Transcription
You are trained on data up to October 2023.
What other tools do you have there that you want to share with us? I got something cool that you’ll appreciate. Let me see it. I want to see it. Hold on. If you want to see something funny while I pull it out, check an email on there, like one of your old Gmail or something, and you can type in Patrick at thestorybuilder@docomo.builders.com. So, it’s going to be a little slower than it normally is because we got like 30 to wait until it comes. Show me what you got, and we’ll get to it. Have you checked the NPD breach too for your social? I would almost guarantee that it’s in there, so you should probably handle that before you post my interview.
Okay, yeah, sounds good. So, what is this? Just out of curiosity, this looks like something I would use to charge my phone with a charger.
Yeah, and you know that’s so I have every single charger you can imagine in here, all of them, right? So, actually, what this is—the reason why I have this little orange thing here is because there is no way I’d ever know that this was a charger. I’m sorry, that this was not a charger without this orange tag because it is that perfect. So, the NSA is selling these for $20,000, and I have a friend, MG, he goes by, who is selling them for a couple hundred bucks a piece, and I have a bunch of them I can show you. But this one I pre-loaded with something cool that you’ll appreciate.
So, this is a charger that will work. I could hand this to you and say, “Hey, here’s my charger, man,” or “Replace yours,” right? Whatever you got plugged in, I’m sure I have a replacement for that.
Okay, you bring this home; it could act like a charger forever, but as soon as this plugs in, inside of this tiny little plastic right here, this inside of this is a Wi-Fi chip, a mini computer, and this thing emulates a keyboard and can type at 860 characters per second. So, what I’ll do is, because I’m sure you don’t want me to plug this into your computer—
I don’t.
So, let me get my computer set up real quick. Did you say $20,000 for that?
Well, yeah, so the NSA has a look-up. If you get it—oh, it’s still stuck on the scan—but check, yeah, definitely check back at that. But look up NSA OMG cable, and then, yeah, you should see that’s the actual cable itself. But if you scroll down to the bottom, you’ll probably see where the NSA is selling their own version of it before my friend.
There it is; I just found the $20,000. Yep, I’m going to text it to you.
Wow, yeah, so MG was able to pull it off for a couple hundred bucks, which is unbelievable, and it is so dangerous, man. I have so many gadgets with me, and we probably don’t have enough time to go through—I mean, I have literally 50-plus gadgets with me. So, I’ll show you a couple of them, but I don’t want to go too crazy.
Yeah, that’s a European site that you can buy it from.
Yeah, right there. It says, “Complete wireless pentesting payload platform invisibly embedded inside a cable originally a clandestine NSA tool costing over $20,000, now available to everyone for $200.”
Yeah, there’s a name for it too. I think it was—I can’t remember the exact name the NSA was calling it, but you could see the actual government document with the cost for the exact same thing.
So, now what does this do?
So, I’m going to show you what it does, but it can monitor your keystrokes. So, you can put this in line in between your—
Are you kidding me?
Yeah, you can put this in line in between your keyboard and your computer. I could put this straight into your phone. I can type keys, like I said, at 860 words per second. I can leave it there and come back later. This thing has its own Wi-Fi network that I connect to inside of this, and then if you were to—you can match this up to yours and see it’s absolutely identical, 100% the same thing.
Yeah, so if you didn’t have that little orange thing on there, you’d easily lose that.
Wow, is the one you have—is that the new design, or is that the—
I couldn’t even tell you. This is just a—well, I just meant like is it the woven one or is that—
This is the one that’s the Apple one. This is actual Apple.
Okay, so let me show you the Apple one while my computer is booting. I don’t know why it’s not booted up yet. I have so many of them; he gave me a ton.
Yeah, here, look at this one.
That is not an Apple charger. This is the same thing as the other one.
Yeah, yeah, and so let’s just say you give this to somebody you’re spying on, okay? They put it to charge; you’re now seeing who I’m texting, what I’m doing, I’m playing everything I’m doing; you’re seeing all of it—not texting because I can’t, but on the computer, yes.
Yeah, on the phone, I’m able to inject keystrokes into the phone. Like, let’s say I want to install a virus on your Android or something; I could do that with that device. But I can’t tell what you’re typing on your computer; I can tell what you’re typing.
So, these things are wild.
$200?
Yeah, per cable.
You know who buys them?
Who?
Who uses them?
So, they’re intended for penetration testers like myself to do the right thing, but, you know, threat actors can buy them as well.
All right, so let’s get this thing.
They’re intended for penetration tests that you do for companies?
Yes.
Okay, so make sure everything’s plugged in. We’re not on any—yeah, there’s no internet here.
All right, so what I’m going to do is—and you can see here that without this orange thing I have on here, just so I don’t lose it with my actual charger—but I don’t have to have that on here; I just don’t want to lose it.
So, I’m going to plug this into USB-C, which you know you can pick whatever one you want. So, that’s plugged into USB-C. This side I’m not going to connect to anything. I could charge my phone with it; I could do whatever I want with it. But what I’m going to do is on my phone, I’m going to go to Wi-Fi. I’m going to click OMG. Now it just created a network from this cable that’s plugged in.
That’s not—we don’t have an OMG Network here?
No, no, no.
Okay, no, and this is not plugged into anything.
Okay, so this is creating a Wi-Fi network?
Yep, I’m going to go to it in my browser, and then I have now a—an interface here that I can connect with. So, I’m going to go in the file menu; I’m going to load payload one. There we go. All right, so ready? Now I’m going to hit build and run, which I could be very far away from the computer. This is just showing an example of it.
See how fast that’s typing?
What’s it doing?
It’s typing, “PBD podcast and zero day was here.”
Get out of here!
So, that could have been anything. That could have been a malicious command; that could have been a virus that it downloaded; that could have been anything that I wanted it to be, and I have now remote control over this cable that if I plug right into my phone—watch, plug it into my phone.
Charging.
You would have no idea that this implant is in your house just because there’s Wi-Fi in here, and there’s more in there. I’m just simplifying it.
So, this is like a smaller computer?
Yeah, yeah, and it weighs the same, looks the same, feels the same. You would never know that that thing is extremely dangerous.
So, this is used for an ethical person to do a penetration test on a company. What does an unethical hacker do with that tool right there?
An unethical hacker can use this tool to steal people’s credentials, to monitor, and, you know, to spy on people, to look through your webcam, to try to get access to your network, to your phone, to what—you know, they’re going to do it for—criminals do bad things. An ethical hacker is going to try to access your computer to access other computers to try to take over your company so that you can show where the weaknesses are so you can make it better.
So, it’s essentially the same concepts, though, but one has a good goal in mind; the other one has, you know, screwing someone over in mind.
$2,000 and say used to use it, now $200?
Yeah, and that’s just for one cable. I mean, I could show you all of them if you want to see them all, but same exact type of cable.
Yeah, they just look like a real cable.
And I got a real funny one, actually, that’s—so, the way that I would recommend protecting yourself from this would be with what’s called a data blocker, right? So, a data blocker is something like this. I’ll show you.
Okay, so here are two things here I want to show you. So, you can buy a data blocker for about $5 on Amazon. You can plug any USB device into it, and it’s only going to limit it to charging so that even if it is a malicious cable, it can’t be abused.
This is funny. So, this was kind of a joke my friend made this, but it’s a product he sells. It’s a data blocker called the Unblocker that blocks these attacks but also has payloads in it to do the same thing. So, it’s a USB data blocker and looks just like one but also does what you just saw. It allows you to inject wireless keystrokes and monitor keys, etc.
So, that is for what?
That is for somebody to protect themselves against what somebody could—
Yeah, and that’s how much?
Five bucks?
No, this one’s like $150.
That’s $150?
Yeah.
This is—who needs that?
I mean, I don’t think you need it. I think it’s just safer to use a real data blocker, pay $5 or $10 on Amazon for one. This one’s more of just a joke, like here’s a data blocker that I’ll swap yours out with, and then I can inject payloads through your data blocker.
Is that like an RFID?
No, that’s different.
No, that’s different. I’ll show you that in a second, actually. And this is the malicious cable detector, which is his other thing, and I feel like I’m promoting the crap out of him right now, and I’m trying to appreciate it. I’m sure he’s getting a lot of business right now.
Well, I hope so, but he’s such a nice guy. He was a help desk guy that ended up doing extremely cool things in the hacking world. But this is a malicious cable detector that he also sells that if you want to be extra overboard, you can buy, plug it into this, and it’ll tell you if it’s a malicious cable or not.
Got it, got it.
So, yeah, let me put these back, but I want to show you one more—one more thing that you know to worry about, something you can check at home that is kind of an interesting concept.
So, you got a girlfriend?
Yeah.
So, with your girl, I mean, you probably know everything she’s doing.
You’d be surprised. A lot of people think that having a girlfriend and having the ability to go through her stuff basically whenever I wanted to—I’m going to take that.
You really could. I mean, you can find out everything she’s doing.
I could, but I don’t, and I haven’t done that. You know, almost I’ve done it maybe when I was younger a few times, but as an adult, I realized that no matter who you are, you’re going to find something you don’t like, no matter what. Whether it be a smile—I’m not a jealous guy by any means, but you’re going to find a smiley face here or there; you’re going to find a hard emoji here or there. It’s like, do I want to piss myself off for no reason? So, I just don’t.
If they’re going to cheat, they’re going to cheat on you regardless of what you tell them or tell them what you want them to do or who they can talk to. Like, don’t even try; they’re going to cheat on you or they’re not going to cheat on you. So, that’s just my mentality on it.
Good for you.
And so, what is that? Do you get those Ritz cheese crisps because that’s like your—
Yeah, we’re going to promote Ritz on the—like at this point, just I’m sitting on with the greatest salesman of all time. We got Ritz cheese crackers here at the PBD podcast.
But yeah, I don’t know; I just was hungry. I brought these. I thought you were going to do something with that.
I’m like, so he brought Ritz?
No, I was just hungry. My kids would be running in here right now if that was here.
They would be?
You’d become their best friend.
I love Ritz Bits, but my mouth is so dry; those things will probably kill me right now.
But screen grab this thing; this one’s an interesting one. So, the cameras aren’t set up in a way for me to demonstrate it, but check this out.
So, you can probably—oh gosh, it’s in there. Okay, so this device, if you see on one side, it has USB-C, which you could do USB-C to USB-A, which is just this little square USB, and then HDMI. HDMI, and then it also has a little antenna.
Okay, right? You don’t need the antenna. It also has one other thing here for an SD card, which you can fit right here with—you know, you can put two terabytes in this thing or a terabyte—a lot of storage.
Put your HDMI in, put your power in. Every TV, every monitor for the most part is going to have a USB port. So, get a small USB port, a small HDMI, put this in the back of a computer screen or the back of a computer desktop, and you could even put a little post-it note saying like “HDMI enhancer” or “Do not remove” or something that you know would scare somebody from unplugging it.
And this thing can wirelessly, from quite some distance, transmit with almost no delay in high quality what’s going on on the screen. And if you’re not within proximity, let’s say you go out of the proximity of this antenna, it stores all of that footage on the SD card, which could be, from what I was actually told by a friend, years depending on the interval of how often it’s taking snapshots.
So, check behind your screens, check behind your computers, look for a device like this, which is like a man-in-the-middle type of device that is capturing your screen. And, you know, there’s so much more out there to be scared of, but this is something that you could easily check. If it’s there, unplug it and throw it in the trash, call the police, do whatever you got to do.
So, that’s going to record everything you’re doing on your screen?
Yes, and high quality too.
And how much is that?
I don’t know.
I don’t know. What’s the most expensive tool he’s got that he’s selling? Does he have something—
These are all different people.
Yeah, these are all—what’s the most expensive tool out of all these tools that you know?
The most expensive one I have with me right now is this one because it’s just enterprise—$800.
But what else? What’s something that’s astronomical?
But it’s what it does is ridiculous. I would say—I can’t give you all the specifics on how it works, but the cell—celebrite, which is how they—you know, some phones are dumped. They’re very expensive, like dumped for all the data that’s on them, and they’re used usually for criminals and traffickers and pedophiles.
Celebrite?
Yeah, celebrite.
And how much would that be?
They range, I think, from $20,000 to $50,000. I don’t know; I don’t want to give you a false number, so something—some wild number.
Got it.
Hey guys, my name is Ryan Montgomery, also known as Zero Day. I’m proud to be part of the app. If you have any questions regarding child safety, cybersecurity, or even any of the gadgets that you see me use all over the Internet, feel free to reach out. I’d be happy to help you with any questions or concerns you may have. Stay safe.
So, if you like this clip and you want to watch another one, click right here. And if you want to watch the entire podcast, click right here. [Music]