admin

Are your USB cables sending your data to hackers? We expect USB-C cables to perform a specific task: transferring either data or files between devices. We give little more thought to the matter, but malicious USB-C cables can do much more than what we expect. These cables hide malicious hardware that can intercept data, eavesdrop on phone calls and messages, or, in the worst cases, take complete control of your PC or cellphone. The first of these appeared in 2008 — but back then they were very rare and expensive — which meant the average user was largely safeguarded. Since then, their availability has increased 100-fold and now with both specialist spy retailers selling them as “spy cables” as well as unscrupulous sellers passing them off as legitimate products, it’s all too easy to buy one by accident and get hacked. So, how do you know if your USB-C cable is malicious? Identifying malicious USB-C cables Identifying malicious USB-C cables is no easy task since they are designed to look just like regular cables. Scanning techniques have been largely thought of as the best way to sort the wheat from the chaff, which is what industrial scanning company, Lumafield of the Lumafield Neptune industrial scanner fame, recently set out to show. Also Read: Secure Our World Software Updates Tips The company employed both 2D and 3D scanning techniques on the O.MG USB-C cable — a well-known hacked cable built for covert field-use and research. It hides an embedded Wi-Fi server and a keylogger in its USB connector. PCWorld Executive Editor Gordon Ung covered it back in 2021, and it sounds scary as hell. What Lumafield discovered is interesting to say the least. A 2D X-ray image could identify the cable’s antenna and microcontroller, but only the 3D CT scan could reveal another band of wires connected to a die stacked on top of the cable’s microcontroller. You can explore a 3D model of the scan yourself on Lumafield’s website. It confirms the worst — that you can only unequivocally confirm that a USB-C cable harbors malicious hardware with a 3D CT scanner, which unless you’re a medical radiographer or 3D industrial scientist is going to be impossible for you to do. That being so, here are some tips to avoid and identify suspicious USB-C cables without high-tech gear: If this article has been an eye-opener about the dodgy tactics hackers employ to steal your data, you’re not alone. Malicious USB-C cables are still not widely known about. That being so, be sure to share the tips above with your family and friends. The more people that take time to safeguard their data, the safer we will all be in the long run. Credit: PC World

Over 1 million registered domains could be vulnerable to a cyberattack method known as “Sitting Ducks,” as recently unveiled in a new report from Infoblox Threat Intel. This relatively unknown attack vector allows malicious actors to hijack legitimate domains by exploiting misconfigurations in DNS settings. The Sitting Ducks attack, which has been active since 2018, enables threat actors to gain full control of a domain by taking over its DNS configurations. Infoblox’s monitoring initiative identified approximately 800,000 vulnerable domains, with about 70,000 of those already hijacked. Threat Groups Several threat actor groups have been exploiting this attack vector: The attack is particularly dangerous due to its stealthy nature. Hijacked domains often retain their positive reputation which allows them to evade detection by security tools. This makes it challenging for security teams to identify and mitigate the threat. The impact of Sitting Ducks attacks is far-reaching, affecting organizations, individuals, and security teams. Businesses face reputational damage, while individuals risk malware infections, credential theft, and fraud. Security teams struggle to defend against these attacks due to the use of trusted domains in malicious infrastructure. To protect against Sitting Ducks attacks, domain holders, registrars, and DNS providers must ensure correct configurations and implement proper ownership verification processes. Increased awareness and vigilance within the cybersecurity community are crucial to addressing this growing threat. Credit: Cybersecurity News