Investigating an “evil” RJ45 dongle

I came across the tweet about this "Evil" dongle and instantly recognized it as the exact same thing I worked on before... It's not evil, it's just annoying.

https://blog.brixit.nl/making-a-usb-ethernet-adapter-work-sr...

In my case I disabled the SPI flash module to have it not appear as a CD drive, the author of this post actually found some documentation about the SPI being optional. Funnily enough this post now also gives you all the tooling to make an actual evil RJ45 dongle by reflashing one :D

Hm, why does shorting CS and S0 make it not work?

I have no idea about S0 but CS is usually chip select. It should be sufficient to short it to prevent the chip from being selected. However CS is frequently inverted and you would have to pull it up to prevent the chip selection, so maybe S0 is always high and inhibit CS

That makes sense, thank you.

SO (MISO) should generally be high impedance if not selected...

I suspect this causes SO to always output the same value and the Ethernet controller must expect some magic

Shorting almost any two of the communication lines of the flash chip will corrupt the communication enough that the ethernet controller thinks there's no flash installed at all.

Thanks you for refreshing my memory, I learn about that in college twenty-something years ago but never used that knowledge!

What happened to U3 at the top left in the image of the flash chip?

Looks like they had a footprint for a diode in a 3-pin SOT23 package and found they didn't have stock of the special part, so they installed a SOD323 diode at a 30 degree angle across two pins...

I'm pretty sure that's exactly what happened

> Funnily enough this post now also gives you all the tooling to make an actual evil RJ45 dongle by reflashing one :D

Ironic! I'm convinced most security problems are caused by well-meaning people breaking down hard- and software and explaining how to "hack" things. I mean if that's unintentional than at best it was security by obscurity to begin with which should be exposed so people don't rely on it.

“I'm convinced most security problems are caused by well-meaning people breaking down hard- and software and explaining how to "hack" things.”

Huh?

If you think some curious spare-time white-hat hackers are the main cause of most security problems, you grossly underestimate the size and skillset of the black-hat hacking industry, and the unlimited profit-potential available in that field...

You can just buy a malicious USB cable, complete with a suite of payloads - from a US company, no less.

https://hak5.org/products/omg-cable

And here I thought the main cause of most security problems was stressed developers on rushed projects where noone cares about security.

Is it possible to add an autorun.inf to the fake cd?

I hope someday some youtuber drops omg cable at my office for content. Preferably several.

Or it was meant to be toggleable.