Hi, this is Wayne again with a topic “I wouldn’t give this cable to my worst enemy – O.MG Cable”.
This looks like an ordinary cable, but it’s actually a hacking tool So Sophisticated. It makes the flipper zero look like a Happy Meal toy watch. This once plugged in the OMG cable cannot only execute payloads, but it can allow Bad actors to upload new ones. Wirelessly inject Mouse movement, read your keyboard inputs and even self-destruct before anyone gets wise and the scariest part it is nearly undetectable by software and the newest version. The OMG cable Elite is already well beyond anything that we’ve seen in similar devices, with updates rolling out constantly that enhance its functionality and all for less than the price of a backpack from lttstore.com. But if all of this has you worried? Fear not because we’re going to be showing you both the full range of its capabilities, at least for now how to protect yourself and how to segue to our sponsor paradox. Paradox wants me to keep it simple here: play their hit strategy game, Crusader, Kings, 3, completely.
Free this weekend, starting May 11th and then City skylines next weekend party, like it’s 9 32 A.D at the link below. If you watched our previous video on the rubber ducky, you probably already have some idea what’s going on here, but for everyone else. Here’S a quick rundown inside the OMG cable is a microcontroller that connects to the host system, either by USB, a or type c and emulates a human interface device like a mouse or a keyboard. This allows this cable to input both Mouse movements and keystrokes at will, including injecting automated payloads that are created with ducky script, making this the first third-party device to license the language from hack 5., but there’s more.
This is not just a stealthier rubber ducky, aside from one being a USB stick and one being a charging cable. The biggest difference between the OMG, cable and the rubber ducky is the use of Wi-Fi. I know right as hard as it might be to believe inside this little USB connector is everything necessary to not only execute scripts but to generate a Wi-Fi network and host a simple web page now? The good news is that the range is not very far. Maybe 30 feet if you’re lucky, the bad news is stop looking around, because it can easily be extended with a commodity, Wi-Fi repeater and that’s not the worst of it.
The very bad news is that, even without that range extender, the OMG cable can be accessed at range, with just a few extra steps you see, unlike the rubber ducky, which is limited to a single payload, the OMG cable can hold multiple payloads eight. For now, with the promise of up to 200 in the future, so one of those payloads can just grab the Wi-Fi credentials of the PC as soon as it’s plugged in and then send them to a web server. That’S controlled by the attacker. The OMG cable can then be placed into what’s called station mode where it connects directly to your Wi-Fi and can be controlled by anyone else on the network but Linus I hear some of you saying my network is configured to only accept connections from approved Mac addresses. Oh you sweet summer, child. The OMG cable cares not for your pesky limitations.
It can copy Mac addresses with ease, and for that matter it can also change how it’s presented to the host system by changing its USB vendor and product ID manufacturer and product name and its serial number. So, by presenting itself as a common keyboard, it can gain access to a machine without running a foul of any security system. But remaining undetected is only part of the battle, the goal of any bad USB deployed by a bad actor. Be it a rubber ducky in OMG, cable or the plethora of other cheap devices out there is to move data to or from the Target, in a string of recent attacks by hacker group fin 7 packages containing bad USB devices were delivered to hundreds of companies around The United States, when their recipients mistakenly inserted the drive it type in a command to download and execute a Powershell script which, within only a few seconds, infected their systems with ransomware when plugged into a Windows.
Machine Powershell is the real source of strength for these devices, but similar vectors exist for nearly every system and once the newest OMG firmware comes out, it’ll be able to detect the operating system it’s connected to and then adjust its attack. Accordingly. Mac and Linux both have command line. Android devices can have apps installed through APK files and even on iOS there’s a lot that can be done once full keyboard support is enabled now, while there’s no current way to sideload apps on iPhones or iPads, at least not without connecting the device to a PC Or Mac, it looks like there’s a chance that EU regulations are going to force Apple, to allow side loading in some capacity very soon, of course, before the device can do any of that. It needs to gain access to your system. There’S not much. It can do from a lock screen. However, the OMG cable has two pretty solid ways of getting around that, at least for Windows, Mac and Linux. First up, it includes a mouse Jitter setting that will move the cursor very small amounts. Every few minutes keeping the system in an active state. So if the target user is the kind of person to trust their machine to lock when they walk away, the attacker will have an easy entry Vector since it won’t that’s how we got to Dennis. But even if the target is diligent about locking up, that’s barely a hurdle with the right connection with an OMG, cable or adapter placed between the keyboard and a Target, it can act as a key logger and then send out keyboard inputs over Wi-Fi.
When this information is put into a ducky script, payload, the attacker can then access the machine from a lock State without ever having to physically retrieve the device to grab the stolen data. However, data exfiltration or the act of grabbing data from a Target system isn’t as straightforward on the OMG as it is on the rubber ducky. The ducky can transfer data undetected by flashing. The caps lock light to signify binary pretty effective, but while the OMG cable lacks this feature, what it has is much better we’ll let Mike Grover the mg of OMG explain instead of uh doing anything, that’s visible on your keyboard uh.
It just opens up a kind of a raw hid socket on that endpoint and that allows you to bi-directionally send data and do so much much faster because you can send. I think it’s like eight plus bytes per packet uh. You know the the attacker, since this is red team. Dueling has a machine that catches the socket, and one of the most obvious use cases for that uh for a demo anyway, is like a reverse shell from from one to the other, so you can have like an air gapped machine that has a cable plugged into It uh and it’s not showing that a new network interface is up or anything like that and you’re still able to push data to add yet another level of sophistication.
The geofencing feature of the OMG cable allows it to lie dormant until it detects a particular Network or self-destruct if it leaves the vicinity of a particular Network, wait self-destruct yeah. You heard me in the event that an attacker gets spooked and wants to abort the mission or, if they’ve just completed their task and when a tie up Loose Ends. The OMG cable comes with two self-destruct options. It can either wipe out all the data but keep the device working or it can completely wipe everything and disconnect the data lines outright.
They aren’t physically severed, of course, and the cable can be restored using omg’s programmer and firmware update device. But the hope for the attacker would be that the target assumes the cable is broken and throws it away before. Anyone detects the breach and takes a closer look at it. Oh something like the OMG cable being so readily available is clearly concerning.
In fact, the FBI recently issued a warning against using public charging stations due to the risk of unauthorized device access over USB. A practice known as juice, jacking really juice jacking anyway, silly name aside. This is a very real threat and it’s worth familiarizing yourself and your loved ones, with some of the simple ways that you can protect against unauthorized USB devices. The first and most obvious one is to not use public charging stations thanks FBI, bringing your own charging, cable and box will not only keep you safer, but will probably charge your device faster for businesses.
Reasonable building security is a must. If you want to protect your workstations, adequate locks on points of Entry, tracking building access and keeping your space covered by security cameras are all good tips. Remember if someone can walk in and take something without getting noticed, they can walk in and plant something even more easily, and if you have any machines that the public can use, I would strongly recommend locking them away where the ports can’t be reached, not that that’s Even a bulletproof solution – I didn’t really mention it before, but the OMG cable is even available as a short extension. So if you have a keyboard with a removable cable, for example, this could easily be inserted in such a way that the target could fail to notice it.
So a better rule of thumb, then, is to assume that any public kiosk is compromised and never plug. In anything you found on the ground, even if it’s not a malicious device, do you really want your ports clogged up with dirt and dog food? Finally, the tip that everyone seems to give is to use a data blocker. There are several types out there, but the general idea is the same. They allow power to pass through, but not data, which is fine for charging phones, but not that useful for plugging in your keyboard. So for that, you might prefer the malicious cable detector which Mike created this is great, because his wife was tired of not being able to tell which cables in their house were OMG and which ones were benign. This one doesn’t block data outright, but rather it will detect nefarious cables and offers power filtering as a bonus.
Links to Mike’s blog post about data blockers and the malicious cable detector are down in the description now it’s time for the uncomfortable conversation that we always have to have around hacking tools Mike a bad guy, should his product even be legal. Well, here are the arguments for it. If you’re trying to stress the importance of cyber security to a group, you would be hard-pressed to find something more compelling than this. It’S tangible, you can hold it. It looks simple, but then it packs an absolute Wallop. In minutes, you can demonstrate how a well-placed attack could bring an organization to its knees.
With all of that said, though, you’re probably more likely to get hit by actual lightning than an OMG, lightning, cable, it depends what you’re going after there’s always exceptions here, but it’s like a general approach. These things are generally only going to be seen as a targeted attack, because the other ways of getting in work present now, whether it’s over the phone email, that’s going to be an easier way and for the most part, and when we’re talking about the the general Person they’re very susceptible to that right. Look at most of these companies getting breached like it’s their web services hanging out, so there’s so many easier ways in that I you know I would love for us to be in a world where everything is so secure that suddenly uh cables like this are actually A viable threat for most people but um for the most part. The value of these cables is for red teams, doing higher sophistication attacks against a company that they have to defend against nation states and high funded uh attackers. Those are all good points at over. A hundred dollars per cable – this is not the kind of thing the average gel is likely to come up against. So then, why are we making such a fuss here? Well, at sixteen hundred dollars, the RTX 4090 isn’t too relevant to most people, either still talk about it. It’S Tech, it’s gon na, come down in price and the way I see it, especially when it comes to this stuff, we’re better off learning about it.
Now, while it’s expensive than later, when it’s cheap and it’s too late – but it’s not too late to hear about our sponsor secret lab – you may know them for their Best in Class gaming chairs. But did you know secret lab makes desks too their Magnus Pro? Isn’T your average sit to stand desk, it’s packed with unique features, hate having loose cables dangling all over the place? Have the cleanest desk around with a patent-pending integrated power supply column and a full length, built-in Cable Management tray and, of course, the Magnus Pro is fully adjustable as a sit to stand desk with a Sleek integrated control panel and to top it all off, there’s a Full metal table top check out the Magnus Pro and all of secret lab’s other offerings at the link below. If you liked this check out our video on The Flipper zero, it’s just about the most popular Tamagotchi style hacking device and is very cool. .