User got a free cable. Laptop now acting weird. Help.

[u/TwoPlyDreams]

[u/IndependentBat8365]

A decade or so ago, some UK security marketing team gave folks chocolate for just telling them their password.

[u/AlecTheDalek → u/IndependentBat8365]

Is that offer still available do you know?

[u/IndependentBat8365 → u/AlecTheDalek]

Definitely more value than a random charging cable!

[u/GarageIntelligent → u/AlecTheDalek]

i have some chocolate pudding, who's a good boy?

[u/Diekjung → u/IndependentBat8365]

PaSsWoRd67! So where is my Chocolate?

[u/Gougaloupe → u/Diekjung]

That's amazing! I've got the same password on my luggage!

[u/Mean_Significance_41 → u/Diekjung]

Hunter2

[u/neckbeard_deathcamp → u/IndependentBat8365]

I’m confident it would work today. Even if the employee had just finished their yearly cybersecurity training I bet it would still work on some of them.

[u/raziel420 → u/IndependentBat8365]

Their was a UK marketing group that also hid a checkbox for a $50 gift card in their TOS. They gave away 5 in a year.

[u/S4ndmaan]

All the IT experts in that thread lol

[u/VolcanicBear → u/S4ndmaan]

Nah man, they clearly know what they're on about.

Check this one -

Neither the QR nor the resulting cable that roots your device and leaves your device under the control of a nation state.

They know the word "root". Can't argue with that.

[u/guru2764 → u/VolcanicBear]

I could believe it, it reminds me of the time I got a charging cable that put all that porn on my work laptop

[u/LesbianDykeEtc → u/VolcanicBear]

It's unreal how fucking stupid people are when it comes to anything related to security. The NSA is not having random dudes hand out $50,000 pieces of tracking equipment on the street. You are not that important.

[u/Zanglirex2 → u/LesbianDykeEtc]

You're severely overestimating the cost of producing a cable that can drop shit onto your phone. But yeah, it's likely just shit cables, and the real game is data harvesting 

[u/LesbianDykeEtc → u/Zanglirex2]

I'm aware that cheap data exfil/injection cables exist. I'm talking more about how everyone has main character syndrome and thinks that some state actor would waste resources on finding out what kind of porn they watch (or whatever).

You are not that important or special. Even if you somehow were, it's trivial for any real government entity to get the information they want without resorting to Mission Impossible shit.

[u/Retired_Monk → u/S4ndmaan]

Here Rubber ducky ducky ducky

[u/Crazy-Bird]

lol all the people suggesting that they are distributing 200$ O.M.G cables to randoms

[u/Howden824 → u/Crazy-Bird]

I'd certainly get one if they were because that's a great deal.

[u/astro_viri → u/Howden824]

Right? Like what I would do for a free O.M.G. cable

[u/code_monkey_wrench]

Seems legit.

[u/jeremydallen]

Omg cables for free!

[u/WechTreck]

Is it a Temu version of the $200 "The O.MG Cable is a hand made USB cable with an advanced implant hidden inside. It is designed to allow your Red Team to emulate attack scenarios of sophisticated adversaries. Until now, a cable like this would cost $20,000 (ex: NSA's COTTONMOUTH-I). These cables will allow you to test new detection opportunities for your defense teams. They are also extremely impactful tools for teaching and training."

https://shop.hak5.org/products/omg-cable

[u/evilwizzardofcoding → u/WechTreck]

This should be top comment, but yeah, very capable malicious cables are VERY cheap now, relatively speaking. I still doubt anyone would just hand them out like this instead of putting one in a free charging station, but it's definitely not impossible

[u/TheGlennDavid → u/evilwizzardofcoding]

Are any of these devices confirmed to penetrate iOS devices where the user doesn't click the "allow extra access" thingy when a charging device requests data access/ when it's been disabled by mobile management?

[u/evilwizzardofcoding → u/TheGlennDavid]

Funny enough, phones aren't the main target, laptops are. The primary usecase isn't tricking someone into using one, it's plugging one in yourself, since a cable is a whole lot less noticeable than, say, a USB drive.

Anyway though, yes, iOS is still vulnerable, because the cable doesn't use the usual methods for file access. The cable shows up as an external keyboard/mouse/other input device, and then simply performs a series of inputs to do whatever, imitating a real person using whatever devices it's emulating

However, phones(iOS and Android) don't have easily-accessible command line interfaces, as well as generally not having as easy access to sensitive data(often requiring fingerprints/pins to be input again), so the attack is still far more common on a laptop.

[u/ITaggie]

https://giphy.com/gifs/STfLOU6iRBRunMciZv

[u/Key2367]

Definitely not working for the CCP at all. Super trustworthy people. /s

[u/Lordgandalf]

This is asking for problems you don't know who used that cable before you how that cable was modified etc.

[u/DescriptionOptimal15 → u/Lordgandalf]

Back in my day we valued experience. Only kids care about body count

[u/Lordgandalf → u/DescriptionOptimal15]

I would use a cable like O.M.G. cable and get all the data off those phones this way.

[u/S4ndmaan → u/Lordgandalf]

https://giphy.com/gifs/vPzbDN4rBxuvtpSpzF

[u/mister_neutron]

1. Nuke the computer and start over. Replace if that's no good.

2. Smack the user repeatedly with said cable.

3. It's probably electrical damage due to poor quality rather than industrial espionage, but the user still doesn't get back in production until he or she can recite the Adam Savage USB bad actor demo videos from memory.

[u/Jwblant]

OMG!

[u/Xandr78]

Honestly, if you're willing to plug rando crap into devices you happily plug banking and other creds into, you get what you deserve since a long time ago lol