USB-C cable CT scan reveals sinister active electronics | Hacker News Reader

USB-C cable CT scan reveals sinister active electronics

tomshardware.com

26 pointstoss112 comments

This title is clickbait.

They didn't scan a random USB cable, they scanned an OMG cable, which is designed to hide a bunch of pen testing stuff.

It's the actual headline shortened to the HN 80-char limit

The point of the article is not that it is a random cable, but that the pen-testing cable would pass normal 2D x-ray analysis, and required a CT scan to really identify anything abnormal.

Knife is infinitely more accessible and equally effective, no?

Protecting a cable I'm motivated to investigate doesn't even register as a priority. If it is: electrical tape. Once I cleared it, I may as well use it.

Either I have a legitimate concern and should consider my cable source... or seek psychological help. Who's scanning Red Team cables and coming out surprised?

This seems more demonstrative (read: advertising, perhaps fear-mongering) than practical. Needlessly aggrandizing in presentation.

It's the kind of thing you solve without expense or effort, lest it snowball. Easier - and arguably better - to replace an untrustworthy cable than get the absolute truth.

I don't send DCOPs out with the tester, splicer, and so on. I tell them to get a replacement cable. Once I have a reason to suspect it, that is - the foundation of this article is shaky.

The foundation of this article is a tweet from Lumafield who are the people behind https://www.scanofthemonth.com/ where they CT scan an object a month as advertisement for their CT scanning service so if we're talking about CT scans of objects showing things, the article was quite successful.

Yes, I agree - advertising with a silly premise

I'm not discounting the effectiveness so much, just really trying to assert it's closer to bait than the other poster would admit.

The invoice - for the cable - told them the same thing as the scanner, lol. We're talking so it worked, sure. Bait... or more kindly, advertising - I said it first! :P

> The good news is that these cables are expensive, with prices starting at $119.99 for the most basic version. So, you don’t have to be worried about someone spreading this malicious hardware to provide widespread chaos among the public at large.

That's pretty damn cheap as far as hardware-enabled exploits go, and it looks like the keylogger-enabled "Elite" version is just $199.99. If the basic one is limited to spoofed keyboard and mouse inputs, I'm temted to order one just to mess around with people...

Made me think about my first iPad. Back when they first came out and none of my friends had seen one. I was already into jailbreaking so had Cydia and all the best apps. I put on a screen record function which did so secretly. My buddy comes by one day and was like that thing looks cool. I said ya man it is awesome try it out. Had my secret screen record going and said try facebook man look how cool it is on that. He logs in and I record his password. Logs out and hands it back and I quietly watch what he typed and log into his facebook and changed his profile picture to something funny and made a dumb status. This was back before 2fa was a thing so it was easy.

The funny part was when he realized he was not mad as we were long time friends but he was so sad I got his long time password he had used for years. It was fun to mess with him. But now days I would be worried about the legality of using one of these devices to steal someones password. I would not want to take the risk myself.

The O.MG cables are indeed $200 but the EvilCrow cables are $25 dollars and have a programmable ESP32-S3 inside. This has wifi, bluetooth, and a ton of other stuff.

A chip inside a USB-C cable isn't that special, high-end thunderbolt cables have (active) signal shaping chips in both ends.

Example tear down of an Apple thunderbolt 4 cable: https://youtu.be/LBWnb0ZIlEA?t=276

Isn't the only reason for this, nefarious?

What purpose does this serve except for something bad.

Is there any justifiable reason?

yes but is the person they're using it on good or bad, making the purpose something good? killing is bad, but if I'm a hitman that only takes contracts to kill bad people, does that make me a good guy?

I think problem with this is it is on amazon for anyone to buy.

The pagers were targeted. They manipulated the supply chain to get them into the hands of the bad guys.

This USB connector is general public. Everyone could have one.

Reply on news.ycombinator.com