Legit-Looking iPhone Lightning Cables Will Hijack Your Computer

https://www.vice.com/en_us/article/evj4qw/these-iphone-lightning-cables-will-hack-your-computer

by kccqzy • 7 years ago

215 150 7 years ago

One idea is to take this malicious tool, dubbed O.MG Cable, and swap it for a target's legitimate one. MG suggested you may even give the malicious version as a gift to the target

Even more frightening, people selling them as seemingly legitimate cables on Amazon? People will pay you and you get a new botnet.

How many could you sell before it's discovered?

How can I, as a consumer, even tell? Amazon will even allow you to sell your malcable under the Apple brand.

Scoundreller7• 7 years ago

Your attack would need to be targeted since you can’t connect to your cable over-the-internet, only over the wifi interface, limiting you to that range.

roywiggins• 7 years ago

The thing can scan for open wifi and phone home, so anyone within range of a Starbucks would be vulnerable.

ebg132• 7 years ago

The article says

"But the cable can be configured to act as a client to a nearby wireless network. And if that wireless network has an internet connection, the distance basically becomes unlimited."

ceejayoz3• 7 years ago

Given that it can do things like open a terminal, I'd think it could automatically be set to install botnet malware. Sell a few hundred thousand on Amazon and you're in good shape.

The wifi's just so you can control it remotely.

michaelt3• 7 years ago

If you were mailing the cables to random people, you wouldn't use wifi, it's true. You'd just want the fake keyboard to just use a terminal to download and install a trojan.

If you can fire off a successful "curl | bash" on an internet-connected machine, wireless isn't needed.

Of course, without wifi you've only got a USB Rubber Ducky clone [1] whereas with wifi, you've got an NSA COTTONMOUTH clone [2] which I imagine is much more likely to get your talk accepted at DEFCON :)

[1] https://shop.hak5.org/collections/physical-access/products/u... [2] https://en.wikipedia.org/wiki/NSA_ANT_catalog

misiti3780• 7 years ago

I do not buy electronics on amazon for this very reason.

reaperducer• 7 years ago

I do not buy electronics on amazon for this very reason.

Ditto. Further, I do not buy lightning cables or iPhone chargers from anywhere but an Apple Store.

This has been a good idea for years, even before this, when HN was all aflutter about fake chargers frying phones, or with embedded computers that tried to hack your phone.

buildbuildbuild• 7 years ago

My opinion is that the Amazon threat vector is overblown. This cable is better suited for inside attackers (friends & family) or for highly targeted attacks.

Amazon reviewers would quickly notice terminal windows pop up on their screens or keystrokes happening at inopportune times, assuming a more advanced exploit isn’t used. (many of these attacks simply try to spawn a terminal window and type commands, a very noisy approach) Scary device regardless, I just think the Amazon vector is overhyped.

If you are a high value target, pay close attention to your supply chain and how you receive packages.

ikeboy• 7 years ago

Amazon hasn't allowed unauthorized sellers sell Apple products since January

3JPLW2• 7 years ago

I've not found many details about how this is actually working — there's some info on his D̴̹̭͂ë̷̗́̃̿̓̾͜ṃ̸͔͚̗̙̪̎̄̋ȏ̸̝̤̱͜n̶͇͇͙̻̩͑͑S̴̳̩̮̥͚̥̚ė̸̟̃͋͂͝e̷̪̲̪̰̣̿̀͠d̵̡̂͗ cable here [1], but apparently the O.MG cable is "a very different piece of hardware that does a whole lot more."

Does anyone have any insight into how this attack works? My guess is that it acts like a hub that exposes both the iPhone lightning connector and a keyboard/mouse. And then the keyboard/mouse is controllable via some near-range wireless like WiFi or bluetooth? I suppose it could even scan for open networks and try to join to allow a more remote exploit. Anyone find more information anywhere?

1. https://github.com/O-MG/DemonSeed

Scoundreller7• 7 years ago

It says it has a wifi chip. So the attack is limited by that distance.

It probably switches on the Keyboard/Mouse Logic as necessary.

But from there you could play an “Open Terminal” and be quite creative. Don’t know if you could send much information back, but I don’t see why it couldn’t have a few gb of flash storage to copy from/to, e.g. occasional screenshots to see what’s there. Or files.

egdod• 7 years ago

Maybe not distance-limited.

"But the cable can be configured to act as a client to a nearby wireless network. And if that wireless network has an internet connection, the distance basically becomes unlimited." he added.

lucianfelix• 7 years ago

You could easily use the host computer's internet connection to upload data or to execute commands downloaded from a control server.

tda• 7 years ago

I'm guessing the cable has an esp8266 on board which you can get cheaply and is only a few mm2. It has WiFi and WiFi direct support and is powerful enough to run a webserver. Probably there are plenty chips that do the job, but the esp8266 (and its successor esp32) is very popular for custom hardware due to being cheap and easy to program

MuffinFlavored• 7 years ago

How would the board in the cable know what WiFi to connect to, and how would it run shell commands via USB?

Maxious• 7 years ago

https://theamphour.com/the-amp-hour-454-mike-grover/ goes into the tradeoffs and techniques required to get the board so thin

scohesc• 7 years ago

I don't see how Hak5 can create exact replicas of Apple Lightning cables with hacking tools embedded in them and NOT have Apples dream litigation team blasting down their doors

It's pretty amazing how technology has gotten so small we can hide a wifi chip and keyboard emulator into the end of a USB port plug.

jagger27• 7 years ago

No, they are modified genuine cables.

orpheline• 7 years ago

The demo was a modified cable, but the article said Hak5 was interested in manufacturing them.

ege_erdogan• 7 years ago

I have this USB-C looking like this[0] (not the same one though). The thing is whenever it is plugged into my MacBook Pro, the hub starts to overheat, even when there is nothing connected to it. I once tried plugging it into the MBP adapter and charging my phone through the USB port on it, and it did not heat at all.

I am suspecting it is running some program in the background (a miner maybe). Is there a way I can check if such a program is running?

[0] https://www.amazon.com/Purgo-Adapter-2018-2016-Delivery-Thun...

Eric_WVGG• 7 years ago

You could install Little Snitch on your Mac to see if it phones home.

IMO more likely that it's shoddy hardware; either way it's munching your battery, so I'd send it to the recyclers and find something more reputable.

qrbLPHiKpiux6• 7 years ago

Ask your dentist to take an x-ray of the cable you may be concerned about. We're all digital and it only takes a second. If your guy is cool, he'll do it.

ceejayoz3• 7 years ago

That won't be much good against random third-party cables from Amazon, where you don't have a "it should look like this" scan to compare against.

qrbLPHiKpiux6• 7 years ago

I told you _my_ dentist was cool. This is a 3rd party Amazon cable.

https://i.imgur.com/RdxDYF4.png

Just acquired.

HyperTalk23• 7 years ago

Where do you find these "cool doctors"? I once tried to bribe six different doctors in my area with $3000 in exchange for agreeing to allow me to get an exploratory MRI and they all said no.

qrbLPHiKpiux6• 7 years ago

You gotta be one!

falcolas5• 7 years ago

An exploratory MRI has inherit risk (even if minuscule) to your life, and thus their livelyhood. A very big difference from asking for an x-ray of a cable.

ska4• 7 years ago

I suspect many would be far more open to clearly non medical usage of machines they actually own or lease. What you were asking for isn’t any, and had perceived risk for them.

If I was a random clinician there is no way I would have helped you either.

If you do want a MRI done out of curiosity your best bet is to go through biomedical imaging research group who needs subjects, I would guess. Unless you happen to live near a manufacturer.

xnyan• 7 years ago

I don’t know anything, but I would not be shocked to learn that malpractice insurance does not cover "exploratory" practices paid in cash under the table.

arkades• 7 years ago

Because that opens them to a giant slew of malpractice claims. Your 3000$ doesn’t come close to covering the risk.

lorenzhs• 7 years ago

Used dental X-Ray equipment can be surprisingly cheap (obligatory "don't try this at home if you don't know what you're doing" warning applies). I know some guys who are mad enough to buy and operate it: https://twitter.com/FauthNiklas/status/1123745053032292357 and https://twitter.com/FauthNiklas/status/1113902554931449858

You can find a few examples of x-ray images they took on their twitter feeds as well: https://twitter.com/FauthNiklas/status/1125606579540246528 and https://twitter.com/JanHenrikH/status/1127033349246279680 and https://twitter.com/FauthNiklas/status/1149386796352069633

perfectphase• 7 years ago

There's an interview with MG talking about these cables on the Amp Hour podcast this week https://theamphour.com/the-amp-hour-454-mike-grover/

lostgame• 7 years ago

I still don't get why iPhones don't use USB-C. OOTB, there's issues between a brand new iPhone and a brand new MacBook Pro.

jmull• 7 years ago

I think it's just an accident of timing and history.

The old 30-pin connector (inherited from the iPod) had various issues so I think Apple was eager to replace it. The lightning connector was their solution. It predates USB-C by a few years, so that wasn't an option at the time (I guess it might have been on Apple's radar by the time the lightning cable was introduced, but if so, they must have made the call not to wait.)

Since USB-C has made its way to some iPads, my guess is Apple is in the process of phasing out lightning connectors entirely.

ReverseCold• 7 years ago

Since USB-C has made its way to some iPads, my guess is Apple is in the process of phasing out lightning connectors entirely.

It could also be more that Apple is trying to position the iPad Pro as a "laptop replacement" - and their laptop has type-C ports - so having the same port makes it feel and work more like a laptop.

kccqzy2• 7 years ago

Instead I've heard that Apple essentially designed the USB-C standard after the successful design of Lightning, and gave the standard to USB-IF. (Apple is a member of the USB-IF.)

eridius4• 7 years ago

If Apple were going to ditch the lightning connector on the iPhone I would have expected them to do it last year.

More generally, the lightning port is actually slightly slimmer than a USB-C port, which is important. While the iPad isn't any thicker than an iPhone, it has squared-off edges, versus the iPhone's rounded edges, so switching the iPhone to USB-C would likely require either making it thicker or making the area around the charge port flat.

paulsutter2• 7 years ago

Really need a setting “never trust any device ever”. I’ve never once had a use case with my phone to do anything but charge. Really hate when I plug in my phone to charge in a car and the car takes over my UI. All bad ideas. If I want to move photos I use the network.

judge20202• 7 years ago

Car takes over the phone's UI? Is that an Android thing? I've only ever heard of carplay/android auto taking over the Car's UI (and replacing it with a much better UI).

kemayo• 7 years ago

If we're speaking of an iPhone, if you plug one into a CarPlay receiver then it lightly interrupts the phone use. The iPhone gets a big CarPlay splash screen (which you can dismiss), and switching apps on the car display will also switch them on the phone.

This is changing in the upcoming iOS 13, so the car display and the phone will be much more independent[1]. As someone who's often a passenger with their phone plugged in, I'm happy for this.

[1] https://www.macstories.net/stories/carplay-in-ios-13-a-big-l...

excalibur• 7 years ago

Moving large amounts of data over the network can be cumbersome. MicroSD cards can come in pretty handy.

gambiting• 7 years ago

This device shows up as a keyboard - should keyboards never be trusted ever? How would that work?

throwaway5d097• 7 years ago

First thought was whitelisting USB vendor and device IDs, but I guess those could be spoofed. A button above every USB port?

Going back to PS/2 could be an option? Guess that wouldn't be too different from allowing all devices only on a single USB port.

Tharkun• 7 years ago

It would be nice of my OS had an option to disallow any and all USB devices. Plug something in? Ask whether I want to allow it. I guess this would get annoying after a bit. But still, I only use a couple of USB devices on a daily basis, but I click on boatloads of cookie warnings every day.

Faark• 7 years ago

At least the user should be informed, meaning it should show the bare minimum to allow us to act upon. Something like "USB keyboard connected: [Device specified name]" for common device types. More complicated/dangerous stuff should only run after user acknowledgement. This way there is at least a significant risk to get caught / chance for the user to catch it.

Not sure if I just mis-configured my windows, but it is certainly lacking on that front. The Settings -> Devices -> USB having just a single checkbox for error popups is probably not a good sign.

paulsutter2• 7 years ago

I have never once wanted to attach a keyboard to my phone

abugheratwork• 7 years ago

Regarding keyboards, maybe at least don't automatically trust a SECOND keyboard? Even when user interaction isn't possible until the device is active, as someone else pointed out, you can at least send a warning to the user's display.

optimiz32• 7 years ago

My quick thought was to have the OS display a random char sequence, which must be typed on the keyboard before input is accepted.

Usability could be optimized depending on how uniquely identifiable keyboards are (to reduce when trust prompts are shown).

falcolas5• 7 years ago

Personal opinion: Charging only is what a cigarette adapter is for.

Allowing me to use the car's interface to control my phone is a nice tool. It probably adds to the safety of my driving, since I can skip audio tracks using physical controls on my steering wheel instead of a touch screen.

JadeNB2• 7 years ago

Personal opinion: Charging only is what a cigarette adapter is for.

But hardly any new cars have that ….

Allowing me to use the car's interface to control my phone is a nice tool. It probably adds to the safety of my driving, since I can skip audio tracks using physical controls on my steering wheel instead of a touch screen.

It seemed that paulsutter (https://news.ycombinator.com/item?id=20686844) was suggesting a setting that prevents this automatically for people who never want it, not removing the capability for people like you who do want it.

everdrive• 7 years ago

If you have an old-fashioned USB 2.1 plug, you can actually remove / cover the data pins, leaving only the power pins exposed!

libria• 7 years ago

Do female->male USB-USB power-only passthrough adapters exist? If I could buy a few from a trusted source like directly from the Apple store, I could use it to firewall my cables (never thought I'd have to do that).

As an added bonus, my iphone wouldn't automatically crank up itunes on my mac every single friggin time I plug it into the dock.

JustSomeNobody• 7 years ago

I use a data blocker on anything I think might be suspect.

But, then, I am shifting trust to my data blocker...

optimiz32• 7 years ago

Would be nice if they narrowed the attack surface -

"A new (unneeded if devices sufficiently uniquely identifiable?) keyboard has been plugged in, please type <random char sequence> to confirm"

bashinator• 7 years ago

You're on a desktop computer, and you've just spilled water on the keyboard. How do you replace it?

CamperBob2• 7 years ago

Really hate when I plug in my phone to charge in a car and the car takes over my UI.

For every phone owner who thinks this way, there are probably a dozen others who hate it when they plug in their phone and the car doesn't mirror the phone's UI. I'd be in the latter group.

NoodleIncident• 7 years ago

It sounds like you need a "USB Condom"; It's essentially a minimum-length extension cable, with only the power lines enabled, not any of the data.

jcheng• 7 years ago

Now MG wants to get the cables produced as a legitimate security tool

Can someone explain how these could be considered a "legitimate" security tool? What legitimate use would require the cable to look like a genuine Apple cable? (I'm honestly asking.)

par• 7 years ago

onsite pentesting for example. You want to train your employees to be aware of random cables and usb drives laying around, this is a good test to ensure your training worked.

kccqzy2• 7 years ago

The vendor is Hak5. Among the products they currently sell is a USB drive lookalike that's actually a keyboard that can send preprogrammed keystrokes.

jiveturkey• 7 years ago

up to 300 feet

which means 50 feet, which is still impressive in that it's a useful distance. I remember the earlier version being more like 5 feet, which sounds pitiful but is still enough. In fact no wifi at all (0 ft) is enough to plant software (CMD-space Terminal RET curl | bash && exit) if you take your chances that the target is inattentive.

I learned of the earlier version here on HN but I can't find the link now. It was maybe 4 months ago?

Given that the attack is that it's a USB keyboard, nothing to do with the lightning aspect, except that the victim is likely to need a lightning cable at some point, any USB dongle will do.

Given the attack methodology for this specific device, of being in visual distance of the victim, just use an unpaired apple keyboard. Macs will automatically pair to them, so you just need to turn it on when the victim looks away (a brief 2-second overlay appears on the screen upon connecting). You could force this by creating a distraction: drop a glass. No dependence then on the victim using the cable.

tunesmith• 7 years ago

Is there a piece of cheap validation hardware where you can plug in both ends of your cable and a little display will tell you what kind of cable it is and if it is legitimate?

dredmorbius4• 7 years ago

Proving a negative is hard.

Though checking to see what USB / PCI devices are advertised could be useful.

Device / USB whitelisting looks like it will need to be a default thing Real Soon Now.

caf2• 7 years ago

Even just a device with a USB port that reports No Device / Hub / Keyboard / Storage / Other through a set of LEDs would be reasonably useful.

avian• 7 years ago

Maybe just have something like the USB killer [1] to "sterilize" cables. Zap the cable with a high voltage/high energy pulse, beyond what normal on-die ESD protection could handle. A bunch of copper and plastic won't get damaged (unless you really get crazy and it arcs over and carbonizes or something), but it will probably burn out any covert semiconductors in the cable. It's hard to absorb high energy pulses in small packages.

[1] https://usbkill.com/

chendragon• 7 years ago

Type-C cables have an E-Marker IC inside them by design, so this would probably render the cable non-functional or worse-functional unfortunately.

eridius4• 7 years ago

Lightning cables have a computer inside them, that would destroy the cable.

BluSyn• 7 years ago

Any thoughts on how someone could validate a set of cables to ensure no trojans exist?

hansdieter1337• 7 years ago

Get a USB condom! https://shop.syncstop.com/products/usb-condom?variant=354300...

ihuman• 7 years ago

How do you know you can trust that? Couldn't it be doing the same thing as the fake lightning cable?

digsy2• 7 years ago

They block (or just dont have) the USB data pins - so all it can do is draw power.

jimrandomh2• 7 years ago

Reposting from 4 months ago (https://news.ycombinator.com/item?id=19609745):

It's a severe discredit to the major operating system vendors that plugging in a USB stick can still compromise a system.

If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until either that keyboard has typed the user's login password, or the user uses a different input device to authorize it. If it identifies itself as a storage device, the filesystem driver should be hardened. If it identifies itself as an obscure 90s printer with a buggy driver written in C, it should prompt the user to confirm the device type before it loads the driver.

It's 2019. Why the f* haven't Windows, MacOS and Linux all implemented these basic precautions?

gitgud• 7 years ago

If a USB device identifies itself as a keyboard, the system shouldn't accept its keystrokes until either that keyboard has typed the user's login password, or the user uses a different input device to authorize it.

An interesting solution, it would definitely prompt the user to understand what the device is trying to do.

But I'm sure that it's extremely hard to prevent something malicious, once it has physical access to a port on your computer...

josephg2• 7 years ago

Except for running wacky voltages through your computer, there's no fundamental reason why USB devices should be harder to protect against than malicious network traffic. The model is very similar - in both cases they're serial data transports. USB just uses devices instead of services, and drivers instead of programs.

squarefoot• 7 years ago

"An interesting solution, it would definitely prompt the user to understand what the device is trying to do."

But then it could simply wait for the user to enter the password (1), then read it by sniffing the traffic from the keyboard and store it internally for later use, since it's all in clear ad it cannot be encrypted before entering the machine unless most (all) USB consumer hardware get some heavy modifications.

1- very simple algorithm: store in the internal flash memory whatever the user enters between connecting the keyboard and hitting the 2nd enter key; if it's mostly the same words, then it's very likely an user/password pair.

"But I'm sure that it's extremely hard to prevent something malicious, once it has physical access to a port on your computer... "

Very true. Malicious plug in hardware was just a matter of time; we badly need some active protection for these things, or it would be a mess. This is the perfect weapon in the hands of people with a thing for vandalism, I hope mainstream media won't cover that story.

thunderbong• 7 years ago

Probably because the keyboard can be plugged in and has to be recognized even before the operating system boots?

digsy2• 7 years ago

I saw Kevin Mitnik (FBIs most wanted hacker in the 1990s) at a conference plug one of these into laptop with a fully patched version of Windows 10 and one of the very common security suite of apps.

The laptop was completely compromised in seconds.

From a remote laptop, he had complete access to the target machines full filesystem, started the webcam and turned on the microphone without any notifications to the target user and connected a bluetooth hard drive remotely.

And this was using a rogue cable that he just bought off ebay.

I was honestly shocked at how easy it would be to compromise someones machine. I'll never look at a USB cable the same way.

Legit-Looking iPhone Lightning Cables Will Hijack Your Computer

Related Stories