Topic: anyone make their own USB cables from scratch? - page 2. (Read 594 times)

A WiFi chip and proximity to the cable is completely unnecessary. If the device is set up to accept USB devices (as many are by default), a chip can execute any arbitrary code, including clipboard malware, key logging, screen capturing, uploading data from the device, or even downloading a payload over the internet.

How? If you are buying individual components to assemble yourself, where are they going to hide a chip that you won't notice it?

For *charging* you can get away with making your own cables fairly easily. I have done it and repaired some.
For data transfer, it's a bit more picky. They did work but with 1.1 speeds, the tolerances are easy for a machine to solder tougher for a human THAT DOES NOT DO IT WELL.
You can get away with many solder connections that are OK or even pretty good, to get full USB speed it's more difficult.

At least for me.

-Dave

Ability to do such thing in a company like Apple or Samsung with high control on employees is very low. According to this article they need to insert a wifi chip in cable's socket to remotely accept hacker's command. they also need to know who bought that fake cable they created in product line and then go close enough to victim to connect to wifi chip.... it is mission impossible. so that will be safer to use original cable than buying ready USB sockets online and creating cable himself. those sockets are more dangerous and may equipped with such chips.
next level could be using 007 USB cable

Why? Because shady individuals never apply to work at famous companies? How much oversight do you really think companies like Apple or Samsung put in to churning out millions of USB cables? You think every single one is quality control checked by at least two different people? If a rogue employee at Apple wanted to start embedding chips in to USB cables, they could probably get a good few thousand out before someone in quality control or a consumer picked it up.

It's a very unlikely attack, as each cable is probably only going to be used by one or two individuals. Much better to put a malicious cable at a public charging point and infect 100s of users a day. If, however, it's a vector of attack you want to protect against, then using cables from famous companies offers very little additional protection.

if you are worry about usb cable, always use branded, original cables from famous companies and that will be ok

how would that work? any links or such?

You do not have to be anxious about these attacks, even if you use a harmful USB, the hacker still needs some permissions from you to be able to carry out the attack successfully, in fact, these attacks are based on the fact that your computer allows and enables HID devices on all USB ports.

The easy solution: Use only a reliable USB link, avoid connecting any unknown connections, you can check the connection by dismantling part of it.
The difficult solution: Add some codes that deny access to these permissions.

heh yeah ive never used airport or hotel charger ports, i always bring my own battery banks and cable (for on the go) and bring my own wall powered usb chargers, usually just need quality extrnally powered hub as most support hi speed charging protocols on some/all ports.

with supply chain attacks happening more and more sooner or later compromised cables will be out in the wild, if not there already. i never use cable that come with hardware wallets any more; they go into the trash (overly paranoid? you bet!). im sure theyre fine, but my philosophy is you cant be too prepared, especially in security.

i plan on whipping up a bunch of self built  usb 2,(whatever) cables purely for my own peace of mind.

Oh yeah, in that case, it's certainly a vector of attack to be aware of. There are devices on the market such as USBHarpoon and USBNinja that anyone can purchase and configure, which are essentially a BadUSB attack hidden inside a USB cable. The cable will perform normally otherwise, transmitting power and data to any connected devices, and can be programmed to deliver the attack when it detects periods of inactivity (so less chance of being detected) or when it is triggered by Bluetooth or an antenna. There's also the possibility of attacks similar to juice jacking.

These attacks are the reason you should never use public charging stations' provided cables, and should only use the station at all if you can connect to it with your own power only USB cable, which is unable to transmit data of any sort. You can buy such cables, but they are very simple to create yourself - take any existing USB cable, and remove the inner two data pins, leaving only the outer two power pins. Although its nicer if you open up the casing and remove the pins gently, you can also achieve this by just pulling them out with a small pair of pliers.

yes, trezor and other hardware wallets that you confirm addys and amounts are the same as the computer displays prevent most attacks.

i also lump in "badusb" type stuff that may not target the wallet, but want to inject malware to that machine, hoping to get other data. should of been more clear, my bad.

i have looked into just buying bulk usb cable and connectors. probably make some just for piece of mind.

EDIT: nice site, bookmarked.

Kind of, but it's unnecessary.

The whole point of a good hardware wallet (such as a Ledger device) is to protect your keys (and therefore your coins) from malware and other attacks, including when connecting them to compromised software or hardware. The most that a compromised cable could do would be to change the transaction between you clicking to sign it on your computer and it showing up on the screen of your hardware device. In that case, provided you double check what shows up on your hardware device matches what you have tried to do on your computer, then you will recognize the attack immediately. Your keys never leave the device and so couldn't be stolen. If the cable tried to change your transaction after you had signed it on your hardware wallet and were sending it back to your computer, then it would become invalid and wouldn't be accepted by the network.

---

Easier than building your own from scratch would be to just open up the casing on a cable you have to make sure there are no extra chips hidden in there. If you want to build your own, you can buy entire DIY USB kits, or male and female connectors for a few bucks and strip an old cable that you already own. You can also find no-solder connectors that you can just screw the cables in to if you don't have a soldering iron. I followed this guide from the geekhack forums when I did it several years ago: https://geekhack.org/index.php?topic=44924.0. I had an extra long cable which had become damaged at one end, and wanted to repair it rather than buy a new one. The repair worked, but my handiwork was even less robust than the manufacturer's and it wore through again within a few months, so I just bought a good quality braided cable instead.

per title.. would suck bad to use a compromised cable with a hardware usb connected wallet. maybe this is overblown? although this (bluetooth chip or even just memory to cache communications) is in prototype phases and as such it is a real possibility.

as it seems with the extremely small chips that could be hidden in a usb cable/connector now, and the proof of concepts out there demonstrating it. so to protect against that, seems it should be easy to make your own cables to meet minimum usb1.1 spec.

anyone done so?

EDIT: aaack. meant to put this in Hardware Wallets. if a mod could please move it there if more appropriate, thanks.