INTRODUCTION
In the age of connectivity, data privacy is of paramount importance. Yet, with the plethora of interconnected devices present in a space, it grows increasingly difficult to constantly keep tabs on each device’s location and actions. Something as ubiquitous as a charging cable could actually be exfiltrating data without you even knowing. Clearly, data exfiltration poses a significant security risk. As such, taking the steps to audit your wireless space to look for any of these kinds of malicious devices must be an indispensable step in your security protocol.
This information is provided for general awareness and defense purposes only. This information also is not intended to be a complete description of the functionality or risks of the identified tools.
WHAT IS THE O.MG CABLE?
O.MG Cables resemble a standard, commercially available phone charging cable. They can be purchased commercially for a relatively low price and come in a variety of formats such as USB-A, USB-C, lightning connector, and others. However, the is remotely controllable and can exfiltrate data and keystrokes via Wi-Fi. This malicious cable includes a small processor built into the USB-A casing which allows for the data exfiltration to occur.
HOW DOES IT WORK?
To camouflage its capability and purpose, the cable performs as expected providing charging and data-transfer functionality to connected devices. However, the processor built into the device actually includes Wi-Fi connectivity which can be used to control and exfiltrate data from the connected system, all while the user thinks they are simply charging their device.
When the O.MG Cable is triggered via Wi-Fi, it can then be used to deliver a payload via keystroke injection. It can also be used to capture the data that is transmitted via the cable. In the case of keystroke exfiltration, think of a USB-connected keyboard which would not have any encryption of obfuscation used over the cable. In this instance, the O.MG Cable could then record all keystrokes used by the keyboard and then send that collected data to whomever is controlling the malicious cable.
“If used to connect a keyboard to a host computer, the cable can record every keystroke that passes through it and save up to 650,000 key entries in its onboard storage for retrieval later.” The Verge, read the full article
Co-founder Bob Baxley discusses the functionality and risk of the O.MG Cable.
HOW CAN I UNCOVER AN O.MG CABLE?
There is no physical inspection of the cable that can be done to reveal whether or not a cable is “normal” or has embedded processing capabilities. The O.MG Cable is made to imitate a regular commercially available charging cable. However, wireless monitoring of your airspace will reveal the device’s wireless activities. Gaining full wireless visibility into all of the devices into your space will allow you to find these otherwise innocuous-looking cables.
WHAT CAN I DO TO DEFEND AGAINST THIS THREAT?
Bastille recommends a few security best practices for this type of threat:
Purchase from Trusted Sources: Only purchasing charging and data-transfer cables from reputable vendors can help mitigate the risk of an O.MG Cable ending up in your space.
Monitor RF in Your Space: Continuous, passive monitoring of all wireless devices in your space will ensure that an O.MG Cable, should it enter your facility, will not go undetected.
Update and Enforce Your Security Policy: Establish and educate upon a corporate policy for all employees regarding these types of devices to help keep your space secure
Be Cautious with Public Charging: You’re in an airport or a café and realize you need to charge your device. Luckily, they have charging stations! But, be wary of these public charging cables as they may not be secure.
Stay Up to Date: The landscape of wireless security is constantly evolving. In order to defend against these threats, you need to know what’s out there. Watch our webinar on Spywares and Vulnerabilities for a deeper dive into the O.MG Cable and other threats that you should have on your radar.
