And a great example that truth is complicated, expensive and uncomfortable. It's much easier to postulate an evil nation-state entity with a bad plan (without evidence) than to dig through the thicket of this article. It's much cheaper as well, certainly in terms of time and knowhow. And it's also much more comfortable to claim you're the victim and have uncovered a conspiracy, rather than realize this was just the result of the patchwork typical of engineering.

Kudos to the author.

Looks like they had a footprint for a diode in a 3-pin SOT23 package and found they didn't have stock of the special part, so they installed a SOD323 diode at a 30 degree angle across two pins...

I appreciate the ones that don't need their own drivers in the first places. Sure something needs special drivers but things like usb sticks and mice should just work using the default ones and let you get the updates from the internet if you want them.

But multiple modes of operation really made it harder for to configure devices like those 4G/LTE USB dongles: they will either present as USB storage, or one type of serial device or a CDC-ACM modem device (or something of the sort), requiring a combination of the tools + vendor-specific AT commands to switch it into the right mode. Ugh, just get me back those simple devices that do the right thing OOB.

>Malicious hardware has plenty of precedent: it’s been used by intelligence agencies and private pentesters alike. Heck, a bit over a decade ago, I built an evil plasma globe for work. Still, we weren’t here to debate whether a malicious RJ45-to-USB adapter could be made. The important question was whether in this particular instance — as the poster put it — “the Chinese were at it again”.

https://imgur.com/Gpgj7w7

Per Wikipedia, USB 3.0 (from 2008) can reach 5 Gbit/s, so (naively?) one would expect them to reach 2.5 GbE line rate easily, right?

(A) replace your WiFi adapter - download drivers from internet

(B) configure a router or other equipment (hard to configure WiFi without WiFi).

(C) stand up your Linux install on your laptop (easiest way to futz around until you get WiFi adapter working - but check chipset on adapter is compatible which the cheapest usually are)

You don't usually care about the performance. Just keep a cheap one in your box of shit - I need mine often enough. If you need high performance, then buy a high performance adapter.

People should have more faith in dongles. Not all are bad.

I.M.H.O. these USB dongles are actually preferable to the much more expensive Thunderbolt dongles praised below, because a) they work on regular USB ports as well b) they do not require Thunderbolt c) they use less power and d) they don't force a highly ventilated cooling mode on certain host systems. And, fwiw, at least some Thunderbolt docks actually used USB NICs connected to the internal USB controller, which was hooked up over PCIe.

That seems unlikely given that "malware" is signed by Microsoft Windows Hardware Compatibility Publisher.

https://news.ycombinator.com/item?id=42680282

I don't know of any modern systems that will execute anything on a newly inserted drive, nor boot from an external drive in the default configuration.

So we are missing a couple of things. First, a vulnerability in the OS/system. Second, an implementation of that vulnerability in a device like this.

Should this design be phased out? Perhaps. There is relatively little difference between not populating the flash memory part of the board and a proper network-only implementation.