Hacker Introduces a Lightning Cable That Can Load LockScream to Steal Mac Passwords
Remember when we talked about the potential security threats behind using someone else’s charger? Well, the same developer who revealed a flaw in the Apple security back in August 2018 is now back with fully developed gadgets to intercept lock screen password. Although it is not clear when exactly these gadgets will hit the market, it is obvious that your Mac password isn’t as safe as you’d want it to be.
Use this entry as an educational material that can help you learn more about various actors threatening your Mac password security. Also, please do not forget to apply at least the most basic security measures to avoid malicious hacks.
Table of Contents
Who is MG?
MG is a security researcher who unveiled certain Apple security flaws some time ago. The hacker has his own website, where he posts the latest information about various projects. As one could expect, not much is known about the personal details of this researcher, but one of his latest projects is causing concern to security experts because of its application. The project is called the O.MG Cable, and that’s the USB cable that can intercept lock screen password.
What is O.MG Cable?
O.MG Cable is a custom USB cable primarily for Apple devices that exploits the previously revealed vulnerabilities. The vulnerabilities are all about the problem within Apple chargers that allow hackers to change the internal power circuitry. So, if hackers can add their hardware into USB cables, they can take control of the device that the cable is connected to. In other words, your Mac password is just one of the many things that could be hacked.
What does O.MG Cable look like? Well, it looks just like your regular Lightning cable. That’s the common USB cable that connects iPhone, iPod, and iPad to your computer. Like most of the USB cables, it can be used for syncing and charging. What makes O.MG Cable different from the regular Lightning cable is a small Wi-Fi transceiver embedded in the hardware. This transceiver can work as a wireless client or an access point. So, if someone connects to that transceiver, with the right software, they can gain access to your computer, too.
The good news is that there is a distance limit for O.MG Cable, and so the hacker has to be at least within a 100-meter radius from the device they’re trying to break into. To access the device, hackers need a mobile phone app that is also being offered by MG. The interesting thing about this project is that it doesn’t look like the hacker is profiting much from it. It’s more like he’s working on it out of pure interest and curiosity. According to the blog post that discusses O.MG Cable, the author called it “a near zero (more likely negative) profit project,” so it is very unlikely that the researcher is doing it for the money.
Potential payloads
Needless to say, the cable can be used to deliver various payloads. One of those payloads can easily steal your Mac password by intercepting lock screen password. This payload is called LockScream, and the attacker that uses it first distracts the user by sending them a random text message. While the user is distracted from the Mac, the hacker sends the payload through the O.MG Cable, and this payload locks the Mac screen.
As you know, to unlock the screen, you have to enter your Mac password again. The moment you do that, this payload intercepts the lock screen password. From there, if you go away from your computer for a moment, the hacker can use the intercepted password to unlock your machine and steal sensitive personal information.
Aside from stealing the Mac password, O.MG Cable can also be used for attacks on other systems. Researchers have pointed out that there are payloads for Ubuntu and Windows systems that can use the cable as well. And if that weren’t enough, this cable has been devised in a way that allows the attacker to remain hidden for as long as possible.
Think about it, when you plug in a new USB device or cable to your computer, the machine usually informs you about that, as it tries to install the drivers that would help you run whatever is connected to it. O.MG Cable, on the other hand, has a feature that allows it to avoid USB enumeration, and so the affected user is not notified about the new USB device connection. To put it simply, the cable has a perfectly working stealth mode.
Protection measures
It is obvious that the creator of O.MG Cable doesn’t even try to hide it. So, some users might wonder how it can even affect anyone when such activities are done out in the open.
The problem is that users often fail to employ the most basic security measures to protect their Mac passwords and other sensitive data. For instance, they tend to reuse the same passwords over and over again, instead of employing a powerful app that protects them with strong encryption algorithm.
Also, users are often too gullible, as they do not believe they could be the next target of a dangerous hacker attack. They often forget that any kind of information could be valuable on the dark market. Consequently, users do not grasp the importance of using only official products that are fully compatible with their devices. So, if you’re purchasing a new cable, make sure it’s from the official store! Also, be careful about using other people’s chargers, and avoid leaving your device unattended in a coffee shop or other public spaces when you run for a quick break to the bathroom.
These are the small constituents of your device and your personal information security. Be aware of your surroundings and make sure to exercise good cybersecurity habits. If you want to learn more about potential cybersecurity issues, check out our entry here on the seven big security mistakes that people make every single day.
