Years after the “BadUSB” flaw was discovered in virtually all existing USB flash drives, security researcher Mike Grover demonstrated that attackers could also turn seemingly harmless USB cables into tools that allow them to hack your devices remotely.
O.MG Cable
Grover said that he was able to build a USB cable -- dubbed the "O.MG cable" -- with an embedded Wi-Fi controller that could receive commands from a nearby smartphone and then execute malicious payloads on the target PC or smartphone.
The victims may think they are using a generic USB cable, but the PC will recognize the cable as a Human Interface Device, much like it would a mouse or keyboard, giving the attacker just enough permissions to wreak havoc inside the system.
As you may already know, a mouse or keyboard can be used as soon as it's plugged into a PC, even if the system is locked with a password or biometric, which means these peripherals can bypass the operating system’s protection features and gain access to some system resources right away.
How the Demo Attack Worked
To demonstrate his attack, Grover plugged the malicious cable into a MacBook and used his own smartphone to remotely trigger a visit to a fake Google login web page asking for victims’ credentials.
The researcher noted that this attack also works against Windows, Linux, and iOS devices. The attacker only needs to trick the victim into plugging in the cable and then the victim’s device can be taken over via various exploits delivered through the cable. The attack can be expanded from a single device to an entire Wi-Fi network or even a cellular hotspot.
Grover was able to put the Wi-Fi controller inside his USB cable by using a $950 CNC milling machine to help enclose the chips inside the USB end of the cord. The researcher plans to create more cables so that more people can see for themselves how the attack could work.
This new type of attack is a reminder to everyone that you shouldn’t plug just any USB-type device, even if it’s just a cable, into your own devices. Otherwise, you risk getting hacked, or worse, having your devices maliciously fried.
