Image: © marcoperulli/Stock.adobe.com
The creator of the device hopes it can be produced as a legitimate security tool, and wants to use it for educational purposes.
On Sunday morning (11 August), Forbes reported that a hacker was selling a malicious iPhone Lightning cable for just $200 at this year’s Def Con hacking convention in Las Vegas.
The hacker, known online as MG, informed followers that they could purchase the malicious cable – dubbed the O.MG Cable – which looks standard to the naked eye.
Speaking to Vice Motherboard at Def Con, MG said: “It looks like a legitimate cable and works just like one. Not even your computer will notice a difference. Until I, as an attacker, wirelessly take control of the cable.”
The reason that the cables are such convincing dupes of Apple’s USB cables, is because they actually are Apple cables that have been “painstakingly” modified by hand. MG told Motherboard that he had built the implants in his kitchen before integrating them into the cable, with each one taking four hours to assemble.
As detailed by Forbes, the cables still charge your phone, open iTunes and trigger the usual dialogue boxes. However, the wireless implant within the cable allows an attacker with 300ft, according to MG, to access it. If the cable is configured to act as a client to a nearby wireless network that has an internet connection, the distance “basically becomes unlimited”.
TechCrunch said the device “lets a nearby hacker run commands as if they were sitting in front of the screen”. The device also features a ‘kill switch’, which allows the hacker to erase the compromise when they have achieved their aim.
‘Educational’ tool
Prior to attending Def Con, MG shared a blogpost informing readers that a prototype of the O.MG Cable was available for purchase.
MG wrote: “There has been a lot of interest and support behind this project, and lots of requests on how to acquire a cable. That’s a great feeling!
“These are what I consider to be educational grade and not something capable of field use. But they do produce an ‘easy’ to assemble malicious cable that will send a HID payload to the target, provide a charge to the phone and be a ‘close enough’ visual representation of a legit cable.”
The end goal, according to the hacker, is to have these cables produced as a legitimate security tool. He said he’s working with the company Hak5 to make the potential tool from scratch as it’s too tedious to continue modifying Apple cables.
He told Motherboard: “Apple cables are simply the most difficult to do this to, so if I can successfully implant one of these then I can usually do it to other cables.”
TechCrunch noted that MG’s project also served to raise awareness of the dangers of unknowingly using a malicious charging cable. MG told TechCrunch: “Most people know not to plug in random flash drives these days, but they aren’t expecting a cable to be a threat. So this helps drive home education that goes deeper.”
Forbes cybersecurity reporter Zak Doffman noted the implications for a device such as this, pointing to how most people casually accept cables given as gifts, or the ones provided in hotels or airport lounges, without question.
