Topic: anyone make their own USB cables from scratch? (Read 633 times)

I do agree, you're speaking to someone who has degoogled their phone, uses Qubes OS, and is generally very paranoid . I've never had to use a USB socket at an airport, I tend to go for phones with bigger batteries.

Although, as much as we try to avoid it, if they go to this extent, they've probably already infiltrated most of the phone manufacturers themselves. It's generally why it's said that you can't really escape state level spying, whereas you can at least keep your privacy intact from non state level spying.

I'll take a look at the juice jacking in a bit more detail. I'm quite fascinated, since I knew of USB exploits being plugged into a computer (hence why I like the idea of a disposable sys-usb on Qubes OS), and obviously phones, but I never really considered it with the USB sockets themselves.

Absolutely! State-level stuff can just have malicious USB sockets installed by the contractors when the facility is built / renovated. That way there's not much risk involved. You can argue that they might also simply use those acquired USB exploits by plugging in your device when you pass the x-ray.

However, this 'juice jacking' [1] attack is pretty well researched and there have been warnings by the FBI [2], but I'm not aware of research about the deployments 'in the field'.

That's good to know!

I mean just a 5V charger / transformer from 110 / 220V.

[1] https://en.wikipedia.org/wiki/Juice_jacking
[2] https://news.softpedia.com/news/fbi-warns-against-wireless-keystroke-loggers-disguised-as-usb-chargers-504435.shtml

Yeah, wouldn't this be more state level spying rather than independent malicious actors? First, to tamper with a USB socket in plain sight in public seems rather high risk, for relatively low reward? At least, you don't hear of it too often. I mean, there's plenty of better places to do it than a airport with all the cameras, and security walking about. However, you typical cheap hotel probably isn't going to have this sophisticated attacks, they'd be much more likely to do identity theft with the documents you provide or alternatively run off with your credit card.

I have a 50,000mah one which I know wasn't allowed, which I admit is significantly larger than your usual power bank. I believe the limit is in the 20kmah mark, and you're allowed two of them, which have to be carried in your hand luggage due to risk of the lithium battery catching fire.

Here you go:

Depends on the length of travel. At some point that brick is going to need charging.

From both my gut feeling, news stories and professional experience, I can say that USB exploits are not uncommon, but pretty sought after by companies in the exploit buying / selling business, as well as the people and organizations they sell them to. In my opinion, the highest risk of finding malicious USB ports will be in airports / border controls. There are known cases of some countries' border patrol (hidden or even openly - if I recall correctly) jailbreaking / rooting people's phones to track and spy on them. I expect this risk to be much lower in generic hotel room equipment.

I'm not sure about that, but I've definitely lived off a single (large) power bank for a 7-day week and I believe that was still plane legal.

On the other hand, if you have the capacity and remember to bring a voltage checker, why don't you just bring a 5V brick?

Fair play, I thought I was security conscious, but I'll be honest I've never even thought about the possibility of a socket being compromised. I mean, even now that I've been made more aware that these things do happen, I imagine they're slim chanced. Would be interested seeing when, and where this happened, and to what extent they gained access to someone's device. I do use Qubes OS with a sys-usb for unknown usb devices, but never really thought about it with charging the phone. Although, my Bitcoin hasn't ever touched my phone, so not that I have to worry about that.

Aren't you limited by what you can carry with battery banks anyhow. I always thought there was a maximum of two at a certain volume. Otherwise, I'd be bringing more of them on my travels.

For that you could bring a voltage checker. They're cheap, and if you've done any electricity work in the house you've probably already got one.

another thing i worry about in hotels that have those usb sockets mounted in multipurpose wall sockets (ie 2 x 120/240v outlets and 2+ usb sockets) and found in stuff like nightstand etc with built in usb plugs is you have no idea how good the power supply in them is. while some may be fine as far as voltage regulation etc im sure there is some absolute trash electronics in some of them that supplying lord knows what as far as the powers purity. sure in theory there may be some protection (?)  on the device  but why chance it.

much prefer to plug my $1k plus phones etc into a known good usb supply that i bring.

so a couple good reason to never trust strange usb sockets in the wild.

You don't even need to strip it - a pair of needle nosed pliers and you can reach in there and just yank out the two middle pins. Not the most high tech solution, but it does the job.

Connecting your device to a standard electricity wall socket via your own cable and adapter plug is fine. Connecting your device directly to USB socket on the wall via your own cable is not (unless the cable is power only) - you have absolutely no idea what could be hiding on the other side of that USB socket. The risk of doing this is akin to the risk of picking up a random USB drive you find lying in the street and plugging it in to your device.

How about PortaPow?

nice. thanks for the links. will check into them.

I believe interception would be much easier to do and it would work across operating systems and OS versions, so it's much more likely. Also I don't know how you would set up shared symmetric keys between device and software, without the key being leaked. It should be trivial to extract it from the binaries, so a hardcoded key is out of the question. There would need to be a key agreement setup phase the first time you connect the wallet to the software, which I've never heard of being used in hardware wallet software.
A quick GitHub search on Trezor's firmware repo [1] yields nothing regarding key agreement or public keys to protect the USB connection, but it might be worth analyzing the traffic - especially on closed-source devices - using a device such as Adafruit Beagle USB 12 [2]. Low-cost DIY solutions also exist which may be enough for hardware wallet USB communication [3].
Anything such a USB hardware sniffer can extract, can also be extracted by a malicious cable and either stored locally^{[on the cable]} to later be extracted by the attacker, sent over WiFi or maybe by injecting a process on the host which has network connectivity.

Another search term for these devices would be 'USB sock' or 'USB condom'. They even exist for USB-C (since we talked about it before). Downside is that they're easy to lose.

That's why I currently only use QR codes (like @dkbit98 mentioned) - don't have to worry about all this nonsense anymore at all.

[1] https://github.com/trezor/trezor-firmware/search?q=key+agreement
[2] https://www.adafruit.com/product/708
[3] https://github.com/matlo/serialusb

this is another very good way. except. im lazy af 

once i took a dremel with a diamond bit and ground out the two data traces in the plug on a couple cables i had. works but messy.. i just sprayed the crap out with contact cleaner after.

@dkbit98  at this point in this timeline i have a baseball cap with silver foil liner. that  way i get the sunviser too.

Are you always bringing tin foil hat with you on your travels?
I don't see the problem in connecting devices for charging in wall power socket, you can always bring adapter with you, but it's different thing connecting it with other devices.
Best thing about airgapped hardware wallets is the fact they don't need any cables for connection with computer and other devices, and they are even safer if they don't have bluetooth and wireless conenction.

Why not strip the wire instead and cut the two lines the data+(green wire) and the data-(White wire) then two negative(Black) and positive(Red) should remain then use heat shrink to cover it back. If you need the cable for other things to transfer data make sure it's not related to your wallet or any important data then you can strip it again and connect those two cut lines.

Or buy an adapter like this below then put a tape on the two pins in the middle

sweet. gonna grab me some pronto.

A malicious cable could still inject and run arbitrary code on the computer you are connecting the hardware wallet to, and steal your unencrypted public keys or addresses from there. So although a good hardware wallet should protect you from any direct security risks associated with a malicious cable, as n0nce says there is still a privacy risk.

Go one step further, and make sure all the cables you are carrying with you are power only cables (except maybe one data cable if you need to connect up your hardware wallet/phone/tablet/laptop to each other). That way, you can use public charging points or hotel charging points without risk of transmitting any data to or from your devices. You can buy such cables or make them yourself as I described above. You can also buy small adapters which connect to regular USB cables and only attach to the power pins, leaving the data pins disconnected - search for USB defender or USB blocker.

But if hardware wallets encrypt all data being transmitted from the device to the PC with an AES key [hardcoded in both hardware device and software library], then wouldn't a malicious cable only be able to read gibberish anyway?

After all, it's not like they can get an Ethernet interface or WiFi interface inside it and relay the gibberish to some remote server to attempt to brute-force the key. Or try to do it themselves by putting a mini-ASIC of some sort.

thats why when i travel i never use usb charge sockets in airports and hotel rooms. i bring several usb battery banks for my phones and ebook reader for on the go recharging. in hotel rooms i always bring my own powered hubs.. like the ones that plug into conventional wall power and can charge 10+ usb items and such. plus spare hubs and cables so when one craps out i have spares. no need to by crap stuff cuz youre out.

I think it would also be possible for a badUSB cable to intercept the xpub or individual public keys that are sent from device to host and then send those to a server for deanonymization, wouldn't it?

Should be highly unlikely since the cables in question are much more expensive than regular USB cables so they cannot be sold for like $10 without taking a loss. They are just used for targeted attacks. For instance, someone handing you such a cable, or distributing them in the office.

USB attacks in the wild also happen in airports or other public places where there are free phone charging spots. You connect the phone to a bad USB socket or cable and get infected with some malware / virus / tracker. Speaking of airports: border security of some nations intentionally infects devices of visitors to spy on them.

I cant remember a particular case where i have read of an infected series of cables being distributed over Ebay/Amazon but it is possible, why not. A malicious person could infect at least a few devices before negative comments start to flow in. After that the users would become cautious and ebay/amazon could delete the sales threads.

Any cases where there is malware/virus from buying cables on ebay or amazon?

A WiFi chip and proximity to the cable is completely unnecessary. If the device is set up to accept USB devices (as many are by default), a chip can execute any arbitrary code, including clipboard malware, key logging, screen capturing, uploading data from the device, or even downloading a payload over the internet.

How? If you are buying individual components to assemble yourself, where are they going to hide a chip that you won't notice it?

For *charging* you can get away with making your own cables fairly easily. I have done it and repaired some.
For data transfer, it's a bit more picky. They did work but with 1.1 speeds, the tolerances are easy for a machine to solder tougher for a human THAT DOES NOT DO IT WELL.
You can get away with many solder connections that are OK or even pretty good, to get full USB speed it's more difficult.

At least for me.

-Dave

Ability to do such thing in a company like Apple or Samsung with high control on employees is very low. According to this article they need to insert a wifi chip in cable's socket to remotely accept hacker's command. they also need to know who bought that fake cable they created in product line and then go close enough to victim to connect to wifi chip.... it is mission impossible. so that will be safer to use original cable than buying ready USB sockets online and creating cable himself. those sockets are more dangerous and may equipped with such chips.
next level could be using 007 USB cable

Why? Because shady individuals never apply to work at famous companies? How much oversight do you really think companies like Apple or Samsung put in to churning out millions of USB cables? You think every single one is quality control checked by at least two different people? If a rogue employee at Apple wanted to start embedding chips in to USB cables, they could probably get a good few thousand out before someone in quality control or a consumer picked it up.

It's a very unlikely attack, as each cable is probably only going to be used by one or two individuals. Much better to put a malicious cable at a public charging point and infect 100s of users a day. If, however, it's a vector of attack you want to protect against, then using cables from famous companies offers very little additional protection.

if you are worry about usb cable, always use branded, original cables from famous companies and that will be ok

how would that work? any links or such?

You do not have to be anxious about these attacks, even if you use a harmful USB, the hacker still needs some permissions from you to be able to carry out the attack successfully, in fact, these attacks are based on the fact that your computer allows and enables HID devices on all USB ports.

The easy solution: Use only a reliable USB link, avoid connecting any unknown connections, you can check the connection by dismantling part of it.
The difficult solution: Add some codes that deny access to these permissions.

heh yeah ive never used airport or hotel charger ports, i always bring my own battery banks and cable (for on the go) and bring my own wall powered usb chargers, usually just need quality extrnally powered hub as most support hi speed charging protocols on some/all ports.

with supply chain attacks happening more and more sooner or later compromised cables will be out in the wild, if not there already. i never use cable that come with hardware wallets any more; they go into the trash (overly paranoid? you bet!). im sure theyre fine, but my philosophy is you cant be too prepared, especially in security.

i plan on whipping up a bunch of self built  usb 2,(whatever) cables purely for my own peace of mind.

Oh yeah, in that case, it's certainly a vector of attack to be aware of. There are devices on the market such as USBHarpoon and USBNinja that anyone can purchase and configure, which are essentially a BadUSB attack hidden inside a USB cable. The cable will perform normally otherwise, transmitting power and data to any connected devices, and can be programmed to deliver the attack when it detects periods of inactivity (so less chance of being detected) or when it is triggered by Bluetooth or an antenna. There's also the possibility of attacks similar to juice jacking.

These attacks are the reason you should never use public charging stations' provided cables, and should only use the station at all if you can connect to it with your own power only USB cable, which is unable to transmit data of any sort. You can buy such cables, but they are very simple to create yourself - take any existing USB cable, and remove the inner two data pins, leaving only the outer two power pins. Although its nicer if you open up the casing and remove the pins gently, you can also achieve this by just pulling them out with a small pair of pliers.

yes, trezor and other hardware wallets that you confirm addys and amounts are the same as the computer displays prevent most attacks.

i also lump in "badusb" type stuff that may not target the wallet, but want to inject malware to that machine, hoping to get other data. should of been more clear, my bad.

i have looked into just buying bulk usb cable and connectors. probably make some just for piece of mind.

EDIT: nice site, bookmarked.

Kind of, but it's unnecessary.

The whole point of a good hardware wallet (such as a Ledger device) is to protect your keys (and therefore your coins) from malware and other attacks, including when connecting them to compromised software or hardware. The most that a compromised cable could do would be to change the transaction between you clicking to sign it on your computer and it showing up on the screen of your hardware device. In that case, provided you double check what shows up on your hardware device matches what you have tried to do on your computer, then you will recognize the attack immediately. Your keys never leave the device and so couldn't be stolen. If the cable tried to change your transaction after you had signed it on your hardware wallet and were sending it back to your computer, then it would become invalid and wouldn't be accepted by the network.

---

Easier than building your own from scratch would be to just open up the casing on a cable you have to make sure there are no extra chips hidden in there. If you want to build your own, you can buy entire DIY USB kits, or male and female connectors for a few bucks and strip an old cable that you already own. You can also find no-solder connectors that you can just screw the cables in to if you don't have a soldering iron. I followed this guide from the geekhack forums when I did it several years ago: https://geekhack.org/index.php?topic=44924.0. I had an extra long cable which had become damaged at one end, and wanted to repair it rather than buy a new one. The repair worked, but my handiwork was even less robust than the manufacturer's and it wore through again within a few months, so I just bought a good quality braided cable instead.

per title.. would suck bad to use a compromised cable with a hardware usb connected wallet. maybe this is overblown? although this (bluetooth chip or even just memory to cache communications) is in prototype phases and as such it is a real possibility.

as it seems with the extremely small chips that could be hidden in a usb cable/connector now, and the proof of concepts out there demonstrating it. so to protect against that, seems it should be easy to make your own cables to meet minimum usb1.1 spec.

anyone done so?

EDIT: aaack. meant to put this in Hardware Wallets. if a mod could please move it there if more appropriate, thanks.