The security investigator develops a Lightning cable with a hidden chip to steal passwords

A normal-looking Lightning cable has been developed that can be used to steal data such as passwords and send it to a hacker. Vici reports.

The “OMG cable” compared to Apple’s Lightning to USB cable.

The “OMG cable” works exactly like a normal USB Lightning cable and can record keystrokes, iPads, and connected iPhones from Macs, and then send that data to a bad actor who could be more than a mile away. They work by creating a Wi-Fi hotspot to which a hacker can connect and, using a simple web application, can record keystrokes.

Cables also include geo-locking features that allow users to activate or block device payloads based on their location, preventing leakage of payloads or keystrokes from other devices. Other features include the ability to change keyboard assignments and the ability to forge the identity of USB devices.

The cables contain a small implanted chip and are physically the same size as genuine cables, making it extremely difficult to identify a malicious cable. Apparently, the implant occupies approximately half the length of the plastic housing of a USB-C connector, allowing the cable to continue to operate normally.

An X-ray view of the chip implanted at the USB-C end of an OMG cable.

The cables, manufactured as part of a series of penetration testing tools by the security researcher known as “MG,” have gone into mass production to be sold by cybersecurity vendor Hak5. The cables are available in several versions, including Lightning to USB-C, and can visually mimic cables from various accessory manufacturers, making them a notable threat to device security.