Samy Kamkar, a security researcher, shows hacking projects, including Evercookie, PoisonTap, NAT Slipstreaming, and hardware attack devices.
HN links it for his security tools like Evercookie and for the site itself, which commenters note tries to detect DevTools and block viewing its source.
For those who may be curious, how two very similar products (USBNinja and the O.MG Cable) exist, there is a bit of history.
Both products are based on the concept of a HID attack: most modern OSs (MacOS, Linux, Windows, Android...) trust HID (Human Interface Devices) implicitly. This means that when you plug in a Keyboard, Mouse, Storage device or Network device, they work instantly. You don't need to install drivers or explicitly enable them. The newly attached devices work instantly - even on a locked device.
The advantage here is obvious. The disadvantage is more subtle, but was exploited by the Hak5 "Rubber Ducky". By emulating a HID device (or even worse, multiple HID devices simultaneously..) - you could essentially control a computer and deploy / execute anything, as if you had full control of the device.
"The Classic" PoC is the Windows "Creds" attack [1] - which unlocks locked windows machines - later turned very, very nuclear by Samy Kamkar with PoisonTap [2], which essentially exfiltrates data, exfiltrates cookies and credentials, and permanently backdoors a locked PC.
The idea of moving from a dedicated device (Rubber Ducky) to an embedded device first came to surface with the BadUSB device [3].
The idea of moving it into a cable came from the NSA, a device called COTTONMOUTH [4][6], which was leaked during the NSA document dumps [5]. MG, the designer of BadUSB, built a prototype of this with today's resources.
RRG, the company behind the latest iterations…
That's circumstantial evidence at best.
Here's more useless analytical evidence to suggest that most people don't know everything: when Samy Kamkar[0] first demonstrated geolocation via BSSIDs, I tried out every wireless router in my house, including one that had not been plugged into a wall in over 4 years and never at my current residence, long before Google started wardriving for street maps and well before the first iPhone came out. He was able to accurately map it to my old residence. That means that sometime before December of 2006, someone or something was able to snatch my BSSID from someplace, accurately note it's physical location in the world, and store that away in some database that was used almost 4 years later. I can guarantee you it was not Apple, and I'd be damned surprised if it was Google at that time.
[0] http://samy.pl/mapxss/
> site showing the ads could easily fake
Yes, that's what I mean by "unable to verify"; If the site is honest, everyone would be just as happy, but there is already so much fraud, even with (relatively) trustworthy Google and Facebook, that everyone wants some ability to verify; If all the traffic goes only through the site, that ability is lost.
> Assuming that the advertising site would just have a proxy that tunnelled everything to the ad server, would the ad server not get the exact same traffic?
Not exactly - the wide-sense-cookies[0] that allow the ad server to track users across different web sites would not be. Fingerprinting[1] would still work subject to advertisers trusting the proxy.
[0] including flash objects, etags, localstorage, etc, see https://samy.pl/evercookie/ for a 7-year-old discussion.
[1] https://panopticlick.eff.org/
Disabling UPnP makes your system more secure, but unless you also disable all NAT ALGs in your router, you're still exposed to its dangers.
I don't think most routers have a setting for that, so if infected devices are part of your security model, it would be wise to assume NAT is entirely non-functional because of [NAT slipstream attacks](https://samy.pl/slipstream/). An infected device can modify the router's NAT table to effectively act like UPnP, except they don't provide a user interface for you to audit.
If you're NAT free (i.e. only use IPv6) disabling UPnP can be a decent security measure if you're willing to manually do all of your firewall exclusions, but honestly host firewalls are the only reliable protection method for most people these days.
Even if patched/depracated, still a websocket to any ip-address with the packets as long as it can send the packet. Literally any chat applet.
Torrent files, pretty much anything. It's not that scary at the moment.
Browsers can do it now. It's an age old 'feature' -> https://github.com/garywill/LAN-port-scan-forbidder
uBlock apparently blocks your browser from reaching out to your LAN though, but; no 'sandbox escapes' needed, just javascript being loaded.
Our browsers could have been exploiting things behind NAT this entire time. Smart TVs, Smart watches, phones, anything pingable on your LAN.
Go here and see it in action: http://samy.pl/webscan/
Samy Kumar did a project about 10 years back, where he worked out how to brute force a 12 bit garage door code in under 10 seconds, using a childs toy: http://samy.pl/opensesame/
My garage door opener uses a 12 but dip switch config (and my last place used an 8 dip switch config, and I'm pretty sure still does).
Re reading that OpenSesame post was fun. It reminded me of a few names I need to go find out what they're up to these days (Travis Goodspeed and Michael Ossmann are names I remember seeing doing/writing-up some really cool stuff), and that the Mattel IM-ME toy he was using uses that same CC1110 "sub gHz"