Related:
Cheap rj45 ethernet to USB adapter contains malware
replies(2):
Cheap rj45 ethernet to USB adapter contains malware
Basically, what do you get if you hotplug it into a laptop running a current linux kernel and do "sudo lsusb -v" vs "sudo lspci -v"?
The ones that are native PCIE devices offer much better performance, up to 2.5 GBASET line rate, and will communicate with the host over the implementation of thunderbolt over USB.
The ones that are USB only might work okay, but there's a reason they're cheap.
Of course a cheaper laptop also won't have any implementation of thunderbolt on it, so that's something to consider as well.
1) downloading Windows exe files from Chinese forums
2) the USB storage provided by network card can still contain malware,
3) or can be accidentally booted from
4) it has universal USB controller, so can become any HID device: keyboard, mouse...
Made me laugh. Fun article, also really love the genre of "bored smart person goes too deep on something that the end result is obvious by common sense but proving it requires surprising amount of ingenuity and scrappiness"
I don't know of any modern systems that will execute anything on a newly inserted drive, nor boot from an external drive in the default configuration.
So we are missing a couple of things. First, a vulnerability in the OS/system. Second, an implementation of that vulnerability in a device like this.
Should this design be phased out? Perhaps. There is relatively little difference between not populating the flash memory part of the board and a proper network-only implementation.
Per Wikipedia, USB 3.0 (from 2008) can reach 5 Gbit/s, so (naively?) one would expect them to reach 2.5 GbE line rate easily, right?
And a great example that truth is complicated, expensive and uncomfortable. It's much easier to postulate an evil nation-state entity with a bad plan (without evidence) than to dig through the thicket of this article. It's much cheaper as well, certainly in terms of time and knowhow. And it's also much more comfortable to claim you're the victim and have uncovered a conspiracy, rather than realize this was just the result of the patchwork typical of engineering.
Kudos to the author.
The worst thing is this creates an environment where most people are either completely credulous and buy into everything or completely incredulous and think everything is unfounded. It's just exhausting to have a healthy level of skepticism these days, and maybe 1 out of 1000 times (number source: from thin air) something that sounds insane actually has some truth to it.
>Malicious hardware has plenty of precedent: it’s been used by intelligence agencies and private pentesters alike. Heck, a bit over a decade ago, I built an evil plasma globe for work. Still, we weren’t here to debate whether a malicious RJ45-to-USB adapter could be made. The important question was whether in this particular instance — as the poster put it — “the Chinese were at it again”.
That seems unlikely given that "malware" is signed by Microsoft Windows Hardware Compatibility Publisher.
People should have more faith in dongles. Not all are bad.
The ISO thing is a little bit weird, but to be honest it's a creative way to try to evade corporate IT security policies restricting mass storage USB devices. I think optical drives use a different device class that probably evades most restrictions, so if you enumerate as a complex device that's a combo optical drive/network adapter, you might be able to install your own driver even on computers where "USB drives" have been locked out!
Of course, there's a bit of a jump from that to making bold claims about what it's doing, but the initial concern was understandable.
I.M.H.O. these USB dongles are actually preferable to the much more expensive Thunderbolt dongles praised below, because a) they work on regular USB ports as well b) they do not require Thunderbolt c) they use less power and d) they don't force a highly ventilated cooling mode on certain host systems. And, fwiw, at least some Thunderbolt docks actually used USB NICs connected to the internal USB controller, which was hooked up over PCIe.
Anyways, I think it's clever for peripherals to help you bootstrap, and having the drivers baked into the device makes things a little easier instead of trying to find a canonical download source.
So I'll still call them RJ45 connectors. Because nobody has time to say "8P8C unkeyed modular connector" every time!
But multiple modes of operation really made it harder for to configure devices like those 4G/LTE USB dongles: they will either present as USB storage, or one type of serial device or a CDC-ACM modem device (or something of the sort), requiring a combination of the tools + vendor-specific AT commands to switch it into the right mode. Ugh, just get me back those simple devices that do the right thing OOB.
https://blog.brixit.nl/making-a-usb-ethernet-adapter-work-sr...
In my case I disabled the SPI flash module to have it not appear as a CD drive, the author of this post actually found some documentation about the SPI being optional. Funnily enough this post now also gives you all the tooling to make an actual evil RJ45 dongle by reflashing one :D
(A) replace your WiFi adapter - download drivers from internet
(B) configure a router or other equipment (hard to configure WiFi without WiFi).
(C) stand up your Linux install on your laptop (easiest way to futz around until you get WiFi adapter working - but check chipset on adapter is compatible which the cheapest usually are)
You don't usually care about the performance. Just keep a cheap one in your box of shit - I need mine often enough. If you need high performance, then buy a high performance adapter.
Now I never trust anything with Realtek in it, and if buying anything with an Ethernet port, I try to make sure it’s not Realtek. Is this still valid concern, or is Realtek better now?
I appreciate the ones that don't need their own drivers in the first places. Sure something needs special drivers but things like usb sticks and mice should just work using the default ones and let you get the updates from the internet if you want them.
In my case A) and B) are irrelevant because I only really own or deal with laptops now days, and they invariably have built in WiFi, but usually not built-in Ethernet!
Case (A) is common for laptops. I've had plenty of WiFi modules (M.2?) go intermittent connection on friend's Windows laptops over time (maybe component drift?). For Linux on laptops I usually replace the manufacturers WiFi module so I get something better supported (high reliability - used to be Intel). Some people upgrade their module e.g. to get higher spec WiFi.
For (B), configuring WiFi routers is often easier with an Ethernet cable and sometimes necessary (depending on circumstances), and you need a cable to configure many other devices e.g. point-to-point links or whatever.
The fact you have a WiFi laptop is exactly why an adapter is really useful.
Looks like they had a footprint for a diode in a 3-pin SOT23 package and found they didn't have stock of the special part, so they installed a SOD323 diode at a 30 degree angle across two pins...
Oddly enough, point (A) is likely more relevant in the current world of laptops. At least if you use Windows. Plugging in a supported network adapter, may that be WiFi or Ethernet, may be the only way to get through the installation process, without jumping through hurdles, then install drivers for the built-in WiFi adapter, without jumping through another set of hurdles. (I own such a laptop, though I use Linux on said laptop so the WiFi just works.)
I don't disagree that the uses you describe make them helpful in those circumstances, but I can't recall ever needing to do any of that myself. I'm happy with the built-in Wifi adapter and its drivers, and all modern routers can be configured/set up over WiFi, can't they? They create a default network when first turned on, or if you factory-reset them using the physical reset button.
Seems that the origin of the "chinese hack" theory can be just resumed to: younger people not being used to this kind of old stuff.
[1] https://web.archive.org/web/20170705131407/http://www.tscm.c...
I feel like that might have been what took out a neighbor down the street.
Sorry, I got distracted by the newspaper clipping in the article and had to laugh.
VMs exist. I highly doubt the author daily drives windows XP.
> 2) the USB storage provided by network card can still contain malware
Well yes, but so can any other drivers. Downloading from the manufactures website isn't any more secure. Even signed drivers have been caught doing nasty stuff.
> 3) or can be accidentally booted from
True, but again this is quite a convoluted, noticeable, and unreliable way to compromize a system. Just injecting a handful of keystrokes will do it, and once the dead is done, the device can hide all evidence of malicious intent.
> 4) it has universal USB controller, so can become any HID device: keyboard, mouse...
This isn't wtf: a lot of devices nowadays are just microcontrollers hooked up to a USB connector. Quite a few normal USB drives can be reprogrammed to act as keyboards, and be used to get up to all sorts of shenanigans, including ones made outside of China.
I have used many 1000BASE-T dongles and they work exactly as advertised - capable of transferring at ~950Mbps.
I have also used 2.5GBASE-T dongles and speeds are in the 2Gbps+ range.
WisdPi are even offering dongles with 5GBASE-T support (RTL8157 chipset):
https://www.wisdpi.com/products/wisdpi-usb-3-2-5g-ethernet-a...
Unsurprisingly, it shows up as a PCIe device.
I use 2.5 GbE USB adapters and they work great... as long as they're in the right port.
Half of the ports on my Thunderbolt dock are provided by a shaky ASMedia USB chipset and it drops or lags after an hour or so. The other half of the ports use a more solid Fresco Logic chipset and I left an iperf + ping running overnight and it was a solid 2.3 Gbit 0.x ms the whole time. The built-in Apple ports are also solid.
as long as it isn't wireless or bluetooth
I've had good luck with the Realtek 2.5 GbE adapters, no CPU usage issues.
And these days even with a 10 GbE Thunderbolt adapter the CPU use is negligible, so things have improved across the board I think.
2) Any USB storage can contain malware. The driver that this one stores is digitally signed by Microsoft as mentioned in the article.
3) If there was a MBR boot block or EFI file, sure. But there isn't. See 2. And that would still require the user to have Secure Boot disabled and USB as the first boot option.
4) So any device with a universal USB controller is "prove[d] backdoored"?
This wording is misleading because it implies the fake chips were the plague. The fake chips worked fine, and it was FTDI's official driver that intentionally ruined peoples' working hardware when they detected the fakes and changed their PID to 0000 so they would no longer be recognized: http://www.rei-labs.net/changing-ftdi-pid/
The BBC and Reuters can be posited as counterexamples to your assertion. They’re good journalists and well-funded (and not primarily by advertising either).
From what I can tell, they would report accurately once these findings were published but would not find a researcher to dig into the claims before publishing that someone (named) said that these chips are at fault.
It's scary because if even those in the know are not resistant to such BS, who else is going to shield the general public from populism-fueled pushes to anarchy or worse? Detoriation of trust in media is one of the building blocks of that, and if even the experts of subject areas are fooled and/or don't care enough, all hope may be lost.
The silver lining though is that the HN submission got pushback in terms of comments and an eventual flagging.
Ethernet controller being a dma master means it can continually plop packets where it wants without CPU intervention. Infamously Realtek RTL8139 10/100M chip was the first Realtek with DMA mastering support, but it was brain dead implementation https://people.freebsd.org/~wpaul/RealTek/3.0/if_rl.c:
>"The RealTek 8139 PCI NIC redefines the meaning of 'low end.' This is probably the worst PCI ethernet controller ever made, with the possible exception of the FEAST chip made by SMC. The 8139 supports bus-master DMA, but it has a terrible interface that nullifies any performance gains that bus-master DMA usually offers.
For transmission, the chip offers a series of four TX descriptor registers. Each transmit frame must be in a contiguous buffer, aligned on a longword (32-bit) boundary. This means we almost always have to do mbuf copies in order to transmit a frame, except in the unlikely case where a) the packet fits into a single mbuf, and b) the packet is 32-bit aligned within the mbuf's data area. The presence of only four descriptor registers means that we can never have more than four packets queued for transmission at any one time.
Reception is not much better. The driver has to allocate a single large buffer area (up to 64K in size) into which the chip will DMA received frames. Because we don't know where within this region received packets will begin or end, we have no choice but to copy data from the buffer area into mbufs in order to pass the packets up to the higher protocol levels.
It's impossible given this rotten design to really achieve decent performance at 100Mbps, unless you happen to have a 400Mhz PII or some equally overmuscled CPU to drive it."
Afaik 10 years later 1Gbit RTL8111B required alignment on 256 byte boundaries so not much better.
fwiw the last time I had wireless issues was with an exceedingly cheap 2013 laptop built from tablet hardware. That required an out of tree driver for a few years.
For a long while there was an issue with multiple monitors which you want to configure with different settings: you couldn't.
I believe that is also fixed today with Wayland but I mostly stick to a single monitor anyway.
I would actually be really angry to discover a USB Ethernet dongle I bought didn’t have magnetics built in.
I mean I don't trust the Chinese, but neither do I trust the Americans so it's choose your flavour of evil.
Anyway that said, I'm sure it's politically and economically motivated, as for decades China has played catch-up in the global economy and they are rapidly overtaking, with financial interests worldwide. The US is trying to slow them down by trying to keep e.g. chip technology out of their hands, but other than that all they can do is to stop Chinese companies from earning money in the US.
Ironic! I'm convinced most security problems are caused by well-meaning people breaking down hard- and software and explaining how to "hack" things. I mean if that's unintentional than at best it was security by obscurity to begin with which should be exposed so people don't rely on it.
And USB Ethernet, USB CDC-ECM/NCM has existed for a while and have drivers in common OSes. And yet we are plagued by USB Ethernet with custom drivers (some of which are not available for macOS on Apple Silicon).
Of course, PCIe over Thunderbolt is even better.
I have never encountered any problem whatsoever. Only in Windows I have encountered sometimes scaling problems.
The only programs with which I had sometimes problems in Linux with high-DPI monitors have been commercial applications written in Java, some of which were very expensive. However those problems were not Linux-specific, but Java-specific, because those Java programs behaved equally bad on Windows.
For some reason, there seems to exist a high percentage of Java programmers who are incompetent at writing GUIs and the programs written by them neither follow the platform DPI settings nor allow the user to select a suitable display font, making their programs unusable without a magnifying glass when using high-DPI monitors. Moreover, I have encountered several expensive Java applications that crash and die immediately when used with monitors configured for 10-bit color instead of 8-bit color, both on Linux and on Windows.
So in more than a decade of using only high-DPI displays, I have never had problems with native Linux GUI applications, I have seldom encountered problems with native Windows applications and I have very frequently encountered problems with Java applications, regardless of the operating system on which they were run.
All the USB network devices that I have ever used required specific drivers. Sometimes the drivers happened to be already bundled with the Linux kernel or with Windows, but frequently they were not.
Edit: quoted evil-nation since it’s a debatable term usually applied to any country not politically or culturally aligned with some intelligence activity presence.
For example, I use a USB Ethernet dongle to connect my router to a cable modem provided by the ISP.
The ground of the cable modem is at the potential of the shield of the coaxial cable, which comes from far away and the voltage difference between the coaxial cable and the ground of my apartment is big enough to give you a serious shock if you would touch an exposed metal part (normally there are no such exposed metal parts).
So it is essential for the USB Ethernet dongle to provide insulation between the incoming Ethernet cable and the USB port that is connected to the router, which is grounded at the home ground.
With those you just need coaxial cables of appropriate lengths, also with SMA connectors, for making point-to-point connections.
If you want a network where each device can talk with any other devices, you also need a splitter, also with SMA connectors.
Many WiFi M.2 2230 cards have MMCX coaxial connectors on them, which allow the connection of internal antennas attached somewhere on the case of the laptop or mini-PC.
For these, there are MMCX to SMA adapters, which you can use together with SMA cables.
Some M.2 cards have even smaller U.FL coaxial connectors. For these there are U.FL to SMA adapters.
For devices that do not have any standard antenna connectors, one may need to modify them, to solder some RF connectors, which is hard to do without greatly lowering the quality of the WiFi links, due to additional attenuation and reflections.
:-D
Corporations cannot be trusted. Proprietary software is bad enough but proprietary drivers is on a whole new level. You really have no idea what those things are doing unless you reverse engineer them.
Here are example of corporations essentially pwning your computer with their "justified and trustworthy" software:
https://www.vice.com/en/article/fs-labs-flight-simulator-pas...
Shipped a browser stealer to users and exfiltrated on an unencrypted channel the usernames and passwords of users they deemed to be "pirates".
https://old.reddit.com/r/Asmongold/comments/1cibw9r/valorant...
https://www.unknowncheats.me/forum/anti-cheat-bypass/634974-...
Screenshots your computer screen and exfiltrates the picture to their servers.
https://www.theregister.com/2016/09/23/capcom_street_fighter...
https://twitter.com/TheWack0lian/status/779397840762245124
https://fuzzysecurity.com/tutorials/28.html
https://github.com/FuzzySecurity/Capcom-Rootkit
The driver literally provided privilege escalation as a service for any user space executable.
As far as I'm concerned anyone who trusts these corporations with kernel level access to their computers is out of their minds. I don't trust firmware but at least it's contained in some isolated device.
There's multiple GUI Java toolkits and they all equally suck in their own way. Eclipse for example uses SWT which translates to the native application toolkit, which "should" support HiDPI, but as you're limited to native widgets it's not very common.
so if you only have USB ports and care about performance the bigger distinction would be if the USB ethernet device implements CDC-NCM or just CDC-ECM, with the distinction being that CDC-ECM sends the frames to the driver one-by-one and the driver has to acknowledge and process them one-by-one which generates ton of CPU work, while the newer CDC-NCM protocol sends frames in batches...,
on my laptop I can still get full gigabit speeds with a 1Gbit ECM dongle but when I do it uses 100% of one CPU core, while a 1Gbit NCM dongle has negligible CPU usage...
On the other hand, I would have to be careful if I would want to disconnect and reconnect the coaxial TV cable that comes from the ISP, where the threaded coaxial connectors have a metal part. This is how I have learned that the potential difference between the coaxial cable ground and my ground is big enough to cause a shock :-)
That isn't to say Chinese spyware isn't a problem. But, if you don't have the baseline technical competence to detect it, it's bad to go running around yelling "CHINA CHINA CHINA!" That's how our politicians pick up a bogus news story and use it as an excuse to enact stupid policies. It's bad for society.
I laughed. While there certainly are very smart people here, HN crowd is pretty diverse and large parts of crowd are startup/business/framework of the week/ai bros folks. Not someone who would know what spi is from the top of their head.
These days, all countries are doing insane digital spying on other countries. I believe we’re in a modern Cold War. China is a unique threat not because there’s something uniquely evil about them but they own so much manufacturing and have an explicit tight relationship between companies and government. This is the main reason for moving manufacturing to US, nobody really cares about the workers, it’s a security threat.
All that can be true, and still also be true that most of the shit you hear about China is BS and xenophobic. It leads to actual violence and racism. That’s why it’s important to push back against, for the regular people just living their life. I’m never going to defend any country, these are battles the very richest people are fighting it’s not my war, I push back so don’t people don’t act as foot soldiers in their war or become collateral damage for something they have no part of.
Some of them did. I had some that did weird things with the CBUS pins.
That should tell you that there are plenty of different USB Ethernet Adapters that you can find when buying one.
Among those that I have encountered more frequently have been several kinds of Realtek, and of ASIX, and of Aquantia.
Especially among the faster USB Ethernet adapters I doubt that there are many without custom drivers.
Some people may not notice this, if they are using only fat Linux kernels, with all the possible device drivers being enabled and compiled, but if you use a streamlined kernel, e.g. for instant booting, you may need to add a device driver whenever you buy such an Ethernet adapter.
The first is what the original claim was, screaming "Russians!" and "Chinese!" at the same time with poor technical understa ding.
The second is what actually happened. It's no worse than inserting a CD-ROM and installing a driver. As bad as that is, and to be criticised in its own right, it's qualitatively different from the first.
Let's not muddy the waters by conflating the two and make the (IMO legitimate) criticism of one of them wade into a conspiracy theory about the other.
Correct. Not more, not less. Question is what the default assumption is. With enough BS thrown around, the public seems to tend to tilt to "something is fishy" without any (non-debunked) evidence having ever been presented. Doesn't mean it never will be, but until then, a lot of debunked falsehoods shouldn't create more bias than just silence. Sadly, something always sticks.
Also Stuxnet [https://en.m.wikipedia.org/wiki/Stuxnet]
Some years ago, I have been working in designing certain kinds of WiFi devices.
For their testing in a laboratory, a wired setup was used, exactly as described, i.e. with SMA coaxial cables replacing the antennas in the units under test, together with splitters and/or directional couplers to implement multi-point networks, and together with attenuators to simulate a greater distance between the units under test.
The majority of the tests concerning hardware and software were done using the wired setup, which allowed the simultaneous testing of a great number of units in a small space, without interference between their different tests. Only a much smaller number of tests was done with antennas, on the units that had already passed all hardware and software tests, so only the behavior of the antennas remained to be checked.
Such tests in wired setups were done both for the production units, for quality control, and for prototypes, where new versions of hardware and/or software were developed, and it made no sense to waste time with wireless testing until the new hardware and/or software was proven to be completely functional in the wired setup.
In a testing laboratory, there would be a huge amount of coaxial cables and adapters, attenuators, splitters and directional couplers, and of WiFi interfaces, so demonstrating a complex setup would be easy. Otherwise, collecting enough devices and accessories to make an impressive demonstration would be costly when you do not actually have a need for those devices.
In a home where you have an Internet router/gateway that has external WiFi antennas and you have a desktop using one of the many motherboards that include a WiFi interface with connectors for external antennas, you could use an SMA coaxial cable between your desktop and the router/gateway, instead of using an Ethernet cable.
This would be the simplest example of wired WiFi. There are cases when this would be a good idea, e.g. when the router/gateway has only few Ethernet ports for local devices and those are already occupied by other computers. In this case buying an SMA cable may be preferable to buying an additional Ethernet switch and also preferable to a wireless connection, if your home has many neighbors who also use WiFi, creating a congestion that slows down the wireless communication.
With enough problems, enough people get burned that of course this is where it goes.
Bluetooth works better under modern Linux than modern windows. I can go on for literal hours about this. Windows Bluetooth stack is the most broken and disgraceful pile of code I've ever had to work with.
It doesn't tell you that at all. Linux contains tons of drivers for odd devices that you will never encounter in your lifetime.
Note that kernel is totally unconcerned with DPI in general: it only cares about physical pixels and reports physical dimensions to apps — if scaling caused kernel level issues, it might be related to proprietary driver issue (they frequently lag in Nvidia's case).
I never used ultrawides myself, but if the monitor did not report proper "timings" and available resolutions, you might have needed some manual tweaks.
There are no "conspiracy theories" here. It's not a theory, it's really happening. It's not a conspiracy, they don't even think what they're doing is wrong. Corporations see themselves as utterly justified in everything that they do in the name of profit. There are no limits they wouldn't cross. Nothing is sacred to them. Not morals, not you, and certainly not your computer and the personal information stored in it.
Trust them at your peril.
