Fake lightning cable can be used to control your PC

[Bradley Prior]

Fake lightning cable can be used to control your PC

Security researcher Mike Grover has developed a prototype of a fake Lightning charger that can hijack a computer simply by being plugged in, Motherboard reports.

The malicious charger, which Grover showcased at the DefCon cybersecurity convention last week, can give an attacker full control over a Linux, Mac, or Windows system.

 

[whatwhat]

How is it a "fake lightning cable" if it charges the device?

Fake would imply it doesn't even cover the basic use case someone has to plug this into their computer in the first place.

 

[Lupus]

How is it a "fake lightning cable" if it charges the device?

Fake would imply it doesn't even cover the basic use case someone has to plug this into their computer in the first place.

Not made by Apple, that would make it fake.

 

[Rocket-Boy]

This is nothing new, its probably using the exact same concept as a malduino or similar.
A lightning cable on its own would be too small even for an ATtiny so its most likely hidden in the power supply.

 

[Totempole]

This is nothing new, its probably using the exact same concept as a malduino or similar.
A lightning cable on its own would be too small even for an ATtiny so its most likely hidden in the power supply.

No mention of a power supply. Specifically refers to the cable being plugged into the machine itself.

 

[RonSwanson]

Old fish.

 

[Takkies]

Sound like Apple wants to sell more cables, folks.

 

[Nod]

I'm sure the same could be done with any device you plug into a USB port.
A cable though would not be suspected by default.

 

[Rocket-Boy]

No mention of a power supply. Specifically refers to the cable being plugged into the machine itself.

Yeah I was going on this "The malicious charger, which Grover showcased at the DefCon cybersecurity convention last week" but after looking at the article I see its just the cable.
The concept is the same though, its hard to monitor HID inputs which are trusted by default. This just uses HID keyboard emulation which is why it gets away with it.

 

[MoHaG]

This is nothing new, its probably using the exact same concept as a malduino or similar.
A lightning cable on its own would be too small even for an ATtiny so its most likely hidden in the power supply.

You can get an ATTing in a 4x4mm QFN package...

Other microcontrollers are available as bare dies (Bare dies usually end up under a blob of black stuff (epoxy?) as often seen in calculators and cheap toys...). With a minimal / flex kapton-based PCB that should easily fit inside the USB connector...

 

[Kosmik]

Or maybe its in those bulge thingies meant to prevent the cable from breaking near the end.

 

[hackerjargon]

Do yourself a favor and go to his twitter (https://twitter.com/_MG_) and check out how he makes them and the videos. It's nicely done and very covert.

https://twitter.com/_MG_/status/1094389042685259776

 

[hackerjargon]

Yeah I was going on this "The malicious charger, which Grover showcased at the DefCon cybersecurity convention last week" but after looking at the article I see its just the cable.
The concept is the same though, its hard to monitor HID inputs which are trusted by default. This just uses HID keyboard emulation which is why it gets away with it.

'Charger' refers to the cable, not a 'power supply'. We in S.A call a 'Power Supply a 'Charger', so hence the confusion.

 

[Hunted]

'Charger' refers to the cable, not a 'power supply'. We in S.A call a 'Power Supply a 'Charger', so hence the confusion.

Don't get why some do that... My kids also refer to the USB cable as the charger... Sorry back on topic