to the victim - ??? - Profit

bellerose2• 7 years ago

Huh, so all it takes is someone to break into your home when you're gone and swap a cable. Seems like privacy doesn't really exist for people who truly need it. Unless they're not using any technology.

hannasanarion2• 7 years ago

Do you not use laptops? Or do you never leave your home?

bellerose2• 7 years ago

Huh? What I wrote is basically saying privacy doesn't exist for the ones who truly need it. Since those two cases you write in question are pretty much universal and the majority of people using technology would be prone to them. Unless they're not using any form of technology.

gammateam• 7 years ago

Brb signing up for Handy

pjc502• 7 years ago

If someone's broken into your house, your privacy has been pretty seriously invaded already.

entire-name• 7 years ago

I guess even some sort of "signed device protocol" will not work. An attacker can just create a device that guesses the device identifier (or whatever is used to create the signature). Then, the attacker device can just keep guessing until it gets it right. Chances are, some serial number or similar will be used for this, so continuous guessing is feasible.

Will the solution to this, then, be to have some sort of "smart card enabled device"? For example, assuming TOFU, you manually accept all device's public keys (and all devices, including cables and stuff will have one of these). Then, the computer will have to verify all actions done by those devices by sending a challenge for each action. But this seems impractical and inefficient...

Perhaps physical security is the only way for this...

DaiPlusPlus3• 7 years ago

On Windows XP this would display a “new device: keyboard connected” balloon and the Safely Remove Device icon would immediately set-off my spidersense - it’s unfortunate that newer releases of Windows hide those notifications by default and the only clue that something might be wrong would be hearing the generic device connected sound multiple times in quick succession which many users might think was their sound-card glitching.

I think a solution is for OSs to only allow the automatic mounting of newly-attached devices if they’re “passive” (e.g. mass storage - assuming no autorun.ini, output-only devices, HID class devices that only expose game-controller functionality, etc) - other device classes like mice and keyboards plugged-in to non-trusted ports should always require explicit approval.

While we’re on the subject: keyboards can be massively improved by adding over-the-wire encryption to prevent keyboard-port logging, and the USB keyboard class should be extended to include the keyboard declaring its layout to the host OS. It’s silly that we still need to configure keyboard language settings or that the OS infers it from our regional settings.

cheerlessbog• 7 years ago

How would you approve the keyboard without using the keyboard?

Anyway since we are assuming physical access, they could just swap out your keyboard for one that works normally until you go for lunch, then starts typing for itself..

gruez2• 7 years ago

Will the solution to this, then, be to have some sort of "smart card enabled device"? For example, assuming TOFU, you manually accept all device's public keys (and all devices, including cables and stuff will have one of these). Then, the computer will have to verify all actions done by those devices by sending a challenge for each action.

Even that's not enough. If you're feeling extra-evil you could tamper with the keyboard switches/traces to do whatever evil stuff you want. It's not like you can authenticate the on/off state at a switch level.

emilfihlman3• 7 years ago

No need for any public crypto. On first use, the computer issues a unique key which the device uses to authenticate all messages, for example with hmac.

aussieguy1234• 7 years ago

so... that could be useful to penetrate secure facilities, like nuclear weapons bunkers/reactors. A worker is sent a cable as a "gift" or has one substituted in by mail intercept for an actual order. Attacker waits outside in a van and controls things over wifi.

walrus015• 7 years ago

Also a reason why the TEMPEST standards exist, wifi isn't going to go very far through the walls of a shielded facility that is basically a huge Faraday cage.

Timothycquinn• 7 years ago

That hardware solution sans wifi could offer some interesting security solutions such as trusted bridge between any computer and your mobile phone. Can't wait to see this torn down and hacked.

rhema• 7 years ago

Would a high voltage loop, for breaking components, be a good solution to an attack like this? Like, fry the electronic components to verify it's just plain metal on the insides?

proee• 7 years ago

Perhaps, but it could start a fire. You might consider plugging into a power supply and measuring if there is any current draw.

walrus015• 7 years ago

USB type A male-to-female inline ammeters are really cheap, and accurate to 0.1W. I got one for ten bucks.

gumby2• 7 years ago

Likely fry the conductors in the cable too. Might as well cut the cable in half...or leave it in the home of your enemy.

ars• 7 years ago

A USB C cable has active electronics inside it, they are used to define the wire gauge on the conductors and the length of the cable.

SlowRobotAhead3• 7 years ago

Right. Also the Apple cords have an entire ARM micro in them for cable authentication.

timpattinson• 7 years ago

Just do an insulation test at say 250V using a commonly available 'megger' device

throw7• 7 years ago

what's the attack? the website just drones on about a cable that, as far as i can tell, could just broadcast your keypresses over wifi.

hannasanarion2• 7 years ago

Most operating systems trust USB devices completely. You can send keystrokes that open a text editor and type malware that'll do whatever you want, and you can control the attack in real time via wifi.

(it couldn't read user keypresses unless they use the cable to plug in their keyboard)

PeterisP3• 7 years ago

It certainly could read user keypresses after it typed in malware with a keylogger, and then transmit your keypresses over its wifi (not your network, where it might be detectable) back to the attacker.

emilfihlman3• 7 years ago

Remote keypress injection.

miguelmota• 7 years ago

Here's the announcement tweet with a video demonstration:

https://twitter.com/_MG_/status/1094389042685259776

psophis• 7 years ago

About a month ago I found a similar device on aliexpress that has GPS and SIM card slot:

https://www.aliexpress.com/item/1m-USB-Charging-Data-Cable-f...?

Nition• 7 years ago

And it's only 10 bucks!

mehrdadn2• 7 years ago

Wow, do you know it actually works? Seems cool.

nitemice• 7 years ago

Looking at the reviews, it seems that the "GPS" is just a cell tower ID, and the microphone is very quiet.

vetler• 7 years ago

Would be even scarier with eSIM, but I suppose it's just a matter of time before we get that.

qrbLPHiKpiux• 7 years ago

I bet it's there, someplace, for sometime now.

sxates• 7 years ago

"Sorry, this product is sold out"

I wonder how many things like this are in the wild and nobody's noticed.

baroffoos• 7 years ago

What is the wifi for? the only attack I can possibly see here is pretending to be a keyboard. And you don't need wifi for that, you just need a pre programmed set of steps to set up remote control for the pc.

ElijahLynn2• 7 years ago

Can someone confirm for me? This needs a nearby wifi network that is either open or has credentials too, correct?

The video appeared to have it connect directly to the phone or to the network they both were on.

jwagenet• 7 years ago

It looks like this hack uses an esp8266, which supports WiFi. Most likely the chip is booting up its own WiFi network for the phone to connect to, the phone is sending the payload over this network, and running the usb exploit. Some esp family chips should also support Bluetooth.

ElijahLynn2• 7 years ago

Okay, so the attacker would need to be within range. Is that a correct understanding?

raphlinus• 7 years ago

I'm wondering whether any of the Google security team will use this for their "leaving tradition" [1], or whether it's considered cheating, just too easy.

[1] https://twitter.com/LeaKissner/status/1085624255381827584

usepgp• 7 years ago

I worked on a security team that did this when I left - I taped & signed every USB connection at my desk and checked the signatures every time before I unlocked it.

justaj• 7 years ago

I must be out of the loop but, how do you sign USB connections?

bradgessler• 7 years ago

Are their third party OS extensions for macOS, like Little Snitch, that act as a firewall for USB-C devices?

It’s just crazy to me that plugging my Crapbook Pro into a USB-C power brick could do all sorts of bad to my computer when all I need is power.

Animats• 7 years ago

Naomi Wu reported on those last August.[1] There's one on Amazon that uses GSM, but it's 2G.[2]

[1] https://twitter.com/realsexycyborg/status/103190315541447884...

[2] https://www.amazon.com/Jiusion-Listening-Surveillance-Quad-b...

strictnein• 7 years ago

This is a couple levels past just a simple audio recording device.

It's a remote control rubber ducky and more.

fghtr2• 7 years ago

Another reason to use QubesOS, where usb devices are connected to a separate virtual machine without any networking. And any usb keyboards are only activated after a confirmation.

diegoperini• 7 years ago

Noob question: How do you confirm?

fghtr2• 7 years ago

Qubes is designed for laptops, so your first keyboard does not need any confirmation (it's not connected via usb).

upd: Alternatively, for installations with a usb keyboard, this defence is disabled.

netwanderer3• 7 years ago

Info sec industry is a rabbit hole. Just ask Jeff Bezos.

krapp2• 7 years ago

Jeff Bezos would probably think "info sec" is a unit of time.

dsabanin• 7 years ago

He is Electrical Engineering and CS graduate from Princeton.

woodrowbarlow• 7 years ago

the cable is cool, but i'm more excited to read about his PCB manufacturing process. he built those tiny boards on a desktop CNC machine!

emilfihlman3• 7 years ago

Any links to schematics and code?

WiFi Hides Inside a USB Cable

Related Stories