161: mg

25:09Basically, imagine what someone could do if they had access to your keyboard. That's what this cable did. It acted like a pre-programmed keyboard. If you plugged it in, whatever it was programmed to type, it would type. So you could do some basic Keystrio conjecture attacks, which, you know, open a browser, open a reverse shell. You can do a lot of stuff. But it wasn't this, like, this tool I knew it could be. He was posting about this online and stuff, making a handful of them and selling them in the corners of rooms in DEF CON. But the first version was lacking features and really buggy. From his visits to DEF CON, he met a guy named Fuzzy Knob, who got MG a job red teaming for a Fortune 500 company, which was MG's first cybersecurity job, specifically hacking into places to test their security.

25:57How cool is that? But while he was at work doing his red team stuff, he just kept thinking about, how can you make this little device better? So obviously the next step is, well, what could that product actually be? And the next time I had vacation, which was actually in between jobs. So I had, I think it was six weeks between my first red team job and when I was leaving an IT role. So six weeks in between, I'm like, you know what? I have not figured out how to design PCBs yet, so I'm going to get a mill. PCB is printed circuit board. It's typically a green board inside an electronics device that has the capacitors and resistors, and they're soldered onto it.

26:39And a mill is a way to create one of those PCBs yourself, making the traces and drilling holes for the components. So he spent six weeks learning how to design PCBs and created them on his mill. The cool thing about a mill is that you get rapid iteration. So with software, you can just change some code, save it, hit compile. Seconds later, you can test the output. When it comes to a PCB, it's usually weeks. You got to design it, send it off to a fab, wait for it to come back, then you assemble the components on it, and then you test it and debug it before you can even get a change you want to make to test it over.

27:18But with a mill, you can do some primitive stuff. I can't get super advanced here, but you can test some basic things. You can do it in the span of a few hours and make a revision, kick it out again, and just maybe go through two, three revisions in a day easily, depending on how complex it is. And that allowed me to level up really quickly. So he spent a lot of time in his home lab trying to jam more features into this cable of his. But one thing bugged him about this cable. You have to physically take control of it to program what keys it will type. It would be way better if you could plug the cable into your target and then tell it what to type remotely.

27:58So he was fiddling around trying to figure out how to give this thing an antenna or something, maybe Wi-Fi in the smallest way possible. The Wi-Fi radio allowed it to connect to networks or you with like a phone to connect to it. And there was no need to get access to the cable to update a payload on it or to trigger a payload. So that changed the entire value of this. Being able to dynamically change what it did while it was in play. Ah, yeah. So instead of blindly hoping your cable is typing the right keystrokes that you pre-programmed it to do, now with Wi-Fi, when this cable connects to a computer, it's almost like it turns into a wireless keyboard.

28:42Whatever you type on your phone, those keystrokes would show up on the computer it was plugged into. But it didn't look like a keyboard, of course. It looked like a regular USB cable that you typically have hanging off your computer anyway. This made it a very spooky cable. Suddenly, USB cables were no longer safe. And this malicious cable was starting to finally look promising. The first version didn't have a lot of functionality, but this one, this one's starting to look sharp. So he came up with a name for this cable, the OMG cable. It works for so many reasons, but since his initials are MG, then OMG is a nice fit.

29:19And that took off. Then DEFGON was coming up, August 2019. I'm like, okay, this is getting a lot of traction, So by August, I wanted to have some of these things to actually sell. Now, I was making them still from the ground up in my kitchen, basically. It took me eight hours per cable on average to make these. And the components were so fiddly and tiny that 50 % of them were failures. I'd throw out 50%. That turned into, if you do the math on that, that is 16 hours of work per viable cable. really not scalable, but you know what? I just wanted as many as I could for DEF CON, right? So I just focused entirely on this in my free time while still doing my Red Team role full time.

30:07You have to think, he's trying to fit a microcontroller inside a USB cable so that nobody thinks there's a microcontroller in it. He's working with incredibly small components, soldering under a microscope, sometimes with exposed silicon, with almost no room for error, or it won't fit in there. So he makes as many as he can and brings them all to DEF CON to sell. He's leveled up from the back alley deals by this point. And Darren from Hack 5 was letting him sell them out of the Hack 5 booth. They sold out. Everybody wanted them. And they sold out fast. So Darren was like, why don't you bring more?

30:39And MG was like, because it takes forever to make. So Darren started teaching MG about mass producing electronics. Okay, let's learn how to do manufacturing. Find somebody who can do certain steps. So, you know, we've got one factory who creates the raw PCB, another factory who assembles the components, solders the components to the PCB, and another factory who integrates those PCBs into a cable. And even at that point, there was still plenty that I had to do after receiving them. final assembly, putting the hoods on, gluing the hoods on, running QA, calibrating them, running, you know, putting, putting firmware on them, packing them, shipping off to the warehouse, all, you know, all that stuff.

31:22But anyway, doing any of this outsourcing would have been a huge help for me. And that's, that's what the goal is. So it took about five months of back and forth teaching this shop how to do what I needed. So I get the first batch. This was like the tail end 2019, I finished the assembly. I do some basic tests. I flash them, pack them, and I send them off to the Hack5 warehouse. And like, I think it was January 1st, 2020, start the online sales. This is where I quickly learned it was going to take a lot more work to have a manufacturer do what I needed. Customers started having issues. It was all over the board.

32:01Like there was no obvious pattern. So I had to do a lot of investigating to discover, you know, what was really going on here. It's just really weird problems. It was probably an upstream manufacturing problem, but I couldn't think about the upstream manufacturing. I had mostly finished product currently in hand. And if I couldn't sell that, that was a gigantic loss, like financial loss, like mortgages to house level loss. That was a little bit scary. There were enough issues happening with customers that I just decided to pause the sales and figure out what was going on. He analyzed the cables coming back from the factory and found that on the power supply, inside the cable was a tiny microscopic crack.

32:52And to his horror, it was on over half the cables, which meant his first batch of cables, half of them had to be thrown out, a huge financial loss for him. He had to teach the manufacturer how to test for quality at every stage of the build process in order to find exactly where the cracks are coming from. And he discovered at some point the manufacturer would throw all the finished components into a bag to give to the next build stage. And when they were getting all jostled around in the bag is when the cracks would show up. Typically, that may not be a problem, but since he's working with such small components where silicon is exposed in some areas, then it was damaging the circuitry.

33:30So he got that fixed, was back on track, and he was back to selling the OMG cables to whoever wanted them online through the Hack5 shop. And these cables look amazing. They look exactly like a normal USB cable, one that you would charge your phone with, and you would never be able to tell that it's a malicious one. It's supposed to be stealthy like that. One of my manufacturers lost an entire box of cables, could not account for it. So the way the cables are configured, they're not very useful. Luckily, they're not hot, so to say. But there's a good chance that this box just got shipped to one of their customers who was expecting totally normal USB cables.

34:12So there is absolutely a chance that there are some OMG cables just floating out there. I forget the exact number. It's like 100 or so, which is kind of scary. MG strikes me as someone who just obsesses over making his cable better and better. And it's amazing how he's constantly improving the manufacturing process and the functionality and the build quality of the whole thing. For the first several years, I wasn't trying to focus on profit here. I was just, every dollar that we ended up getting that turned into be profit, I put it right back into just improvements, R &D, because it was a passion project.

34:49And I mean, it still is, right? But that just allowed me to focus on so many trivial things. The cable clips themselves. So people would routinely, like, lose their cables. So we started creating these fluorescent clips that we would include with the cables to prevent that, right? And you can take them off if you don't want it or just keep it on, whatever. But, you know, this is, I'll make this one short, but it's another example of scale in a hilarious way. It's so simple. So, you know, I'm 3D printing all of these little clips, these fluorescent clips. And they're great when you got a few of them.

35:26But when you got 100 ,000 in a bag, they start getting tangled. So that's really annoying to pull out tangled clips when you're trying to pack envelopes. So, you know, redid the design. You know, okay, now I've got tangle-free clips. And, you know, then we got the woven cables are more snagless and things like that. and how can I speed it up so I can get a bed of, you know, 600 clips on a single 3D printed bed without it cascading and falling apart? And, you know, how can I improve the labeling process from a handheld labeler to an automated machine done labeler? Probably doesn't make financial sense to do it, but it's fun to automate and obsess.

36:07So, yeah, point being, I have the opportunity of obsessing at the sacrifice of profit. Now, over time, his cables have gone through many revisions, a lot of feature upgrades too. So if you were to buy an OMG cable today, here's what it can do. It comes in all types of different forms, whether it's got a USB-A or USB-C active end. You know, on the passive end, it'll have like lightning, micro, USB-C, usually meant to emulate the aesthetics of exactly the common cables that are out there. It acts exactly like a normal USB data cable, right? But it's got an implant inside, as you could probably deduce by now.

36:52That thing stays dormant, but an attacker can remotely connect to it via Wi-Fi nearby, or they can have the cable connect out over the internet to a server you control anywhere. It can also do some autonomous things like geofencing and triggering things automatically based on wireless networks it does or doesn't see, right? Okay, cool. But, you know, what does that do? So you get a whole web UI on a phone or a laptop, whatever it is, that gives you full control over this cable. We already talked about keystroke injection payloads, you know, emulating a keyboard. We cranked up the speed at which these things can run to nearly 1 ,000 keystrokes a second.

37:34Added some mouse injection as well, so you can navigate a mouse around the screen, click on stuff. expanded the capacity of these things to store hundreds of individual payloads if you want, or just really giant payloads. Name of the game is always just flexibility. So if you want one giant payload or, you know, 200 tiny ones, cool, you can do that for your need. We added USB key logging a while back. So if you deploy a cable between a keyboard and a desktop or laptop, which happens a whole lot in corporate spaces, you can log those keystrokes if it's a full-speed keyboard. Most recently, we added kind of a novel communication link.

38:11So we're calling it HIDX Stealth Link. And what it does is imagine a network interface that looks like a keyboard to the host. So it says, I am a keyboard. And it looks like a keyboard if you open up Device Manager. But it's got a bi-directional, like, raw data link. So if you ever use, like, Netcat or something like that to create little tunnels for data, same concept. So you can have a remote shell running on the target that's on like a completely air-gapped machine. It doesn't even have a network interface. So very cool. And I had also mentioned a lot of these other types of features like the ability to run self-destruct, the ability to do geofencing, and the self-destruct specifically is to wipe the data.

38:55So if you've got some proprietary malware on there, you don't want to be phoned. You know, if it gets lost, we can help wipe that. If you've got key logs on there with sensitive data, like, I don't know, passwords or whatever it may be, cool, we can wipe that. Can also disable the cable so that it just stops acting like a cable, and hopefully that'll encourage your target to throw the cable away and get it out of play. And that's kind of just a high level of all the different things it can do. Yeah, this thing is pretty scary. And it's one of those things that now that you know a normal-looking, USB cable can be an evil thing, it makes you distrustful of all USB cables.

39:36Like, if you see a random USB cable sitting around, it might be some sort of trap that someone left for you, hoping that you'll plug it into your computer so that they can get into your computer. I've got it in my hand here, and I'm looking at it compared to another cable I have, and it is identical. It's crazy how... Nice. Which one is it? iPhone one. Lightning. C to lightning or A to lightning? C to lightning. Oh, nice. So, funny story about that one. If you hold up these type C ends and look at the white hoods, I delayed that cable by, I think it was a couple months, because it was 0.3 millimeters longer than the actual thing.

40:18So, I was just like, oh, man, it matters. It doesn't really matter. But at the same time, the guy who does the front end work for us is blind. He was a customer originally when we released the Keylogger edition of the cable. And he came to me, he's like, dude, I'm feeling these two cables side by side, and I cannot tell the difference. So that was amazing to me. Yeah, it is remarkable. And going back to the Ant Catalog and Cottonmouth, I wonder if the NSA has bought like a thousand of these to be like, Like, oh, this is so much cheaper than the$20 ,000 per unit we have. And it has way better features and we don't have to run the R &D and all that sort of thing.

41:05You have any idea? I mean, I've heard some whispers that I probably shouldn't talk about. But I'll say this, is that there's many reasons why that could occur. Which, I mean, sure, price point. Yeah, absolutely. Maybe ease of use. Like, I, you know, can't really speak to what the product experience is of their stuff. But I can suspect. but here's another thing is deniability. Like if you find a cotton mouth cable, you're going to know where that came from, right? Or especially if you're a certain intelligence services, you're not have a good idea of like who made this highly custom hardware. But if you're seeing something off the shelf, there's some deniability in there for, for, you know, NSA as an example, right?

41:48Like, Oh, where that came from. That's just a off the shelf OMG cable. Right. So I, I would imagine. um yeah i have certainly talked with numerous people who are in that space whether directly or kind of third parties employed by them to do tests and stuff like that where these are absolutely in a whole lot of those types of environments for various needs whether it's testing third party assessments like red teaming stuff like that um i've talked to police departments, stuff like that, who are using for all kinds of different needs. Yeah, but again, it's that interesting aspect of circumventing things, right?

42:35So, before, Cottonmouth was only available to U.S. intelligence agencies and maybe Five Eyes, but now the OMG cable is available to the world. So, all of NSA's adversaries also have this. And, um, that, that is interesting that it's the technology isn't only in one person's hands now, but that there's a level playing field of like, nope, we've got that too. Yep. I mean, at the same time, I think it should be like, if I could have made that the way I did, I feel like others can make that. And therefore, you know, it was just a matter of time, whether or not we, we heard about it in public was probably the only question there.

43:21That's an interesting way to look at it, right? It used to be that only an exclusive group of people could get their hands on such a thing. And now anyone can. And yeah, that's scary that this thing could be anywhere now. But maybe the bigger danger here isn't when the cable went public, but when it was kept secret. When the only ones who had it were shadows. People who didn't want you to know they had it. People who didn't want you to know this existed. People who didn't have to follow the law. I mean, compare it to smallpox. For centuries, people died of smallpox, and we had no idea why. But then we discovered what it was, and we learned how to contain it.

44:05And then we learned how to fight it, and then we learned how to defeat it. But in that process, we learned how to weaponize it. And that's the double-edged sword of knowledge. We're in danger without it. but we're dangerous with it. We're going to take an ad break here, but stay with us because when we come back, MG's going to tell us stories about how this cable is used in the wild.

44:32This episode is sponsored by NetCraft. Every Dark Net Dari story starts with a scam, a breach, or a crime. NetCraft works behind the scenes to not only disrupt the threat, but to remove the infrastructure that enables adversaries to launch more attacks. Uncovering phishing kits, dismantling malware networks, and disrupting brand abuse at scale, Netcraft stops threats across the open web, social platforms, and the dark web. Trusted by leading internet and infrastructure providers and brands large and small, they clean up the web a little more every day. Proudly earning one-star reviews from cyber criminals and five-star reviews from customers, Netcraft's automated brand protection platform sifts through the noise to deliver high-fidelity signal that powers takedowns at any scale.

45:15Keep your story off this podcast by learning more at netcraft.com slash dnd. That's netcraft.com slash dnd.

45:31So over the years, people have shared stories with MG about how they're using his cable and have asked for some really interesting feature requests. One story he was told was from someone who's a red teamer for the DOD, the Department of Defense. That is, his job was to try to hack into the U.S. government's networks to test their security. This team posed as an Xfinity tech via email and phone. So they got a legit Comcast.net account, which literally every Comcast customer gets. But, you know, you got username at Comcast.net. And they're just like, you know what, we can pretend to be a Comcast employee with that, and I bet it'll pass.

46:09And it did. So after some back and forth with this target, they set up an appointment. They found some Comcast slash Xfinity clothing at a thrift store, stuff like a hat and jacket. They did some OSINT, found some fake IDs, printed those out. They show up. They say, hey, we only need access to the MPO. MPO is a main point of entry. So that's like where the line comes into the building, typically like the basement or something like that, tends to be a lower security area compared to like the server room. So they're given access and they install a small device that allows them to remotely disrupt that line, the main line of the ISP, in the future.

47:00So they leave, they wait a few weeks, let everything kind of just settle, and then they start causing disruptions. they return on site. They ask to look at the MPO first, which lets them reclaim that remote device that they had planted. They say, ah, it's not fixed. I see you're having issues. But we're going to need to find the other end of this cable. Where's this go? And, you know, they knew that's going to be going up to the server room typically. So they brought them up. They brought two supposed Xfinity techs up. there was a camera in the server room. So, you know, they had two techs. One tech would strategically block the camera with their back each time the other needed to deploy a piece of hardware.

47:48So at first they deployed two different malicious network devices, two different types of things. But then they see a server with a monitor and a keyboard hooked up. And then there's a USB cable hanging off of it. I think it was an AIDA micro. that seemed to be for charging a wireless mouse, right? And there was a wireless mouse nearby it. I was just like, dude, that is the perfect spot for an OMG cable. And I think we got a perfect match in the kit. So they pull it out. They noticed, oh, this cable even has like a very distinct scratch on it. You know, I'm going to scratch this cable, make it look perfect, right?

48:22They were obsessed with the details. The cable is already configured to connect to their guest Wi-Fi and then call back to a C2 server. They wait for an off-site teammate to confirm that the cable is now connected not only to that, but back to their C2 server. That means, you know, they got full remote connection from anywhere. They were left unattended in this room for a little bit, so they call the target back. They're like, hey, I think the internet's fixed. Can you check it out? And they use that same server that they were eyeballing to, oh, yeah, it looks like the internet's good, which gave them a little bit more insight into, you know, what's running on that server.

49:00they leave and kind of start their initial work. They've got these tools in play. Now, like within a day, the target knew something was up. They found at least one of those malicious network devices, which immediately led them to the next network device that was in there. Got cleaned out. Everything's fine. What was a malicious network device? It's not the OMG cable. It's not, yeah. It's other hardware that is not as physically stealth. Oh, okay. So they left it there as like Dropboxes kind of thing. Yeah. Something that will like Dropbox. It was slightly disguised, but it's like it's visibly there.

49:37It's like a new thing. So they picked up on that and immediately, okay, there's an issue. We don't know how this got here. Sweep the room. Okay. And this is kind of how Pentest should go. It's like, let's go at stages, right? Let's first see if we can be super stealthy. And then if they didn't catch us, we'll be a little bit more sloppy. Exactly. And if they don't catch us, we'll be overtly breaking rules. And if they still don't catch us, then they've got a lot to explain. And we can try stealing company cars or something. And what's the next step, right? So I've heard these stories before. And it sounds like that's what they were doing.

50:10Like, we're going to put a super stealthy thing in, a medium stealthy, and a very obvious, this thing shouldn't be here. Yeah, but the funny thing is, they did a whole remediation sweep, and they didn't catch the OMG cable. it's still it was still in play after like hey red alarms something happened here sweep it we found two malicious devices but the thing is the cable was dormant like it hadn't run anything it was just sitting there connecting to their guest wi-fi waiting so yeah i mean what would have triggered the other device discoveries were they doing stuff uh yeah they were more active So definitely go looking.

50:50But, you know, it depends. What would you assume if you're like, oh, there's malicious hardware in here. What level of sweep do you need to do to that room and how thorough does it have to be? But hey, OMG Cable survives an active sweep. So the server had some constraints that made things a little bit difficult, which is probably why they were a little less thorough, which was, A, they had some EDR in there, endpoint detection and response tooling that would have detected any form of malware persistence. So they can run a payload on this and deploy some malware that would just live until the server rebooted.

51:30Also, the entire OS was just completely wiped about once a week. So even if you did have persistence, that's still getting wiped. So it's a pretty locked down environment, right? but since they had a cable attached physically at all times that was the persistence so anytime they lost the mailer connection they would just rerun that payload boom they're back in uh they change the payload over the times but ultimately um this this allowed them to run and just were completely undetected for what turned into a six month period of time and the only reason the exercise ended was because the contract came to an end and they needed to wrap things up to explain the full processes and procedures they were using for the op.

52:20Yeah, I mean, is this kind of what you were hoping to like, this is exactly the story that I was wanting someone to do this with, is stick it in a place, have it be there forever. You can get in there whenever you want, have your remote persistence, trigger payloads, get into systems, and no one's going to detect you forever. I mean, that's got to be exactly what you were hoping, right? Oh, absolutely. There's just so many like, oh, yes, you used a lot of the features to just really push this. And it makes me happy because it's, you know, are we doing rickrolls? Are we really pushing the boundaries and improving environments and just doing some really cool James Bond shit?

52:55Yeah, that's, that's, I love that. Because MG has brought this cable into the world, he's met some very interesting people from all around the world and heard some wild stories. Like there was this one person who was telling him how he used the cable to get into an air-gapped computer. That is, there's no way possible to hack into it from outside. And the reason why this computer was air-gapped is because it was part of a digital forensics lab. It was collecting evidence and looking at computers without the risk of any of that data getting out. This group was hired to audit an entire security policy, including the physical security of the building.

53:35So they monitored 24-7 with a whole bunch of cameras at all sides of this building that they had deployed. And it was really hard. There were guards present just constantly, 24-7. Everything was fully access controlled. It was all logged. It was all audited. How were they going to do this? And, of course, the goal was to gain access to that evidence computer, which was air gaps. had access to that large SAN for storage via network. After a whole bunch of discussion, they decided, you know what, we're going to use an OMG cable. Their first idea was to submit a hard drive that needed to be forensically analyzed by that computer, but then throw an OMG cable in the package, and hopefully the tech opens it up and pulls out the cable and says, oh, I'll use this to plug something in.

54:29But they thought, no, that might not work. They probably have their own USB cables in the lab, and they're not going to use the one in our package. So they decided to get a USB external hard drive. You know the ones where there's a hard drive with a little USB pigtail coming off of it, and you just plug it in your computer and you can see it as an external drive. Well, they cut that little USB pigtail off and then snipped off the end of the OMG cable and soldered it onto this hard drive. Because the OMG cable only has one active end, and the other end really isn't needed for anything. So they just took the end with all the functionality and stuck it into this hard drive so that when the forensic tech opened it up, they'd have no choice but to plug in this USB hard drive into the computer.

55:10Now it's integrated to that drive, and the drive looks like a totally normal drive, and it's the cable of that drive that suddenly is the problem, and it stays dormant. So, yeah, put all these different payloads on there in advance. Most important note, they ran a boot payload. So boot payload on this thing is on an OMG cable. It runs every single time the cable powers on, so when you plug it in, right? So they include a geofence that would check to make sure it's inbounds. It's at this evidence computer, which they were given some insider info on this one to make it safe. They're like, okay, here's the network that you should use to keep this in play.

55:51Basic checks to ensure it only ran on that evidence system. So something, you know, an actual adversary wouldn't do, but when you're a third party trying to keep everything safe, you do a little extra. So they placed the hard drive in an envelope with the, let's just say, required labeling that they were able to find via some public record requests. Say, hey, this is probably what this envelope should look like to make it believable. So they turned it in at the front desk via a courier service, which was totally not a courier service. It was them. They advised, hey, this is for an active thing.

56:28It's needed for legal discovery. Probably need it soon. Done, right? Now, the drive sat for two weeks, unplugged, just waiting, right? But then it got plugged in. And once it was, they got a notification. They had kind of detected when it would come up. And they left it plugged in for six days to do a full image of this drive. So they had intentionally kind of downgraded the speed to USB 2 to get like a USB 2 connection on a 4-terabyte drive. So they were imaging this thing for like six days, which means six days they had an OMG cable plugged into the evidence computer. Now, they could have set up a bunch of automated payloads and stuff like this, but for damage control, they decided to keep an active human in the loop for this whole thing.

57:14So when it got plugged in, they got the alert. They returned and accessed the cable from basically the lobby or the parking lot, right? One payload allowed them to create and modify files on both the local system and, more importantly, the SAN. That's where all the evidence is, right? Like, you can manipulate the evidence. They have just proven that. Evidence is supposed to be just, like, pure and untouched. Then they noticed that, okay, yeah, obviously this SAN, you need a network to connect to it, so it was connected via Ethernet from this machine. But they learned that while the evidence machine was supposed to be air-capped, it was only by DNS.

57:56So, like, instead of doing a domain name connection out, you just connect out via IP address, and suddenly, hey, it's working. You can connect out to the Internet by just going direct via IP. Boom. Now they got the ability to exfil evidence from the storage device out over the internet. Like, I think you could immediately assume some terrible scenarios where that's like a big problem. How prolific is this cable? Like, how many companies out there are using it? uh i one day i'll probably find a way to disclose that but basically i i don't know many places that don't have one what yeah it's i'm i'm continually amazed i'm i'm i learn about new places that i didn't even know exist like wait you a you exist that's crazy b you got my stuff what okay cool it's a wild ride going from I'm just making something that I thought was borderline art in my kitchen to all of these types of stories I am telling you it's a little hard to digest sometimes but at the same time I'm trying to take it very seriously yeah but I mean Hack5 or even your website could be like used by these companies if you do know which ones oh yeah I mean yeah I think that would be bad form.

59:31There's a lot of companies who probably don't want that info out there. I think Hack5 will list the media that has been seen on, like cool, you know, Nat Geo and stuff. I just saw the OMG Cable in a Netflix episode, apparently, it was Zero Day, and I think it was Robert De Niro talking about the OMG Cable on screen, and I think Jesse Plemons' face was in there. I'm like, what? That is wild. Okay, so So, Hack 5 is who sells these things. Is there anyone they don't sell to? Yeah, so absolutely. There are a couple of ways to think about this. And, you know, I'm going to just generalize it here a little bit to make it easier to understand.

1:00:15But basically, you can kind of think of three categories of countries. First being countries who are explicitly allowed. And you could kind of think of those as like friendly NATO countries and Five Eyes, right? Then, second category would be countries who are explicitly disallowed. You know, so think sanctioned countries like Iran and North Korea. But then you get this third category is countries who are on neither of those lists. So if the goal was to make as much money as possible, you'd be selling to that third group. but if you're trying to do more than like the legal minimum you might avoid selling to that third group especially if you're operating in space that many people perceive to be a gray area even if it's not a gray area you know perception still matters but uh hack 5 only sells explicitly to the allowed countries and you know skips over that that third group it's a voluntary decision on their end.

1:01:17But it's also a factor of kind of having to be more diligent when you have tools that are more capable. So, you know, toys versus professional tools kind of steps up the level of, you know, attention to following the rules and kind of going a little bit over the minimums, right? Yeah. Those rules fascinate me. It's really export controls that the U.S. government has set up where certain electronics can't be sent to certain countries. And the classic one that just came to mind because of recent events was the DeepSeek surprised us all with their AI abilities. And then it turns out that they had tens of thousands of NVIDIA cards, which I believe is against the export control rules.

1:02:08Nvidia is not allowed to send tens of thousands of these cards to China. And so it's just like, well, how come Nvidia didn't get shut down or fined or slapped on the wrist by the U.S. government for selling so many of these? Like at some point, there's got to be like, OK, we need more. We need more. OK, who are you distributing this to? Oh, don't ask. OK, so I don't know. I just wonder if these export control rules even matter or if they have teeth or if anyone follows them. Because honestly, I've filled out forms before and sometimes it's just a checkbox. Do you live in any of these countries?

1:02:46No. Okay, good. We'll send it to you then. Right. I think the NVIDIA one's a pretty good example. I don't think all of their products are export controlled. So this probably goes back to the capabilities, the toys versus the upper end stuff. And can you do good or bad things with them? Almost dual use kind of territory. And ultimately, any restriction as what you were getting at can be bypassed. But introducing any degree of friction generally is good if you're trying to stop a certain activity. Perfect controls are hard. It's a balancing game, much like almost all security defenses, right? We often get that wrong in the security industry.

1:03:31It's like, oh, it's not perfect, so it's not worth doing. It's not necessarily like speed bumps help to some measurable degree in a large scale. But it's worth reminding, again, Hack5 is the only entity I sell to. But as much as I love not having to worry about it for my own stuff, I absolutely love supply chains in general, especially when you look at them from the offensive security mindset. So I'm totally with you in terms of being fascinated. I think that stuff gets way too little attention. And if you focus on it, you can wield crazy amounts of power if you understand it. So, yeah. Okay, so you've told us a few stories of your cable being used for good.

1:04:15Do you know any instances of it being used for bad? Does anyone tell you about those stories? So I don't know of any stories specifically for my stuff, but Hack5 actually had a semi-recent example that was super applicable here with their Wi-Fi pineapple and the Russian GRU. So let's, what was this? So the Wi-Fi pineapple, it's specifically designed not to be perfect. Like this is for doing security pen tests, right? Not for evading. That's the product design. So simple things like MAC address randomization are omitted. What else? There's like a certain way it sends management frames that could make it harder to fingerprint if they modified how that works, but they don't.

1:05:00It's intentional because the product is meant to enable pen testers to do Wi-Fi audits where they've got permission not to evade the detections. So anyway, late 2018, Russian GRU was caught in Brussels targeting, I believe, UN facilities, right? Not the place, you know, if you're making this that you kind of want to see your stuff showing up, but the Wi-Fi pineapple was being used in the trunk of a car. And that explicit choice to not make the device super stealthy definitely helped law enforcement track this down and figure out what was going on probably a lot faster than if they made other choices in their product design.

1:05:40Well, I'm surprised there's not more malicious intent stories because you know i i just go to a grocery store today and the cash register i could see the back of it like i can i can i can plug something into the back if i wanted and there's so many other restaurants and stuff where i've seen a computer exposed at the bank i was at the bank and the back of their computer was easily there that i could just pull cable out of my backpack shove it in and they wouldn't know and i'm surprised there's there's not just stories of people using this to rob grocery stores. I mean, behind the scenes, and I don't think a lot of people see it, I put a lot of work into just gaming out all of the potential risks to minimize that.

1:06:27And it's not perfect. It's totally possible that bad things will eventually happen. There will be a news story. But I think over the last five to six years, it's been sold. I personally cannot point to any news stories where a bad thing happened. Whereas if you compare it against other, you know, pure devices, say that in the field, I think there's quite a bit more news stories, just comparatively, if we're taking, you know, a sampling. So that track record, I'm just very happy with so far. So, I mean, you can, I assume that people are buying this and using it for malicious intent. I mean, you self-describe the thing as a malicious cable, right?

1:07:08So we can assume that people are going to do bad things with it. But I worry about your liability here. Because if you're saying, I have a malicious thing, this thing's very dangerous, you could do this and this and this with it. And someone's like, great, I'm going to go do that, that, that with it. But it says here, I have the package in front of me, and it says, do not use this unless it's on a network that you have permission to use and such like that. I wonder if that's enough to make you not liable for people actually using this maliciously. Yeah. Because, I mean, the thing is that you've got people who are malware creators out there, botnet creators.

1:07:54They don't unleash it to the world. They don't spread it. They don't infect people. They just make it. And then they're the ones who are going to jail for this. Yeah, I mean, there's definitely some differences there, but just is that legal message enough? Like, absolutely not, not for me. When you're in the gray areas, you can't just do the minimum. And it's also important to point out that legal is not the same thing as ethical, which is, again, why it's not enough for me. You know, product design, like I mentioned, detectable defaults, they're not legally required, but I think they're critical in terms of reducing harm.

1:08:30Community management, like, you know, not just dropping a tool and then letting Lord of the Flies happen, for instance, right? Like, we're talking about a lot of nuances. You and I right now are talking about a lot of nuances that a lot of people haven't spent the time thinking about. So I think it's good to try and share those nuances and just generally keep things from going off the rails within those communities because this, again, helps the outcomes. And it's kind of sort of like open source. A lot of people will just drop code and call it done. But it takes a lot more work, in my opinion, to do it responsibly.

1:09:05You got a, you know, like real open source is code that you've cleaned up, that you've maintained. And the community around it is maintained too. It takes work and effort. But it's also important that, you know, this isn't just about like self-preservation, which is kind of, you know, the topic here. it's about kind of community preservation as well, which is really important. So one entity just being too reckless is basically all it takes to ruin it for everybody. And there's tons of examples of that type of thing happening. Obviously, you know, if my goal was to push the limits of the law, then sure, my answers would be different.

1:09:41But my goal is to push the limits within security. And I guess, you know, that I want to keep focusing on that. And that's why I spend tons of time thinking about all the ways I can reduce harm and risk in all the other areas. This cable started off as just a one-off, a proof of concept, but it moved over time into large manufacturing, sales, and the way I think about the risks has evolved along the way, right alongside that. Yeah, so you talk about supporting the community. I assume that's the ethical hackers, the white hats of the world that have permission. And that's great that that's your intent to help improve security for networks, to help people test it ethically.

1:10:33But that intent, I think, is what matters in the eyes of the law in a lot of situations. and I mean you just told us that you've sold these things in the back alleys of DEF CON and it's our corners and I mean DEF CON in general is a place that has malicious actors and criminals. We've seen people get arrested there and such like that. And so I wonder if there's any sort of, you know, if that's proof enough just to be like, no, this guy sells it at DEF CON. Of course he's got malicious intent. There's no way he's doing it. Like he would be selling it at a legit conference that's just all about securing and not hacking.

1:11:16This is a hacker conference. There's just something there that, I mean, and not just that. There's like, you know, people might come to you and they be like, hey, I want this feature. And you're like, oh, that's a good idea. And you add that feature. And like maybe that you judge them first and be like, wait, hold on. Who do you work for? Do you have permission? or do you hear people be like, man, I keep plugging it into the bank and the bank keeps popping me. I need a feature to be more stealthy. And then you're like, wait, hold on. I'm not going to help you. Like there's got to be this world of who you actually do business with and who you don't or who you help and who you don't.

1:11:54Because again, that intent matters. And if there's a criminal coming to you and saying, hey, I need this for criminal reasons, do you, what do you do there? Because that's where the intent comes in, right? Yeah, I mean, so helping could be anything, right? That could be operational advice for running an op. It could be feature changes or additions. It could even be custom hardware. I've been offered 30 grand for a cable, and I have turned it down because it's like, hey, this could risk just the future. But there's also other things. Like people will come in. They're clearly not in the space of information security, and they're trying to do some like spouseware stuff.

1:12:36And I'm like, as soon as I get a hint of that, it's like immediately know also what you're doing. I just have tons of issue with, like you need to redirect this. So spend your money on like couples therapy or something. This cable is not, it's not a marital aid. Well, yes. See, this is what I imagine, right? So there's these privacy phones of the world and they specifically wanted to help criminals, right? And so they would entertain, They would get them in the hands of drug dealers and such and say, what can we do to make these phones more private? What features do you want? And that's what made the people who made the privacy phones go to prison.

1:13:15I mean, we have phones that are secure, like even the iPhone, right? It's secure to some degree. And you don't see the Apple team going to prison because they're making things private or secure. But it's the fact that all those other privacy phone creators were doing things to work with criminals. And so I imagine some, I don't know, street hacker gang being like, all right, MG, we got all these cables, but we need it to be one step better here. We need you to put this in. I just imagine this world where people are approaching you and you've got to be like, sorry, we'll probably go to jail if I help you.

1:13:50So no. Again, kind of like as you were pointing out there, I don't do this for just anyone. I get to know who they are, who I'm giving custom help to. Actually, so the operational stories I'm sharing with you were from those relationships. Ultimately, you need to do some due diligence, kind of like you were saying, contact. The entity being targeted, verify a contract for offensive work is in place with the other person asking for help. Simply verifying the identity of the entity asking for help to ensure they're legit. Definitely not just offering it up to anybody. I have turned down very large offers of cash because it wasn't exactly where I wanted it to be.

1:14:40A huge thank you to MG for coming on the show and sharing these stories with us. You can find more about him by visiting his website, which is o.mg.lol. This episode was created by me, your pseudo mama, Jack Recyder. our editor is the last JPEG, Tristan Ledger, mixing by Proximity Sound, intro music by the mysterious Breakmaster Cylinder. Sometimes I feel like the biggest cybersecurity threat to myself is my future self. That version of me who forgets to update software or reuses a password or falls for a phishing email. So to stay safe, I started locking myself out of my own accounts. Let's just say future me and past me now officially hate each other.

1:15:19This is Darknet Diaries. Thank you.