What do you do when you’ve misplaced or forgotten your USB cable, the one you use every day to charge your phone? You borrow another one, of course, and you’re good to go. And you don’t worry about the unpleasant consequences that this simple loan might have… In fact, for most people, part of the vulnerability of the USB interface often goes completely unnoticed.

Spy microcontroller hidden in the connector

We’ve certainly learned to beware of USB memory sticks, but our vigilance stops there. Nonetheless, if this subject interests you, you are doubtless aware that inside the USB connector it is possible to conceal a microcontroller. That is capable of transforming a common-looking USB cable into a formidable hacking tool. A few years ago, when this possibility (often called BadUSB) was brought to light, it made a bit of noise. It has been made practical in an interesting product (but one of debatable uses!)

The microcontroller hidden in the connector of the USB Ninja cable is notable in that it communicates wirelessly with the outside world. It is its Bluetooth interface which allows the person controlling the USB Ninja to surreptitiously load malware or spyware.

Programming the device can be done directly in C or in the Arduino programming environment (IDE). Unlocking the device is done with the aid of a small magnet.
 

USB: Espionage, sabotage, infiltration

At first glance, USBNinja innocently looks like a USB data / charging cable (4 to 25 V @ 10 mA). Once activated by Bluetooth (remote or smartphone) it becomes active. It then acts as a keyboard or mouse, clandestinely transmitting various commands to the system. These are called, modestly, payload but they can be real torpedoes. It all depends on the intentions, good or bad, of the programmer. He is free to program the payload as he sees fit.

Penetration testing, police and authorities

According to the manufacturer who presents it as an ideal tool for pentration testers, police and the authorities, such an intruder is not detected by firewalls. As for police, the product is well named. According to Wikipedia, Ninja (忍者) is the modern Japanese word meaning spies or mercenaries, traditionally called shinobi (忍び, literally “to slip through”) who use espionage, sabotage, infiltration, assassination and guerilla techniques.