USB Cables are not always what they seem!
Universally protect yourself from malicious cables with simple off the shelf tools.
If you’ve never heard of the “O.MG cable”, it’s probably a good place to start to understand the problem.
Cables with hidden implants, able to send keystrokes, exfiltrate data and be controlled over wifi — These were once the in the toolbox of $10,000 a time nation state actors, they’re now $100, and look as near as dammit identical to the cable you’d get with your shiny new iPhone.
Subtle differences- without the yellow clips would you notice?
While we can carry our own cables (wise) and not use random USB ports in airports to charge our devices (even wiser), we live in an age where blindly trusting the supply chain of our cables is probably a bad idea.
Are you sure that new apple cable you grabbed in Walmart is really an apple cable? how?
The solution?
Power monitoring. Use any cable, just test it first!
Computers need power, tiny malicious computers in our cables are no different, we can easily check for power draw with USB cable testers, like this one from Amazon for less than $20.
Any cable, showing more than zero watts (red) or zero amps (green) is 100% suspicious, a cable with nothing connected to the other end should draw zero power and should have a high resistance (shown here as 999.9 ohms in blue).
Lets see this on my regular iPhone lightning cable:
Good! Zero power draw, i’d use this cable.
And now the O.MG cable:
Run away, it’s got some active electronics in it.
One more piece of the puzzle
Last but not least, why would we trust the random computer in the USB tester? After all we’re plugging it into something right?
This is key, we dont, and we shouldnt. We only plug the tester into a USB battery pack to give us power while we test the cables, never into a PC/phone/system.
I use this Anker USB-C portable pack. Not sponsored at all, but I find Anker power/charging stuff really reliable and well built.
Future attack vectors
Right now, this will give you a pretty solid level of confidence in the cables you’re using. But, I can imagine where attackers will go next to defeat these types of test.
I’d imagine we’ll start seeing cables that only power up their implant when a circuit is made to the end device, meaning there would be no readings for an unplugged cable like above.. In this case, dummy “devices” with a known resistor value could be used on the end to see if the resistance is the same as expected once both ends of the cable are “plugged in”.
A more tricky problem to test for is moving your implant into the power supply itself, transformers draw current even when not plugged into anything, so it would be hard to detect on the mains/AC side.
What do you measure between if the implant is in here? It’s USB-C out after all.
I hope this is useful information, stay safe out there kids
(and please, don’t charge your phone from USB ports in airports!)
Originally published on Medium on 31 May 2023.