HN Explorer

12 comments

[ 2.1 ms ] story [ 18.4 ms ] thread
spuz
Is this simply a USB keyboard or does it exploit some vulnerability to access the host device?
blinky1456
I think it is just a USB keyboard like the rubber ducky.

The cool thing is how small it is, and it having wifi.

I have seen this guy showing some of his stuff off before on hak5's youtube.

Would be interesting to see if it could be put into a mouse USB, with passthrough so the user can use the mouse as normal. But I guess you could just stick it inside the mouse casing...as long as somebody doesn't inspect the insides of the mouse.

xupybd
Im impressed that he did that with a mill. I’ve used a laser printer, uv box and acid before. I think the setup cost less than $100. Easy to mess up fine tracks however.
misnome
Yes, I'm also impressed - I've used a mill for PCB's before, experimentally, and couldn't get very fine tracks even with height testing and mapping, though this was on a cheaper c-beam CNC. Will be interesting to see the follow-up he mentions.
equalunique
That is the most interesting part of this submission IMO. I will follow his twitter and wait for more updates on his prototyping process.
TorKlingberg
Any information on what the cable actually does? This reads like an out of context blog post.
saagarjha
There’s a video that suggests it emulates a keyboard to control the computer it’s attached to.
pjc50
The professional variants of malicious USB cables can fit a whole GSM in there: https://boingboing.net/2017/11/15/cottonmouth-for-the-rest-o...
kanox
This is crazy scary and also cheap. How do you defend against something like this?

In theory the OS could warn whenever an unrecognized hardware device is attached but nobody does it and AFAIK there is no "authentication" support for devices.

pjc50
For these (unlike the one in the original article) they're just powered by USB, making them invisible to the OS.

USB-C has gone the other way and introduced the concept of authenticated chargers, which means you now need an X509 parser in your plug.

tracker1
I blame all the crappy cable mfgs for that one myself. It's impossible to tell a good cable capable of fast charging vs one that just says it is short of testing with your devices and knowing what to look for on screen regarding fast charging.

I've recently just stuck to overpaying for google/apple chargers and cables to keep it easier on myself. Been burned too many times.

theamk
It's a pity all we have is a video. I would love to see high-res pictures and real blog.