Tag Archive for: tool

O.MG Elite Cable has power of a $20,000 hacking tool; can compromise iPhone, Android, Mac, PC

/in


Shown off at this year’s Def Con is an unassuming and powerful hacking tool, the O.MG Elite cable. With the physical appearance of a standard Lightning or USB-C cable, the hidden modifications mean this cable can log keystrokes, perform attacks, and even transmit data stealthily from air-gapped devices with its own WiFi network.

Seen by The Verge‘s Corin Faife at Def Con, here’s how creator MG decribes the creation:

“It’s a cable that looks identical to the other cables you already have,” explains MG, the cable’s creator. “But inside each cable, I put an implant that’s got a web server, USB communications, and Wi-Fi access. So it plugs in, powers up, and you can connect to it.”

One of the powerful things about the new O.MG Elite compared to its predecessors is the advanced network features mean it can handle bidirectional communications.

O.MG Elite can perform attacks and read data that’s passed through the cable, say between iPhone and Mac, or almost any other combination of devices as it comes in Lightning to USB-A, Lightning to USB-C, C to C, and microUSB versions.

Creator MG says that up until now, a cable like this would have sold for as much as $20,000. But it’s going from $180+ to early access customers.

Attacks, keylogger, and built-in WiFi

O.MG Elite is able to carry out keystroke injection attacks – which makes a device think it’s a keyboard typing commands. That opens up vulnerabilites like command line attacks.

“It also contains a keylogger: if used to connect a keyboard to a host computer, the cable can record every keystroke that passes through it and save up to 650,000 key entries in its onboard storage for retrieval later. Your password? Logged. Bank account details? Logged. Bad draft tweets you didn’t want to send? Also logged.”

X-ray highligting the implanted chip in O.MG Elite

As noted by The Verge, a big part of how scarily capable this cable can be is the built-in WiFi to silently send back data to an attacker – even on air-gapped devices.

“Many ‘exfiltration’ attacks — like the Chrome password theft mentioned above — rely on sending data out over the target machine’s internet connection, which runs the…

Source…

A hacker used a $25 custom-built tool to hack into SpaceX’s Starlink satellite system

/in


A $25 device that breaks into Starlink’s ‘Dishy’ system

Space has launched more than 3,000 satellites into low Earth orbit. Customers for the satellite internet service must pay a monthly fee of more than $100 as well as a hardware fee in excess of $500 to obtain the 19-inch wide “Dishy” satellite dish required for using the service.

Wouters developed a custom-made modchip to gain access to Dishy. According to Wired, this custom circuit board is attached to Dishy and it can be fairly easily made using off-the-shelf parts costing roughly $25 in total. Wouters has made the outline for how to build the modchip available on Github.

The custom-built device allows users to access Dishy’s software and it can launch an attack that causes a glitch, which hackers access locked parts of the system.

“The widespread availability of Starlink User Terminals (UT) exposes them to hardware hackers and opens the door for an attacker to freely explore the network,” Wouters wrote in the description for his briefing.

“Our attack results in an unfixable compromise of the Starlink [user terminal] and allows us to execute arbitrary code,” he continued. “The ability to obtain root access on the Starlink [user terminal] is a prerequisite to freely explore the Starlink network.”

SpaceX blocks cyberattacks at ‘eye-watering’ speed

SpaceX has already replied to Wouters’ warning about the flaw in its system by performing a software update that it believes should resolve the issue. However, according to Wouters the only way SpaceX can ensure others won’t gain access in a similar way is by creating a new version of Dishy’s main chip. It’s worth noting that Wouters didn’t share his findings to help others hack Starlink satellite dishes. Instead, he hopes it will help the private space firm to improve cybersecurity for its users.

Source…

The latest tool in the hacker arsenal: Microsoft Calculator

/in


Hackers have found an unusual and unconventional method to infect PCs with malware: distributing dangerous code with Windows Calculator.

The individuals behind the well-known QBot malware have managed to find a way to use the program to side-load malicious code on infected systems.

A depiction of a hacker breaking into a system via the use of code.
Getty Images

As reported by Bleeping Computer, Dynamic Link Libraries (DLLs) side-loading is when an actual DLL is spoofed, after which it is moved to a folder in order to trick the machine’s operating system to load the doctored version as opposed to the real DLL files.

QBot, a strain of Windows malware, was initially known as a banking trojan. However, ransomware gangs now rely on it due to its evolution into a malware distribution platform.

QBot has been utilizing the Windows 7 Calculator program in particular to execute DLL side-loading attacks, according to security researcher ProxyLife. These attacks have been infecting PCs since at least July 11, and it’s also an effective method for carrying out malicious spam (malspam) campaigns.

Emails that contain the malware in the form of an HTML file attachment include a ZIP archive that comes with an ISO file, which contains a .LNK file, a copy of ‘calc.exe’ (Windows Calculator), as well as two DLL files: WindowsCodecs.dll, joined by a malicious payload (7533.dll).

Opening the ISO file eventually executes a shortcut, which upon further investigation of the properties dialog for the files, is linked to Windows’ Calculator app. Once that shortcut has been opened, the infection infiltrates the system with QBot malware through Command Prompt.

The new version of the Calculator app in Windows 11.

Due to the fact that Windows Calculator is obviously a trusted program, tricking the system to distribute a payload through the app means security software could fail to detect the malware itself, making it an extremely effective — and creative — way to avoid detection.

That said, hackers can no longer use the DLL sideloading technique on Windows 10 or Windows 11, so anyone with Windows 7 should be wary of any suspicious emails and ISO files.

Windows Calculator is not a program commonly used by threat actors to infiltrate targets with, but when it comes to the current state of hacking and its advancement,…

Source…

Security tool will help protect against ‘quantum’ hackers

/in


A security tool picked up by the US Government is based on Auckland University research and will help protect against cyber attacks from “quantum” hackers.

Crystals-Dilithium is the name of one of four “quantum-resistant encryption systems” approved for use by the US National Institute of Standards and Technology last week.

“Quantum-resistant encryption” refers to security systems that can withstand attacks by quantum computers – a new generation of computers, hundreds of million times more powerful than the most advanced supercomputers today.

The system was built on research co-authored by Professor Steven Galbraith, Head of the Department of Mathematics at Auckland University.

Current cryptography methods rely on mathematical algorithms so complicated that even supercomputers would take millennia to solve, but the advance and wider accessibility of quantum computers would make this redundant.

In 2019, an algorithm expected to take IBM’s supercomputer Summit 10,000 years to compute was completed in a mere 200 seconds by Google’s quantum computer.

“A hacker with a quantum computer could decrypt a lot of sensitive information, including health records and national security information. They could also do industrial espionage by getting access to the intellectual property of companies,” Galbraith said.

New Zealand’s institutional cybersecurity (or lack of) was exposed when the Waikato District Health Board was hacked last year, leaving systems disabled and leaking confidential information.

The attack did not involve quantum computers, raising concerns regarding the inadequate cybersecurity practices in place now, let alone preventing attacks in the future.

“At the moment the only people with quantum computers are large governments and large companies like IBM and Google,” Galbraith said.

“Hackers do not have access to their own quantum computers. But the business model of IBM and Google will be to sell access to their quantum computers…much like how Amazon sells access to the AWS system for machine learning,” he told the Herald.

Post-quantum cryptography helps to prevent attacks by “quantum hackers”.

“Post-quantum cryptography is a more practical solution for the…

Source…