About a month ago I found a similar device on aliexpress that has GPS and SIM card slot:<p><a href="https://www.aliexpress.com/item/1m-USB-Charging-Data-Cable-for-GPS-Locator-GPS-Positioning-Pick-up-Line-Tracker-Remote-Tracking/32822576534.html" rel="nofollow">https://www.aliexpress.com/item/1m-USB-Charging-Data-Cable-f...</a>?
This is scary. I mean someone can just replace the cables in my house and my phones and computer would become infected. I can't even imagine the headache this does for company's cybersecurity practices.<p>A rogue janitor replaces the usb cables on some of the employees of a company that makes $INSERT_SUPER SECRET_TECH$ and done.
Naomi Wu reported on those last August.[1] There's one on Amazon that uses GSM, but it's 2G.[2]<p>[1] <a href="https://twitter.com/realsexycyborg/status/1031903155414478848?lang=en" rel="nofollow">https://twitter.com/realsexycyborg/status/103190315541447884...</a><p>[2] <a href="https://www.amazon.com/Jiusion-Listening-Surveillance-Quad-band-Lightning/dp/B06X42SGPY" rel="nofollow">https://www.amazon.com/Jiusion-Listening-Surveillance-Quad-b...</a>
I'm wondering whether any of the Google security team will use this for their "leaving tradition" [1], or whether it's considered cheating, just too easy.<p>[1]: <a href="https://twitter.com/LeaKissner/status/1085624255381827584" rel="nofollow">https://twitter.com/LeaKissner/status/1085624255381827584</a>
Here's the announcement tweet with a video demonstration:<p><a href="https://twitter.com/_MG_/status/1094389042685259776" rel="nofollow">https://twitter.com/_MG_/status/1094389042685259776</a>
I guess even some sort of "signed device protocol" will not work. An attacker can just create a device that guesses the device identifier (or whatever is used to create the signature). Then, the attacker device can just keep guessing until it gets it right. Chances are, some serial number or similar will be used for this, so continuous guessing is feasible.<p>Will the solution to this, then, be to have some sort of "smart card enabled device"? For example, assuming TOFU, you manually accept all device's public keys (and all devices, including cables and stuff will have one of these). Then, the computer will have to verify all actions done by those devices by sending a challenge for each action. But this seems impractical and inefficient...<p>Perhaps physical security is the only way for this...
What is the wifi for? the only attack I can possibly see here is pretending to be a keyboard. And you don't need wifi for that, you just need a pre programmed set of steps to set up remote control for the pc.
That hardware solution sans wifi could offer some interesting security solutions such as trusted bridge between any computer and your mobile phone. Can't wait to see this torn down and hacked.
so... that could be useful to penetrate secure facilities, like nuclear weapons bunkers/reactors. A worker is sent a cable as a "gift" or has one substituted in by mail intercept for an actual order. Attacker waits outside in a van and controls things over wifi.
Can someone confirm for me? This needs a nearby wifi network that is either open or has credentials too, correct?<p>The video appeared to have it connect directly to the phone or to the network they both were on.
Another reason to use QubesOS, where usb devices are connected to a separate virtual machine without any networking. And any usb keyboards are only activated after a confirmation.
Would a high voltage loop, for breaking components, be a good solution to an attack like this? Like, fry the electronic components to verify it's just plain metal on the insides?
Huh, so all it takes is someone to break into your home when you're gone and swap a cable. Seems like privacy doesn't really exist for people who truly need it. Unless they're not using any technology.
Are their third party OS extensions for macOS, like Little Snitch, that act as a firewall for USB-C devices?<p>It’s just crazy to me that plugging my Crapbook Pro into a USB-C power brick could do all sorts of bad to my computer when all I need is power.
<i>The construction of this device is quite impressive, in that it fits entirely inside a USB plug</i><p>The level of miniaturisation is not all that impressive, these have been around for a while:<p><a href="https://www.amazon.com/Edimax-EW-7811Un-150Mbps-Raspberry-Supports/dp/B003MTTJOY" rel="nofollow">https://www.amazon.com/Edimax-EW-7811Un-150Mbps-Raspberry-Su...</a><p>There's no mention of using the rest of the cable as the antenna, since in my experience the above tiny adapters have an equally tiny antenna and thus poor reception.