Investigating an “evil” RJ45 dongle | Hacker News Reader

Investigating an “evil” RJ45 dongle

lcamtuf.substack.com

508 pointszdw169 comments

> The English-language product brief implies that “SR” stands for “Supereal”; that brand name comes up in the context of counterfeit FTDI FT232RL chips that plagued the industry some time ago.

This wording is misleading because it implies the fake chips were the plague. The fake chips worked fine, and it was FTDI's official driver that intentionally ruined peoples' working hardware when they detected the fakes and changed their PID to 0000 so they would no longer be recognized: http://www.rei-labs.net/changing-ftdi-pid/

> The fake chips worked fine

Some of them did. I had some that did weird things with the CBUS pins.

as someone with no connection to this can you elaborate?

They were also a plague because they introduced uncertainty and had spread and contaminated devices across a wide range of devices. Silently counterfeited devices are not OK.

They wouldn't have had to pretend if FTDI would have let them be a second source. I am sympathetic toward wanting to have the support of an already-widely-distributed driver rather than get stuck in the chicken vs egg of being unable to break in to a market because no current software supports your design.

"If you want to try it, be aware that it requires Intel Pentium 166MHz or above."

Made me laugh. Fun article, also really love the genre of "bored smart person goes too deep on something that the end result is obvious by common sense but proving it requires surprising amount of ingenuity and scrappiness"

Don't forget `I was ready to head over to the Dark Web (amazon.com) and purchase one of the dongles just to dump the contents of the memory chip.`

Totally agree.

And a great example that truth is complicated, expensive and uncomfortable. It's much easier to postulate an evil nation-state entity with a bad plan (without evidence) than to dig through the thicket of this article. It's much cheaper as well, certainly in terms of time and knowhow. And it's also much more comfortable to claim you're the victim and have uncovered a conspiracy, rather than realize this was just the result of the patchwork typical of engineering.

Kudos to the author.

Yeah, the insane takes spread faster but it takes more time and resources to look into it than just come to conclusions early.

The worst thing is this creates an environment where most people are either completely credulous and buy into everything or completely incredulous and think everything is unfounded. It's just exhausting to have a healthy level of skepticism these days, and maybe 1 out of 1000 times (number source: from thin air) something that sounds insane actually has some truth to it.

Yeah, for a substantial fraction of people, this case will stick to their minds as "oh the chinese .. again" It's both sad and scary. It was even submitted to HN. Flagged by now, but still. Many people won't have read this follow-up, especially since it doesn't come as a 1-sentence TL;DR..

Hmm, why is it sad and scary?

Not the OP, but I think I get the "sad and scary" part. It seems as though there is some vilification going on and that's happened before with very sad outcome.

It's sad because the HN crowd is technically maximally (?) literate and should be one of the last communities to even remotely buy the debunked story.

It's scary because if even those in the know are not resistant to such BS, who else is going to shield the general public from populism-fueled pushes to anarchy or worse? Detoriation of trust in media is one of the building blocks of that, and if even the experts of subject areas are fooled and/or don't care enough, all hope may be lost.

The silver lining though is that the HN submission got pushback in terms of comments and an eventual flagging.

To add, there's a huge politically motivated anti-China movement going on right now, to the point where anything Chinese sounds scary or suspicious. This has been going on for years now, but only came to my awareness with the Huawei scare (as of today, no evidence was found that they did come loaded with backdoors and the like - but do correct me if I'm wrong, this is based on what I remember, not researched facts).

I mean I don't trust the Chinese, but neither do I trust the Americans so it's choose your flavour of evil.

Anyway that said, I'm sure it's politically and economically motivated, as for decades China has played catch-up in the global economy and they are rapidly overtaking, with financial interests worldwide. The US is trying to slow them down by trying to keep e.g. chip technology out of their hands, but other than that all they can do is to stop Chinese companies from earning money in the US.

Honestly there are so many claims about Huawei but I think the loudest ones were about the 5G network which were BS but there were some that were legit, and this is exactly my point - it’s exhausting to check this stuff, so the vast majority of people either believe it all or none. For example it seems like the Supermicro spy chip thing has truth to it (it feels the thing OP was rebutting was inspired by this story), though it’s unclear, it’s very much based on statements from 3 letter agencies, so I just have to guess, yes probably China got their manufacturers to install hardware spyware on some devices.

These days, all countries are doing insane digital spying on other countries. I believe we’re in a modern Cold War. China is a unique threat not because there’s something uniquely evil about them but they own so much manufacturing and have an explicit tight relationship between companies and government. This is the main reason for moving manufacturing to US, nobody really cares about the workers, it’s a security threat.

All that can be true, and still also be true that most of the shit you hear about China is BS and xenophobic. It leads to actual violence and racism. That’s why it’s important to push back against, for the regular people just living their life. I’m never going to defend any country, these are battles the very richest people are fighting it’s not my war, I push back so don’t people don’t act as foot soldiers in their war or become collateral damage for something they have no part of.

In the absence of further information, I would totally choose to believe the story.

Corporations cannot be trusted. Proprietary software is bad enough but proprietary drivers is on a whole new level. You really have no idea what those things are doing unless you reverse engineer them.

Here are example of corporations essentially pwning your computer with their "justified and trustworthy" software:

https://www.vice.com/en/article/fs-labs-flight-simulator-pas...

Shipped a browser stealer to users and exfiltrated on an unencrypted channel the usernames and passwords of users they deemed to be "pirates".

https://old.reddit.com/r/Asmongold/comments/1cibw9r/valorant...

https://www.unknowncheats.me/forum/anti-cheat-bypass/634974-...

Screenshots your computer screen and exfiltrates the picture to their servers.

https://www.theregister.com/2016/09/23/capcom_street_fighter...

https://twitter.com/TheWack0lian/status/779397840762245124

https://fuzzysecurity.com/tutorials/28.html

https://github.com/FuzzySecurity/Capcom-Rootkit

The driver literally provided privilege escalation as a service for any user space executable.

As far as I'm concerned anyone who trusts these corporations with kernel level access to their computers is out of their minds. I don't trust firmware but at least it's contained in some isolated device.

Sorry but you are blurring the lines between an actual malicious attack and a badly designed driver.

The first is what the original claim was, screaming "Russians!" and "Chinese!" at the same time with poor technical understa ding.

The second is what actually happened. It's no worse than inserting a CD-ROM and installing a driver. As bad as that is, and to be criticised in its own right, it's qualitatively different from the first.

Let's not muddy the waters by conflating the two and make the (IMO legitimate) criticism of one of them wade into a conspiracy theory about the other.

Didn’t china make the news recently because they hacked a handful of huge American telcos and cell providers?

Or the balloon that was hanging out for a while, that was a thing.

There is no muddying of waters here. I posted an example of a corporation who thought it was alright to ship literal malware to their customers. They had every intention of stealing their credentials. They did it on purpose, because they thought they were police officers and wanted to "track down" some notorious "pirate". They displayed zero remorse, only regretting the fact they got caught. They actually thought they were justified in their endeavours.

There are no "conspiracy theories" here. It's not a theory, it's really happening. It's not a conspiracy, they don't even think what they're doing is wrong. Corporations see themselves as utterly justified in everything that they do in the name of profit. There are no limits they wouldn't cross. Nothing is sacred to them. Not morals, not you, and certainly not your computer and the personal information stored in it.

Trust them at your peril.

>It's sad because the HN crowd is technically maximally (?) literate

I laughed. While there certainly are very smart people here, HN crowd is pretty diverse and large parts of crowd are startup/business/framework of the week/ai bros folks. Not someone who would know what spi is from the top of their head.

I meant relative to a random dude on the street.

The problem is that good journalism doesn't have funding. Otherwise this shit would never have made it into a newspaper, maybe outside of a really shitty yellow rag.

> The problem is that good journalism doesn't have funding.

The BBC and Reuters can be posited as counterexamples to your assertion. They’re good journalists and well-funded (and not primarily by advertising either).

Hmm... but do you think that they would produce such an article, funding the research into it?

From what I can tell, they would report accurately once these findings were published but would not find a researcher to dig into the claims before publishing that someone (named) said that these chips are at fault.

BBC is under constant threat of getting defunded, it's almost a meme at this point, and on top of that is generally under constant attack. Reuters doesn't do much local or regional stuff.

Which firm's journalist was it that just got arrested at a press conference for asking questions about Israel?

Ejected, not arrested: https://news.yahoo.com/news/antony-blinken-kicks-journalist-...

Sadly, this is just another example of "A lie can travel halfway around the world before the truth puts on its shoes."

That doesn't mean that every sensational thing is a lie, but verifying the truth definitely takes time!

I would also add, it's not _unreasonable_ to be wary of something when a tool like a virus scan pops up a warning. The jargon used to explain what the executable is doing is gibberish to any 'normal' user, there's no way for them to know it's listing stuff you'd more or less expect it to be doing.

Of course, there's a bit of a jump from that to making bold claims about what it's doing, but the initial concern was understandable.

Truth lies somewhere in between. It's also a generalization to think everything related to the “evil-nation” postulation is nothing beyond a conspiracy theory. Absence of evidence is not evidence of absence.

Edit: quoted evil-nation since it’s a debatable term usually applied to any country not politically or culturally aligned with some intelligence activity presence.

Fun considering the history too [https://www.risidata.com/index.php?/Database/Detail/cia-troj...]

> Absence of evidence is not evidence of absence.

Correct. Not more, not less. Question is what the default assumption is. With enough BS thrown around, the public seems to tend to tilt to "something is fishy" without any (non-debunked) evidence having ever been presented. Doesn't mean it never will be, but until then, a lot of debunked falsehoods shouldn't create more bias than just silence. Sadly, something always sticks.

fundamentally, it’s a ‘liberal’ (assume good intent/turn the other cheek) vs ‘conservative’ (cover your ass) approach. In the literal, not political meaning.

With enough problems, enough people get burned that of course this is where it goes.

It's fun, but I think this kind of thing is important because it underscores the xenophobia in the original post. A flash chip on a circuit board? Hoo boy, must be Chinese spyware!

That isn't to say Chinese spyware isn't a problem. But, if you don't have the baseline technical competence to detect it, it's bad to go running around yelling "CHINA CHINA CHINA!" That's how our politicians pick up a bogus news story and use it as an excuse to enact stupid policies. It's bad for society.

Well, the CIA did it to Russia in the 80’s and blew up a pipeline…. [https://www.risidata.com/index.php?/Database/Detail/cia-troj...]

Also Stuxnet [https://en.m.wikipedia.org/wiki/Stuxnet]

I came across the tweet about this "Evil" dongle and instantly recognized it as the exact same thing I worked on before... It's not evil, it's just annoying.

https://blog.brixit.nl/making-a-usb-ethernet-adapter-work-sr...

In my case I disabled the SPI flash module to have it not appear as a CD drive, the author of this post actually found some documentation about the SPI being optional. Funnily enough this post now also gives you all the tooling to make an actual evil RJ45 dongle by reflashing one :D

Hm, why does shorting CS and S0 make it not work?

I have no idea about S0 but CS is usually chip select. It should be sufficient to short it to prevent the chip from being selected. However CS is frequently inverted and you would have to pull it up to prevent the chip selection, so maybe S0 is always high and inhibit CS

That makes sense, thank you.

SO (MISO) should generally be high impedance if not selected...

I suspect this causes SO to always output the same value and the Ethernet controller must expect some magic

Thanks you for refreshing my memory, I learn about that in college twenty-something years ago but never used that knowledge!

Shorting almost any two of the communication lines of the flash chip will corrupt the communication enough that the ethernet controller thinks there's no flash installed at all.

What happened to U3 at the top left in the image of the flash chip?

Looks like they had a footprint for a diode in a 3-pin SOT23 package and found they didn't have stock of the special part, so they installed a SOD323 diode at a 30 degree angle across two pins...

I'm pretty sure that's exactly what happened

Or it was meant to be toggleable.

> Funnily enough this post now also gives you all the tooling to make an actual evil RJ45 dongle by reflashing one :D

Ironic! I'm convinced most security problems are caused by well-meaning people breaking down hard- and software and explaining how to "hack" things. I mean if that's unintentional than at best it was security by obscurity to begin with which should be exposed so people don't rely on it.

“I'm convinced most security problems are caused by well-meaning people breaking down hard- and software and explaining how to "hack" things.”

Huh?

If you think some curious spare-time white-hat hackers are the main cause of most security problems, you grossly underestimate the size and skillset of the black-hat hacking industry, and the unlimited profit-potential available in that field...

You can just buy a malicious USB cable, complete with a suite of payloads - from a US company, no less.

https://hak5.org/products/omg-cable

I hope someday some youtuber drops omg cable at my office for content. Preferably several.

And here I thought the main cause of most security problems was stressed developers on rushed projects where noone cares about security.

Is it possible to add an autorun.inf to the fake cd?

I actually really appreciate USB devices that masquerade as a storage device to provide their own drivers. I suppose in this day and age the "right" thing to do is to upload a bunch of stuff to microsoft servers so that it downloads whatever is needed upon getting plugged in, but I've observed enough stuff needing manually installed drivers to know that this isn't as apparently easy as it may appear to be. (For example, I very often need to download vendor-specific ADB drivers)

Anyways, I think it's clever for peripherals to help you bootstrap, and having the drivers baked into the device makes things a little easier instead of trying to find a canonical download source.

I appreciate them working out-of-the-box on Linux even more. And they mostly do, with Linux being the best PnP (Plug'n'Play — remember that with Windows 95? :) OS today.

But multiple modes of operation really made it harder for to configure devices like those 4G/LTE USB dongles: they will either present as USB storage, or one type of serial device or a CDC-ACM modem device (or something of the sort), requiring a combination of the tools + vendor-specific AT commands to switch it into the right mode. Ugh, just get me back those simple devices that do the right thing OOB.

> (Plug'n'Play — remember that

I remember it as Plug-n-Pray

I only know that phrase thanks to the Computer Man song that I’ve seen on YouTube.

> with Linux being the best PnP

as long as it isn't wireless or bluetooth

or large high DPI monitor

What's the issue you have with high DPI monitors? I've used 3200x1800 14" screens way back (on Fujitsu U904 when that came out: I found a review from 2014 online), 4k 24" Dell when it still required two DP cables for 60Hz, and more recently 4k 14" screens on X1 Carbon: while you need to configure scaling (I prefer 125% or 150% for UI elements, and fonts further increased by a factor of 1.4x), most programs work well with that (including non-native UI peograms like Firefox, LibreOffice or even Emacs).

For a long while there was an issue with multiple monitors which you want to configure with different settings: you couldn't.

I believe that is also fixed today with Wayland but I mostly stick to a single monitor anyway.

Programs? I meant kernel and drivers. I don’t even need to open an app. My ASUS laptop with a 4090 steadily fails with an LG 40WP95XP with anything else than 100% DPI. My previous ASUS N552VW failed quite often on kernel level because it couldn’t handle the built in 960M, and it definitely couldn’t handle at all my older ultra wide monitor (I don’t remember anymore what was the model exactly).

Please describe "failure": I've had a Sony Vaio Z with switchable Intel/Nvidia graphics in 2009 before Optimus (though that did require some tinkering), but had GTX 960 and GTX 970 (actually still do) in a couple of computers, along with an integrated Intel and AMD GPUs in a bunch of laptops.

Note that kernel is totally unconcerned with DPI in general: it only cares about physical pixels and reports physical dimensions to apps — if scaling caused kernel level issues, it might be related to proprietary driver issue (they frequently lag in Nvidia's case).

I never used ultrawides myself, but if the monitor did not report proper "timings" and available resolutions, you might have needed some manual tweaks.

For more than a decade I have used only 4k displays (in most cases with 10 bit color components) on all my desktops and laptops, all of which run Linux.

I have never encountered any problem whatsoever. Only in Windows I have encountered sometimes scaling problems.

The only programs with which I had sometimes problems in Linux with high-DPI monitors have been commercial applications written in Java, some of which were very expensive. However those problems were not Linux-specific, but Java-specific, because those Java programs behaved equally bad on Windows.

For some reason, there seems to exist a high percentage of Java programmers who are incompetent at writing GUIs and the programs written by them neither follow the platform DPI settings nor allow the user to select a suitable display font, making their programs unusable without a magnifying glass when using high-DPI monitors. Moreover, I have encountered several expensive Java applications that crash and die immediately when used with monitors configured for 10-bit color instead of 8-bit color, both on Linux and on Windows.

So in more than a decade of using only high-DPI displays, I have never had problems with native Linux GUI applications, I have seldom encountered problems with native Windows applications and I have very frequently encountered problems with Java applications, regardless of the operating system on which they were run.

> For some reason, there seems to exist a high percentage of Java programmers who are incompetent at writing GUIs

There's multiple GUI Java toolkits and they all equally suck in their own way. Eclipse for example uses SWT which translates to the native application toolkit, which "should" support HiDPI, but as you're limited to native widgets it's not very common.

Linux has out of the box support for the SBC-XQ hack, which is pretty much the highest quality, most widely supported (even by Apple hardware) low-latency-ish way to drive BT audio. Works exceptionally well. And switching profiles works better than under Windows.

fwiw the last time I had wireless issues was with an exceedingly cheap 2013 laptop built from tablet hardware. That required an out of tree driver for a few years.

I had a Lenovo Yoga a little bit ago and it took 3 years iirc for the kernel module for the wifi/bt chip to be merged.

Yeah, I hate it when vendors are slow to upstream their drivers too.

Linux Bluetooth got upgraded to best in class when Microsoft replaced the windows 7 Bluetooth stack with the present heap of flaming garbage.

Bluetooth works better under modern Linux than modern windows. I can go on for literal hours about this. Windows Bluetooth stack is the most broken and disgraceful pile of code I've ever had to work with.

In this specific case it makes a bit more sense, as when you need to install a RJ45 dongle is likely when you don't have a network connection.

While that's true, you'd also expect USB network devices to be standardized and have builtin drivers under all the main operating systems.

That would be desirable but it does not happen in practice.

All the USB network devices that I have ever used required specific drivers. Sometimes the drivers happened to be already bundled with the Linux kernel or with Windows, but frequently they were not.

Where do you buy such things? Every USB Ethernet card I've used in the last 10 years was either RNDIS or some version of USB-CDC. They've worked out of the box on both Linux, Windows and some even Android.

If you start the configuration of the Linux kernel and you go to "Device Drivers", then to "USB Network Adapters", you will notice that there are close to 50 such device drivers.

That should tell you that there are plenty of different USB Ethernet Adapters that you can find when buying one.

Among those that I have encountered more frequently have been several kinds of Realtek, and of ASIX, and of Aquantia.

Especially among the faster USB Ethernet adapters I doubt that there are many without custom drivers.

Some people may not notice this, if they are using only fat Linux kernels, with all the possible device drivers being enabled and compiled, but if you use a streamlined kernel, e.g. for instant booting, you may need to add a device driver whenever you buy such an Ethernet adapter.

> That should tell you that there are plenty of different USB Ethernet Adapters that you can find when buying one.

It doesn't tell you that at all. Linux contains tons of drivers for odd devices that you will never encounter in your lifetime.

>I actually really appreciate USB devices that masquerade as a storage device to provide their own drivers.

I appreciate the ones that don't need their own drivers in the first places. Sure something needs special drivers but things like usb sticks and mice should just work using the default ones and let you get the updates from the internet if you want them.

usb sticks and mice

And USB Ethernet, USB CDC-ECM/NCM has existed for a while and have drivers in common OSes. And yet we are plagued by USB Ethernet with custom drivers (some of which are not available for macOS on Apple Silicon).

Of course, PCIe over Thunderbolt is even better.

But can we achieve 10gig/2.5gig or even gigabit with that?

Yes. With an NCM Belkin 2.5Gbe dongle, I get ~2300/2300 last time I checked.

So, rather like NuBus? IIRC, cards for early Macintoshes often had at least a basic driver in ROM, written in either Forth or 680x0 assembly code.

I'm not sure what the current state of the art is, but for the longest time it was pretty common for USB peripheral ICs to have small flash devices attached to them in order to be able to store VID/PID and other USB config information, so that the device is enumerated correctly when it's plugged in and can be associated with the correct driver etc. And depending on when the device was designed, 512kB might have been the smallest size that was readily available via supply chain. It would not have been strange to use a device like that to store 10s of bytes!

The ISO thing is a little bit weird, but to be honest it's a creative way to try to evade corporate IT security policies restricting mass storage USB devices. I think optical drives use a different device class that probably evades most restrictions, so if you enumerate as a complex device that's a combo optical drive/network adapter, you might be able to install your own driver even on computers where "USB drives" have been locked out!

For a time, windows would more readily run an autorun from a disc than from a usb stick. Even if that disc was in an emulated usb disk drive.

And the "u3" flash drives that did this were a hot commodity for a little while!

Then came the iODD and the IsoStick...

That's because there was malware that spread via autorun, which is rather harder to do with read-only media, even if it's emulated.

When the system was designed, the way to get a CD to an end user was to spend at least in the range of ten thousand dollars to get discs mastered and pressed, and then convince physical stores to sell them for you. As well as being a lot of effort, there'd be a clear paper trail. You couldn't just burn one and leave it in a parking lot.

Even when you could, viruses didn't tend to spread that way.

Not all malware is viruses, which brings us back to the subject of the article.

What's so odd about this is that they add the flash ($), but skip the magnetics! It just has series capacitors and I don't think the jack has integrated magnetics since it's small and it wouldn't make sense to have a series cap as well.

Wow, good eye. You can see the PCB is designed to take either magnetics or series caps, but the caps would have to be DNP’ed.

I would actually be really angry to discover a USB Ethernet dongle I bought didn’t have magnetics built in.

There are cases when a USB Ethernet dongle without transformers can be dangerous.

For example, I use a USB Ethernet dongle to connect my router to a cable modem provided by the ISP.

The ground of the cable modem is at the potential of the shield of the coaxial cable, which comes from far away and the voltage difference between the coaxial cable and the ground of my apartment is big enough to give you a serious shock if you would touch an exposed metal part (normally there are no such exposed metal parts).

So it is essential for the USB Ethernet dongle to provide insulation between the incoming Ethernet cable and the USB port that is connected to the router, which is grounded at the home ground.

Do you have to wear thick rubber gloves to plug in the cable?

With well-made Ethernet cables, even when they are shielded, it is easy to not touch any conductor (the good shielded RJ-45 connectors have plastic sleeves covering the metal).

On the other hand, I would have to be careful if I would want to disconnect and reconnect the coaxial TV cable that comes from the ISP, where the threaded coaxial connectors have a metal part. This is how I have learned that the potential difference between the coaxial cable ground and my ground is big enough to cause a shock :-)

A difference in potential between grounds in industrial settings is also really common. Especially if one plugs two different pieces of equipment into two different branches of the building's circuit, without knowing it, and then connects those devices with something like ethernet. With 20m+ cables, it happens. :) You'll be very happy for isolation then. 1 to 5V difference is enough to damage electronics.

Are there "evil" USB ethernet dongles? Of course there are...(just not this one)

https://hak5.org/products/lan-turtle

The article admits this explicitly:

>Malicious hardware has plenty of precedent: it’s been used by intelligence agencies and private pentesters alike. Heck, a bit over a decade ago, I built an evil plasma globe for work. Still, we weren’t here to debate whether a malicious RJ45-to-USB adapter could be made. The important question was whether in this particular instance — as the poster put it — “the Chinese were at it again”.

Yeah, I found the link to the evil plasma globe ( https://lcamtuf.coredump.cx/plasma_globe/ ) to be a more interesting read than the article itself.

Not to mention the evil ethernet patch cable:

https://imgur.com/Gpgj7w7

Ah, it's the Etherkiller prank from the good old days. http://www.fiftythree.org/etherkiller/

RJ45 nazi here: these should be called 8P8C

I’ll show myself out

TIL. After maybe 25 years of using this connector, I've never heard it called 8P8C. I knew Ethernet has used other physical layers including coax, which I used to run between Amigas way back in the day. But, today I finally learned about 8P8C.

RJ45 isn't even actually the same connector, at least not in the original FCC naming. That was an 8P8C keyed modular connector. RJ45 connectors had only two of the positions connected to wires (one phone line) an internal resistor between two of the other positions, and a keying bar that stuck out of the plug so they wouldn't even go into the unkeyed 8P8C jacks we use for Ethernet.

So I'll still call them RJ45 connectors. Because nobody has time to say "8P8C unkeyed modular connector" every time!

Weren't phone lines something like RJ11 or RJ12?

FWIW, TIL about 8P8C.

Yes, and RJ45. It used to be defined by the US FCC[1] in 47 CFR Part 68 Subpart F. Along with others, like RJ31X, RJ38, etc. The "RJxxy" numbers were the Universal Service Order Codes (USOCs), the `y` value described the use (e.g. W for wall-mounted jacks). Pages 143 & 144 of the PDF (403 & 404 of the print version) have the electrical connection diagram and the USOCs, pages 125-129 (385 -389 print) have the mechanical drawings. The unkeyed 8p8c connector we use today is also in there (pdf pgs 103-113), but the RJ45 series used the keyed connector! It's RJ31X & RJ38X that used the unkeyed 8-position series jack & 8-position plug we call RJ45 today (pdf pages 137-138).

[1] https://web.archive.org/web/20170705131407/http://www.tscm.c...

Thanks, it's funny how these things happen with language!

Similarly, it's DE9 not DB9

Yep, and these days ribbon cables are rare, instead we have Flexible Flat Cables or Flexible Printed Circuits. Ribbon cables are the old cables like IDE hard drives used, with insulation displacement connectors, while FFCs and FPCs are much thinner and use integral connection schemes (tinned pads on the cable itself get clamped by some sort of connector on a PCB).

Though the pinout was influenced by the phone standards, that’s why the first two pairs are nested into each other in the center, which you obviously wouldn’t do for a high-speed digital interface.

Heh I think anyone who studies for the Network+ ends up debating every time RJ45 is mentioned whether to make this comment or not haha

I don't mind calling the connector an RJ45, but calling this thing an "RJ45 dongle" makes my eye twitch. It's an Ethernet dongle - RJ45 can be used for a lot of other things. For example I've seen "RJ45 dongles" that convert USB to RS232 serial for the console ports on a lot of networking equipment.

https://studiohub.com/

At least they didn’t call it a wired WiFi dongle.

I now have Forest Whitaker Eye.

I did wired WiFi for CES one year. Made having our iot devices on WiFi on the floor much better than other vendors. It’s a long boring story but it was a fun hack.

Spill!

I’m actually really interested: I have a piece of stage lighting, that has a 2.4 GHz Wi-Fi controller. I’d love to convert this to wired Wi-Fi. Can you share what is necessary to achieve this hack? Can I “just” run antenna cable between router and controller? Or what kind of radio physics needs to be understood?

Truly wired WiFi is easy with the devices that have threaded SMA connectors for antennas, e.g. the motherboards or the mini-PCs that allow the use of external antennas.

With those you just need coaxial cables of appropriate lengths, also with SMA connectors, for making point-to-point connections.

If you want a network where each device can talk with any other devices, you also need a splitter, also with SMA connectors.

Many WiFi M.2 2230 cards have MMCX coaxial connectors on them, which allow the connection of internal antennas attached somewhere on the case of the laptop or mini-PC.

For these, there are MMCX to SMA adapters, which you can use together with SMA cables.

Some M.2 cards have even smaller U.FL coaxial connectors. For these there are U.FL to SMA adapters.

For devices that do not have any standard antenna connectors, one may need to modify them, to solder some RF connectors, which is hard to do without greatly lowering the quality of the WiFi links, due to additional attenuation and reflections.

If you build this and expand this to a blog post with some photos and some demo, you can post it here and I guess it will get a lot of upvotes.

Unfortunately, I no longer have the opportunity to do this.

Some years ago, I have been working in designing certain kinds of WiFi devices.

For their testing in a laboratory, a wired setup was used, exactly as described, i.e. with SMA coaxial cables replacing the antennas in the units under test, together with splitters and/or directional couplers to implement multi-point networks, and together with attenuators to simulate a greater distance between the units under test.

The majority of the tests concerning hardware and software were done using the wired setup, which allowed the simultaneous testing of a great number of units in a small space, without interference between their different tests. Only a much smaller number of tests was done with antennas, on the units that had already passed all hardware and software tests, so only the behavior of the antennas remained to be checked.

Such tests in wired setups were done both for the production units, for quality control, and for prototypes, where new versions of hardware and/or software were developed, and it made no sense to waste time with wireless testing until the new hardware and/or software was proven to be completely functional in the wired setup.

In a testing laboratory, there would be a huge amount of coaxial cables and adapters, attenuators, splitters and directional couplers, and of WiFi interfaces, so demonstrating a complex setup would be easy. Otherwise, collecting enough devices and accessories to make an impressive demonstration would be costly when you do not actually have a need for those devices.

In a home where you have an Internet router/gateway that has external WiFi antennas and you have a desktop using one of the many motherboards that include a WiFi interface with connectors for external antennas, you could use an SMA coaxial cable between your desktop and the router/gateway, instead of using an Ethernet cable.

This would be the simplest example of wired WiFi. There are cases when this would be a good idea, e.g. when the router/gateway has only few Ethernet ports for local devices and those are already occupied by other computers. In this case buying an SMA cable may be preferable to buying an additional Ethernet switch and also preferable to a wireless connection, if your home has many neighbors who also use WiFi, creating a congestion that slows down the wireless communication.

Anecdote time (but in a more simple case): Like 15 years ago, I got tired of too many wires at home and I bought a wifi pci for my desktop computer. The problem was that the antenna was in the back, so the computer was blockink the signal. I bough a SMA extension to be able to put the antena on top of the computer and it worked like a charm. Best $5 ever.

I would imagine that the stage lightning microcontroller is running a variant of ESP8266 or something similar where the "antenna" are actually thick traces on a circuit board (https://www.electronicwings.com/storage/PlatformSection/Topi...). This is obviously good enough for regular WiFi, but I would imagine this would complicate an attempt for wired WiFi tenfold.

But ethernet is also used with different connectors so that wouldn't be specific enough either.

Maybe we can all agree to call them Ethernet over unkeyed 8P8C dongles.

Don't show yourself out. Stay and remind people. It's important, since these two aren't interchangeable in both directions.

Or RJ31X or RJ38X, both of which did use the 8P8C modular connector in its unkeyed configuration.

Please don't call yourself an "RJ45 nazi" as it devalues the problem of actual nazis

On the general topic of USB to 1000BASE-T (and now 2.5 GBaseT) dongles, for people who care about performance, it's good to know about the distinction between those that are USB devices and those that are PCI-Express devices.

Basically, what do you get if you hotplug it into a laptop running a current linux kernel and do "sudo lsusb -v" vs "sudo lspci -v"?

The ones that are native PCIE devices offer much better performance, up to 2.5 GBASET line rate, and will communicate with the host over the implementation of thunderbolt over USB.

The ones that are USB only might work okay, but there's a reason they're cheap.

Of course a cheaper laptop also won't have any implementation of thunderbolt on it, so that's something to consider as well.

Could you elaborate on why the USB ones are worse?

Per Wikipedia, USB 3.0 (from 2008) can reach 5 Gbit/s, so (naively?) one would expect them to reach 2.5 GbE line rate easily, right?

USB doesn’t provide any DMA (until USB 4) and requires more host cpu resources to meet the same bandwidth. It also has less consistent performance by virtue of the USB protocol itself.

I am confused by this, I worked on a Linux USB driver that used DMA in 2003.

DMA from device to host directly rather than from host USB controller to host memory.

When I worked on it, the USB controller was just a pci bus device that once set up, the incoming data, from a USB ADC, streamed the data in blocks directly to memory. Maybe they took all that back out.

They didnt remove anything. Did the USB Controller DMA Master support DMA chaining or command lists?

Ethernet controller being a dma master means it can continually plop packets where it wants without CPU intervention. Infamously Realtek RTL8139 10/100M chip was the first Realtek with DMA mastering support, but it was brain dead implementation https://people.freebsd.org/~wpaul/RealTek/3.0/if_rl.c:

>"The RealTek 8139 PCI NIC redefines the meaning of 'low end.' This is probably the worst PCI ethernet controller ever made, with the possible exception of the FEAST chip made by SMC. The 8139 supports bus-master DMA, but it has a terrible interface that nullifies any performance gains that bus-master DMA usually offers.

For transmission, the chip offers a series of four TX descriptor registers. Each transmit frame must be in a contiguous buffer, aligned on a longword (32-bit) boundary. This means we almost always have to do mbuf copies in order to transmit a frame, except in the unlikely case where a) the packet fits into a single mbuf, and b) the packet is 32-bit aligned within the mbuf's data area. The presence of only four descriptor registers means that we can never have more than four packets queued for transmission at any one time.

Reception is not much better. The driver has to allocate a single large buffer area (up to 64K in size) into which the chip will DMA received frames. Because we don't know where within this region received packets will begin or end, we have no choice but to copy data from the buffer area into mbufs in order to pass the packets up to the higher protocol levels.

It's impossible given this rotten design to really achieve decent performance at 100Mbps, unless you happen to have a 400Mhz PII or some equally overmuscled CPU to drive it."

Afaik 10 years later 1Gbit RTL8111B required alignment on 256 byte boundaries so not much better.

at least for Gigabit speeds, the CPU usage is negligible if the device and the driver are communicating through CDC-NCM protocol, but yeah it's a significant hit if you're using CDC-ECM...,

I've only got superficial knowledge in this regard, so please take it with a grain of salt, but: the way I understand it is that PCIE has full direct memory access, so devices connected through it can use zero copy and similar techniques to access and process data much faster, especially with lower latencies than over regular USB. Using USB might/will require copying the data to transfer/read from and to different buffers, between user/kernel space, etc.

Also, PCI can have peer to peer connections, skipping the CPU entirely. See e.g. https://developer.nvidia.com/gpudirect

I'm guessing if I accidentally got a pci-e one, it wouldn't work in any of the USB ports I would connect it to (as, to my knowledge, I only have USB ports), or do they generally fall back to working as a USB device?

Realtek RTL8156 (USB 2.5G ethernet) is fast and rock solid, even for server use cases. I’d take it over an i225 any day

Not only 2.5GBaseT. I have a 10GBase-T Thunderbolt dongle (from [1]). Okay, it's a little bigger than a normal dongle, and it has a USB-C female port instead of a builtin cable, and it gets warm. But it's basically a dongle, and I can get 9.4Gbit/s through it with iperf3 on my Mac.

Unsurprisingly, it shows up as a PCIe device.

[1] https://www.amazon.com/gp/product/B0DHSWSSBY

there is no PCI-e through USB though, other than Thunderbolt/USB4 or is there?

so if you only have USB ports and care about performance the bigger distinction would be if the USB ethernet device implements CDC-NCM or just CDC-ECM, with the distinction being that CDC-ECM sends the frames to the driver one-by-one and the driver has to acknowledge and process them one-by-one which generates ton of CPU work, while the newer CDC-NCM protocol sends frames in batches...,

on my laptop I can still get full gigabit speeds with a 1Gbit ECM dongle but when I do it uses 100% of one CPU core, while a 1Gbit NCM dongle has negligible CPU usage...

A harmful connection to the Ethernet port would be extremely difficult. A harmful connection to a USB port is extremely easy. Call it what it is: an "Evil" USB dongle that happens to also have an Ethernet socket.

Embedded storage was actually very common some decades ago, remember seeing it in a lot of devices, mostly 3G USB Modems, there was even a AT command to enable/disable it.

Seems that the origin of the "chinese hack" theory can be just resumed to: younger people not being used to this kind of old stuff.

Cheap rj45 ethernet to USB adapter contains malware

https://news.ycombinator.com/item?id=42679498

Don't give clicks to grifters.

In cases like this I prefer more context , like

> Discussion in HN of the article debunked here:

> httpwhatever

"It is already possible for an assassin to send someone an e-mail with an innocent-looking attachment. When the receiver downloads the attachment, the electrical current and molecular structure of the central processing unit is altered, causing it to blast apart like a large hand grenade.”

I feel like that might have been what took out a neighbor down the street.

Sorry, I got distracted by the newspaper clipping in the article and had to laugh.

I think there is also sometimes similar suggestion towards the SPI chip underneath the OrangePi Zero 2W pcb as the producer suggests it is just a micro linux installation to test the function of the board without having to install a full sd card OS. Perhaps somebody would like to investigate that.

@lcamtuf: It's Igor Pavlov, not Ivan Pavlov

Brought to you by Epcyber CEO. All their trainings are OSINT on China. Of course this company is full of clickers, using just automated tools.

> If you want to try it, be aware that it requires Intel Pentium 166MHz or above.

:-D

For me the takeaway is that Weekly World News still sways minds.

TLDR: it is not "evil"

All USB-to-Ethernet adapters are pretty evil in my experience. Always terrible performance, often slower than WiFi.

Old custom software, old hardware, vendor wants all the $ for an upgrade, we refuse to pay. I took 10 desktop pc's($500 each) replaced servers ($20k each), one usb to ethernet dongle in every pc b/c we needed 2 network ports and we had this laying around, USB3 to GB, slap virtualization with USB passthrough. They work for 5+ years, gigabit speed, 24/7 with no problems.

People should have more faith in dongles. Not all are bad.

RTL8156B does line-rate 2.5 Gbit/s no problem, most USB-C docks with network have a RTL8153B in them and that does line rate as well. Even mildly dodgy first-generation stuff like AX88179 generally works.

I.M.H.O. these USB dongles are actually preferable to the much more expensive Thunderbolt dongles praised below, because a) they work on regular USB ports as well b) they do not require Thunderbolt c) they use less power and d) they don't force a highly ventilated cooling mode on certain host systems. And, fwiw, at least some Thunderbolt docks actually used USB NICs connected to the internal USB controller, which was hooked up over PCIe.

I don’t remember the exact issues, but I remember seeing years ago my old Intel MacBook had noticeably higher cpu usage when connected to and using a Pluggable dock which had a Realtek Ethernet chipset. Switching to WiFi reduced cpu usage. AFAIK had something to do with bad and/or lack of hardware processing in the Realtek chipset so it had to do it on the cpu.

Now I never trust anything with Realtek in it, and if buying anything with an Ethernet port, I try to make sure it’s not Realtek. Is this still valid concern, or is Realtek better now?

I've used tons of Realtek stuff since the early 2000s and have had only one single device misbehave - the infamous RTL8139 Fast Ethernet which had many bad batches unleashed onto the world. I have both bad and good versions of this chip. It burned a lot of people back then, many of whom to this day stubbornly refuse to grow up from their trauma, and keep saying that everything Realtek is bad and can never be trusted.

It’s actually kinda funny when people say they’d only use Intel NICs (because of their good experience with e1000e), but then you look at Intel’s NGBASE-T (2.5/5 Gbit/s) trash fire or the X710 issues and they’ve just not been good for post-gigabit consumer-ish stuff. Granted, maybe the 19th stepping of i225 finally fixed something, I dunno.

I remember in the Intel days, the Apple Thunderbolt 1 GbE adapter would have high CPU usage when you were transferring at the full 1 Gbps.

I've had good luck with the Realtek 2.5 GbE adapters, no CPU usage issues.

And these days even with a 10 GbE Thunderbolt adapter the CPU use is negligible, so things have improved across the board I think.

USB-to-Ethernet adapters are life savers when you need to:

(A) replace your WiFi adapter - download drivers from internet

(B) configure a router or other equipment (hard to configure WiFi without WiFi).

(C) stand up your Linux install on your laptop (easiest way to futz around until you get WiFi adapter working - but check chipset on adapter is compatible which the cheapest usually are)

You don't usually care about the performance. Just keep a cheap one in your box of shit - I need mine often enough. If you need high performance, then buy a high performance adapter.

Not saying they're not useful for specific purposes. But anyone buying them hoping to improve performance compared to their WiFi, often comes away very disappointed.

In my case A) and B) are irrelevant because I only really own or deal with laptops now days, and they invariably have built in WiFi, but usually not built-in Ethernet!

Your point makes no sense to me. A cable is often useful when WiFi isn't.

Case (A) is common for laptops. I've had plenty of WiFi modules (M.2?) go intermittent connection on friend's Windows laptops over time (maybe component drift?). For Linux on laptops I usually replace the manufacturers WiFi module so I get something better supported (high reliability - used to be Intel). Some people upgrade their module e.g. to get higher spec WiFi.

For (B), configuring WiFi routers is often easier with an Ethernet cable and sometimes necessary (depending on circumstances), and you need a cable to configure many other devices e.g. point-to-point links or whatever.

The fact you have a WiFi laptop is exactly why an adapter is really useful.

In my case, if I want ethernet it's because I want faster performance (reliably/continuously high bandwidth, and reduced latency and jitter) than my WiFi network can provide. But I've only been able to get that with a thunderbolt-connected ethernet adapter. Every USB one I've tried has been a disappointment.

I don't disagree that the uses you describe make them helpful in those circumstances, but I can't recall ever needing to do any of that myself. I'm happy with the built-in Wifi adapter and its drivers, and all modern routers can be configured/set up over WiFi, can't they? They create a default network when first turned on, or if you factory-reset them using the physical reset button.

I have a 2.5 GB/s USB to ethernet adapter. While I cannot say whether the performance matches that of built-in ethernet, transfer rates are fairly close to 2.5 GB/s. That is certainly faster than WiFi.

Oddly enough, point (A) is likely more relevant in the current world of laptops. At least if you use Windows. Plugging in a supported network adapter, may that be WiFi or Ethernet, may be the only way to get through the installation process, without jumping through hurdles, then install drivers for the built-in WiFi adapter, without jumping through another set of hurdles. (I own such a laptop, though I use Linux on said laptop so the WiFi just works.)

Using wired instead of wireless can also help reduce load when your network starts to get congested, since it's not (as much) of a shared medium as wifi (radio vs switched network)

In my experience they always held up the 100 Mbit/sec claim for lower-end variants, and an acceptable 350-ish Mbit/sec on USB2-backed GbE devices. I have no experience with GbE USB3 dongles.

This is not my experience.

I have used many 1000BASE-T dongles and they work exactly as advertised - capable of transferring at ~950Mbps.

I have also used 2.5GBASE-T dongles and speeds are in the 2Gbps+ range.

WisdPi are even offering dongles with 5GBASE-T support (RTL8157 chipset):

https://www.wisdpi.com/products/wisdpi-usb-3-2-5g-ethernet-a...

It will depends on your USB ports.

I use 2.5 GbE USB adapters and they work great... as long as they're in the right port.

Half of the ports on my Thunderbolt dock are provided by a shaky ASMedia USB chipset and it drops or lags after an hour or so. The other half of the ports use a more solid Fresco Logic chipset and I left an iperf + ping running overnight and it was a solid 2.3 Gbit 0.x ms the whole time. The built-in Apple ports are also solid.

So many wtf here. If anything this proves it is backdoored network card

1) downloading Windows exe files from Chinese forums

2) the USB storage provided by network card can still contain malware,

3) or can be accidentally booted from

4) it has universal USB controller, so can become any HID device: keyboard, mouse...

It proves it might be possible to backdoor it. Maybe.

I don't know of any modern systems that will execute anything on a newly inserted drive, nor boot from an external drive in the default configuration.

So we are missing a couple of things. First, a vulnerability in the OS/system. Second, an implementation of that vulnerability in a device like this.

Should this design be phased out? Perhaps. There is relatively little difference between not populating the flash memory part of the board and a proper network-only implementation.

>2) the USB storage provided by network card can still contain malware,

That seems unlikely given that "malware" is signed by Microsoft Windows Hardware Compatibility Publisher.

https://news.ycombinator.com/item?id=42680282

> 1) downloading Windows exe files from Chinese forums

VMs exist. I highly doubt the author daily drives windows XP.

> 2) the USB storage provided by network card can still contain malware

Well yes, but so can any other drivers. Downloading from the manufactures website isn't any more secure. Even signed drivers have been caught doing nasty stuff.

> 3) or can be accidentally booted from

True, but again this is quite a convoluted, noticeable, and unreliable way to compromize a system. Just injecting a handful of keystrokes will do it, and once the dead is done, the device can hide all evidence of malicious intent.

> 4) it has universal USB controller, so can become any HID device: keyboard, mouse...

This isn't wtf: a lot of devices nowadays are just microcontrollers hooked up to a USB connector. Quite a few normal USB drives can be reprogrammed to act as keyboards, and be used to get up to all sorts of shenanigans, including ones made outside of China.

1) China is a country, and in that country people use Windows and make /stuff/ that runs on Windows. A flash tool, which was only intended to be distributed to OEMs, only being found on obscure forums is in line with what I've experienced with similar NAND or BIOS flashers.

2) Any USB storage can contain malware. The driver that this one stores is digitally signed by Microsoft as mentioned in the article.

3) If there was a MBR boot block or EFI file, sure. But there isn't. See 2. And that would still require the user to have Secure Boot disabled and USB as the first boot option.

4) So any device with a universal USB controller is "prove[d] backdoored"?

Reply on news.ycombinator.com