- This looks like an ordinary cable,
but it's actually a hacking tool so sophisticated,
it makes the Flipper Zero (dolphin chattering)
look like a Happy Meal toy.
Watch this.
(upbeat music) (clock ticking)
Once plugged in,
the O.MG Cable cannot only execute payloads,
but it can allow bad actors to upload new ones wirelessly,
inject mouse movement,
(keyboard typing) read your keyboard inputs,
and even self-destruct (computer exploding)
before anyone gets wise.
And the scariest part?
It is nearly undetectable by software.
And the newest version, the O.MG Cable Elite,
is already well beyond anything that we've seen
in similar devices with updates rolling out constantly
that enhance its functionality,
and all for less than the price
of a backpack from lttstore.com.
But if all of this has you worried,
fear not because we're gonna be showing you both,
the full range of its capabilities, at least for now,
how to protect yourself, and how to segue to our sponsor.
- Paradox.
Paradox wants me to keep it simple here.
Play their hit strategy game, "Crusader Kings III,"
completely free this weekend starting May 11th.
And then, "Cities: Skylines" next weekend.
Party like it's 932 AD at the link below.
- If you watched our previous video on the Rubber Ducky,
you probably already have some idea of what's going on here.
But for everyone else, here's a quick rundown.
Inside the O.MG Cable is a microcontroller that connects
to the host system either by USB-A or Type C,
and emulates a human interface device
like a mouse or a keyboard.
This allows this cable to input both mouse movements
and keystrokes at will including injecting
automated payloads that are created with DuckyScript
making this the first third party device
to license the language from Hak5.
But (chuckling) there's more.
This is not just a stealthier Rubber Ducky.
Aside from one being a USB stick
and one being a charging cable,
the biggest difference between the O.MG Cable
and the Rubber Ducky is the use of Wi-Fi.
I know, right?
As hard as it might be to believe,
inside this little USB connector is everything necessary
to not only execute scripts,
but to generate a Wi-Fi network and host a simple webpage.
Now, the good news is that the range is not very far,
maybe 30 feet if you're lucky.
The bad news is stop looking around
because it can easily be extended
with a commodity Wi-Fi repeater.
And that's not the worst of it.
The very bad news is that even without that range extender,
the O.MG Cable can be accessed at range
with just a few extra steps.
You see, unlike the Rubber Ducky
which is limited to a single payload,
the O.MG Cable can hold multiple payloads,
eight for now with the promise of up to 200 in the future.
So one of those payloads can just grab the Wi-Fi credentials
of the PC as soon as it's plugged in, and then,
send them to a web server that's controlled by the attacker.
The O.MG Cable can then be placed
into what's called station mode
where it connects directly to your Wi-Fi
and can be controlled by anyone else on the network.
"But, Linus," I hear some of you saying,
"my network is configured to only accept connections
"from approved Mac addresses."
Oh, you sweet summer child.
The O.MG Cable cares not for your pesky limitations.
It can copy Mac addresses with ease.
And for that matter,
it can also change how it's presented to the host system
by changing its USB vendor and product ID,
manufacturer and product name, and its serial number.
So by presenting itself as a common keyboard,
it can gain access to a machine
without running afoul of any security system.
But remaining undetected is only part of the battle.
The goal of any bad USB deployed by a bad actor,
be it a Rubber Ducky, an O.MG Cable,
or the plethora of other cheap devices out there,
is to move data to or from the target.
In a string of recent attacks by hacker group FIN7,
packages containing bad USB devices were delivered
to 100s of companies around the United States.
When their recipients mistakenly inserted the drive,
it typed in a command to download
and execute a PowerShell script
which within only a few seconds,
infected their systems with ransomware.
When plugged into a Windows machine,
PowerShell is the real source of strength for these devices.
But similar vectors exist for nearly every system.
And once the newest O.MG firmware comes out,
it'll be able to detect the operating system
it's connected to, and then, adjust its attack accordingly.
Mac and Linux both have command line.
Android devices can have apps installed through APK files.
And even on iOS,
there's a lot that can be done
once full keyboard support is enabled.
Now, while there's no current way to sideload
apps on iPhones or iPads,
at least not without connecting the device to a PC or Mac,
it looks like there's a chance that EU regulations
are going to force Apple to allow
sideloading in some capacity very soon.
Of course, before the device can do any of that,
it needs to gain access to your system.
There's not much it can do from a lock screen.
However, the O.MG Cable has two pretty solid ways
of getting around that,
at least for Windows, Mac, and Linux.
First up, it includes a mouse jitter setting
that will move the cursor very small amounts
every few minutes keeping the system in an active state.
So if the target user is the kind of person
to trust their machine to lock when they walk away,
the attacker will have an easy entry vector
since it won't, that's how we got to Dennis.
But even if the target is diligent about locking up,
that's barely a hurdle with the right connection.
With an O.MG Cable or adapter placed
between the keyboard and the target,
it can act as a keylogger, and then,
send out keyboard inputs over Wi-Fi.
When this information is put into a DuckyScript payload,
the attacker can then access the machine from a lock state
without ever having to physically retrieve the device
to grab the stolen data.
However, data exfiltration or the act of grabbing data
from a target system isn't as straightforward
on the O.MG as it is on the Rubber Ducky.
The Ducky can transfer data undetected
by flashing the Caps Lock light to signify binary.
Pretty effective.
But while the O.MG Cable lacks this feature,
what it has is much better.
We'll let Mike Grover,
the MG of O.MG, explain.
- Instead of doing anything that's visible on your keyboard,
it just opens up a kind of a raw HID socket
on that endpoint.
And that allows you to bi-directionally send data
and do so much, much faster, because you can send,
I think it's like eight-plus bytes per packet.
You know, the attacker, since this is red team tooling,
has a machine that catches the socket.
And one of the most obvious use cases for that,
for a demo anyway,
is like a reverse shell from one to the other.
So you can have like an air-gapped machine
that has a cable plugged into it,
and it's not showing that a new network interface is up
or anything like that, and you're still able to push data.
- To add yet another level of sophistication,
the geofencing feature of the O.MG Cable
allows it to lie dormant until it detects
a particular network or self-destruct if it leaves
the vicinity of a particular network.
Wait, self-destruct?
Yeah, you heard me.
In the event that an attacker gets spooked
and wants to abort the mission
or if they've just completed their task
and wanna tie up loose ends,
the O.MG Cable comes with two self-destruct options.
It can either wipe out all the data,
but keep the device working.
Or it can completely wipe everything
and disconnect the data lines outright.
They aren't physically severed of course,
and the cable can be restored using
O.MG's programmer and firmware update device.
But the hope for the attacker would be
that the target assumes the cable's broken
and throws it away before anyone detects the breach
and takes a closer look at it.
Whew, something like the O.MG Cable being
so readily available is clearly concerning.
In fact, the FBI recently issued a warning
against using public charging stations
due to the risk of unauthorized device access over USB,
a practice known as juice jacking.
Really, juice jacking?
Anyway, silly name aside, this is a very real threat
and it's worth familiarizing yourself and your loved ones
with some of the simple ways that you can protect
against unauthorized USB devices.
The first and most obvious one is
to not use public charging stations.
Thanks, FBI.
Bringing your own charging cable
and box will not only keep you safer,
but will probably charge your device faster.
For businesses, reasonable building security is a must
if you want to protect your work stations.
Adequate locks on points of entry,
tracking building access,
and keeping your space covered
by security cameras are all good tips.
Remember, if someone can walk in
and take something without getting noticed,
they can walk in and plant something even more easily.
And if you have any machines that the public can use,
I would strongly recommend locking them away
where the ports can't be (clicking tongue) reached.
Not that that's even a bulletproof solution.
I didn't really mention it before, but, woo!
The O.MG Cable is even available as a short extension.
So if you have a keyboard with a removable cable
for example,
this could easily be inserted in such a way
that the target could fail to notice it.
So the better rule of thumb then is to assume
that any public kiosk is compromised
and never plug in anything you found on the ground.
Even if it's not a malicious device,
do you really want your ports clogged up with dirt
(dog farting) and dog doody?
Finally, the tip that everyone seems to give is
to use a data blocker.
There are several types out there,
but the general idea is the same.
They allow power to pass through, but not data,
which is fine for charging phones,
but (chuckling) not that useful
for plugging in your keyboard.
So for that, you might prefer
the Malicious Cable (banging desk) Detector,
which Mike created, (laughing) this is great,
because his wife was tired of not being able to tell
which cables in their house were O.MG
and which ones were benign.
This one doesn't block data outright,
but rather it will detect nefarious cables
and offers power filtering as a bonus.
Links to Mike's blog post about data blockers
and the Malicious Cable Detector are
down in the description.
Now, it's time for the uncomfortable conversation
that we always have to have around hacking tools.
Is Mike a bad guy?
Should his product even be legal?
Well, here are the arguments for it.
If you're trying to stress the importance
of cybersecurity to a group,
you would be hard-pressed to find
something more compelling than this.
It's tangible, you can hold it.
It looks simple, but then, it packs an absolute wallop.
In minutes, you can demonstrate how a well-placed attack
could bring an organization to its knees.
With all of that said though,
you're probably more likely to get hit by actual lightning
(lightning banging) than an O.MG Lightning Cable.
- It depends what you're going after.
There's always exceptions here.
But as like a general approach,
these things are generally only gonna be seen
as a targeted attack
because the other ways of getting in weren't present.
Now, whether it's over the phone, email,
that's gonna be an easier way in for the most part.
And when we're talking about the general person,
they're very susceptible to that, right?
Look at most of these companies getting breached,
like it's their web services hanging out.
So there's so many easier ways in that, you know,
that I would love for us to be in a world
where everything is so secure
that suddenly cables like this are
actually a viable threat for most people.
But for the most part,
the value of these cables is for red teams doing
higher sophistication attacks against a company
that they have to defend against nation states
and high-funded attackers.
- Those are all good points.
At over $100 per cable,
this is not the kind of thing the average Joe
is likely to come up against.
So then, why are we making such a fuss here?
Well, at $1,600, the RTX 4090 isn't too relevant
to most people either, but we still talk about it.
It's tech, it's gonna come down in price.
And the way I see it,
especially when it comes to this stuff,
we're better off learning about it now while it's expensive
than later when it's cheap and it's too late.
But it's not too late to hear about our sponsor.
- Secretlab.
You may know them for their best-in-class gaming chairs,
but did you know Secretlab makes desks too?
Their Magnus Pro isn't your average sit-to-stand desk.
It's packed with unique features.
Hate having loose cables dangling all over the place?
Have the cleanest desk around
with a patent-pending integrated power supply column
and a full-length built-in cable management tray.
And of course, the Magnus Pro is fully adjustable
as a sit-to-stand desk with a sleek,
integrated control panel.
And to top it all off, there's a full metal table top.
Check out the Magnus Pro
and all of Secretlab's other offerings at the link below.
- If you liked this,
check out our video on the Flipper Zero.
It's just about the most popular
Tamagotchi-style hacking device and is very cool.