How to Detect Malicious USB Spy Cables #TSCM #MurrayAssociatesTSCM

Video Description

A malicious spy cable is any cable (electrical or optical) which performs an unexpected, and unwanted function. The most common malicious capabilities are found in USB cables. Data exfiltration, GPS tracking, and audio eavesdropping are the primary malicious functions. The first malicious USB spy cables began life as an NSA-created spy tool under the code name COTTONMOUTH in 2008. The government paid a lot for it. The cost for their spy cable back then was $1,015.00 per cable, and your agency had to purchase them in lots of 50. Now, they are a fraction of that cost on various websites across the internet. Fast Company reports it, “should send shivers through everyone in the privacy and security.” Malicious USB Cable Capabilities The general expectation is that a cable performs no other function than to transfer energy and/or information (electrically or optically) between two points. Malicious USB cables do much more. Some act as eavesdropping bugs which can automatically record calls. Or, call a pre-programmed phone number, whenever voices are heard. They draw their power from whatever they are plugged into, and use the cellular phone system to make the call. Some also have GPS tracking capability; perfect for vehicle surveillance. The worst malicious cables take control of a user’s cell phone, laptop, or desktop. User names and passwords are the first bits to go. Next, the connected device’s storage is emptied. Next, pre-loaded penetration tools spring into action. The connection is used as a pivot point to attack other machines and databases on the network. All of this is controlled remotely by an outside hacker, via Wi-Fi to the internet, or nearby smartphone. The hacker roams unnoticed on the network, motives unknown. Once the hacker has infiltrated the network. More data can be extracted, viruses planted, or a ransomware attack staged. This is dangerous in a business environment. All this from an innocent-looking USB cable! Malicious USB Spy Cable Threat Assessment • Cellular or Wi-Fi transmission • Data exfiltration / injection capabilities. • Eavesdropping, GPS tracking, keystroke capture capabilities. • Most look exactly like regular USB cables. • They are openly sold on the internet. • Costs range from $6.74 to $160.00. • Placement in an office environment is easy. • Once in place they won’t be suspected. • Discovery is impossible without inspection. Sometimes these “value added” cables are sold as legitimate penetration testing tools. Unfortunately, sales are not restricted to just legitimate cybersecurity practitioners. Other times they are openly advertised as spy cables. LINKS • USB – Hacked Charging Cables https://counterespionage.com/hacked-usb-charging-cables/ • USB – Malicious Spy Cable Detector Instructions https://counterespionage.com/malicious-usb-cable-detector-instructions/ • USB – General Memory Stick Warning https://counterespionage.com/usb-memory-security/ • USB – Malicious Cables https://counterespionage.com/malicious-usb-cables/ • USB – NSA Type Cable Bug – $6.74 https://counterespionage.com/usb-cable-bug/ • USB – Where to buy a USB Spy Cable Tester – Amazon https://amzn.to/3ZbL0lL More videos like this one. https://www.youtube.com/c/KevinMurray-TSCM/videos Free TSCM and corporate security white papers https://counterespionage.com/media/tscm-security-reports/ Voltage / Current USB Cable Tester https://amzn.to/3HLEEQS USB Data Blocker (2 pack) https://amzn.to/3qUk4YO USB C Female to USB Male Adapter (2 pack) https://amzn.to/3oR6FOv Black Canvas Carry Bag (20 pack) https://amzn.to/3r04Ilx