Hacker News new | past | comments | ask | show | jobs | submit login

If you were mailing the cables to random people, you wouldn't use wifi, it's true. You'd just want the fake keyboard to just use a terminal to download and install a trojan.

If you can fire off a successful "curl | bash" on an internet-connected machine, wireless isn't needed.

Of course, without wifi you've only got a USB Rubber Ducky clone [1] whereas with wifi, you've got an NSA COTTONMOUTH clone [2] which I imagine is much more likely to get your talk accepted at DEFCON :)

[1] https://shop.hak5.org/collections/physical-access/products/u... [2] https://en.wikipedia.org/wiki/NSA_ANT_catalog




At that point, just pre-load the cable with a flash drive and copy the malware onboard.


Seeing now why counterfeits are a serious problem for resellers!


Opening up a terminal while the user is actively using their computer is going to be a huge red flag and give the whole game away. Presumably with a local attack, the attacker will wait until the user is distracted or away from their computer before taking control.


Yes, if you did a scattershot attack some users would notice for sure.

But if the terminal only flashes up for 100ms, plenty won't notice or will think it was just a glitch.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: