Lammy 4 hours ago

> The English-language product brief implies that “SR” stands for “Supereal”; that brand name comes up in the context of counterfeit FTDI FT232RL chips that plagued the industry some time ago.

This wording is misleading because it implies the fake chips were the plague. The fake chips worked fine, and it was FTDI's official driver that intentionally ruined peoples' working hardware when they detected the fakes and changed their PID to 0000 so they would no longer be recognized: http://www.rei-labs.net/changing-ftdi-pid/

klik99 12 hours ago

"If you want to try it, be aware that it requires Intel Pentium 166MHz or above."

Made me laugh. Fun article, also really love the genre of "bored smart person goes too deep on something that the end result is obvious by common sense but proving it requires surprising amount of ingenuity and scrappiness"

  • er4hn 12 hours ago

    Don't forget `I was ready to head over to the Dark Web (amazon.com) and purchase one of the dongles just to dump the contents of the memory chip.`

  • fishstock25 12 hours ago

    Totally agree.

    And a great example that truth is complicated, expensive and uncomfortable. It's much easier to postulate an evil nation-state entity with a bad plan (without evidence) than to dig through the thicket of this article. It's much cheaper as well, certainly in terms of time and knowhow. And it's also much more comfortable to claim you're the victim and have uncovered a conspiracy, rather than realize this was just the result of the patchwork typical of engineering.

    Kudos to the author.

    • DSMan195276 12 hours ago

      I would also add, it's not _unreasonable_ to be wary of something when a tool like a virus scan pops up a warning. The jargon used to explain what the executable is doing is gibberish to any 'normal' user, there's no way for them to know it's listing stuff you'd more or less expect it to be doing.

      Of course, there's a bit of a jump from that to making bold claims about what it's doing, but the initial concern was understandable.

    • klik99 12 hours ago

      Yeah, the insane takes spread faster but it takes more time and resources to look into it than just come to conclusions early.

      The worst thing is this creates an environment where most people are either completely credulous and buy into everything or completely incredulous and think everything is unfounded. It's just exhausting to have a healthy level of skepticism these days, and maybe 1 out of 1000 times (number source: from thin air) something that sounds insane actually has some truth to it.

      • fishstock25 11 hours ago

        Yeah, for a substantial fraction of people, this case will stick to their minds as "oh the chinese .. again" It's both sad and scary. It was even submitted to HN. Flagged by now, but still. Many people won't have read this follow-up, especially since it doesn't come as a 1-sentence TL;DR..

        • dgfitz 9 hours ago

          Hmm, why is it sad and scary?

          • fishstock25 an hour ago

            It's sad because the HN crowd is technically maximally (?) literate and should be one of the last communities to even remotely buy the debunked story.

            It's scary because if even those in the know are not resistant to such BS, who else is going to shield the general public from populism-fueled pushes to anarchy or worse? Detoriation of trust in media is one of the building blocks of that, and if even the experts of subject areas are fooled and/or don't care enough, all hope may be lost.

            The silver lining though is that the HN submission got pushback in terms of comments and an eventual flagging.

          • prerok 2 hours ago

            Not the OP, but I think I get the "sad and scary" part. It seems as though there is some vilification going on and that's happened before with very sad outcome.

      • mschuster91 3 hours ago

        The problem is that good journalism doesn't have funding. Otherwise this shit would never have made it into a newspaper, maybe outside of a really shitty yellow rag.

        • DaiPlusPlus 3 hours ago

          > The problem is that good journalism doesn't have funding.

          The BBC and Reuters can be posited as counterexamples to your assertion. They’re good journalists and well-funded (and not primarily by advertising either).

          • prerok 2 hours ago

            Hmm... but do you think that they would produce such an article, funding the research into it?

            From what I can tell, they would report accurately once these findings were published but would not find a researcher to dig into the claims before publishing that someone (named) said that these chips are at fault.

          • mschuster91 22 minutes ago

            BBC is under constant threat of getting defunded, it's almost a meme at this point, and on top of that is generally under constant attack. Reuters doesn't do much local or regional stuff.

MartijnBraam 11 hours ago

I came across the tweet about this "Evil" dongle and instantly recognized it as the exact same thing I worked on before... It's not evil, it's just annoying.

https://blog.brixit.nl/making-a-usb-ethernet-adapter-work-sr...

In my case I disabled the SPI flash module to have it not appear as a CD drive, the author of this post actually found some documentation about the SPI being optional. Funnily enough this post now also gives you all the tooling to make an actual evil RJ45 dongle by reflashing one :D

  • LeifCarrotson 10 hours ago

    What happened to U3 at the top left in the image of the flash chip?

    Looks like they had a footprint for a diode in a 3-pin SOT23 package and found they didn't have stock of the special part, so they installed a SOD323 diode at a 30 degree angle across two pins...

    • MartijnBraam 9 hours ago

      I'm pretty sure that's exactly what happened

  • stavros 11 hours ago

    Hm, why does shorting CS and S0 make it not work?

    • MartijnBraam 10 hours ago

      Shorting almost any two of the communication lines of the flash chip will corrupt the communication enough that the ethernet controller thinks there's no flash installed at all.

    • nick__m 10 hours ago

      I have no idea about S0 but CS is usually chip select. It should be sufficient to short it to prevent the chip from being selected. However CS is frequently inverted and you would have to pull it up to prevent the chip selection, so maybe S0 is always high and inhibit CS

      • cozzyd 10 hours ago

        SO (MISO) should generally be high impedance if not selected...

        I suspect this causes SO to always output the same value and the Ethernet controller must expect some magic

        • nick__m 10 hours ago

          Thanks you for refreshing my memory, I learn about that in college twenty-something years ago but never used that knowledge!

      • stavros 10 hours ago

        That makes sense, thank you.

bentcorner 11 hours ago

I actually really appreciate USB devices that masquerade as a storage device to provide their own drivers. I suppose in this day and age the "right" thing to do is to upload a bunch of stuff to microsoft servers so that it downloads whatever is needed upon getting plugged in, but I've observed enough stuff needing manually installed drivers to know that this isn't as apparently easy as it may appear to be. (For example, I very often need to download vendor-specific ADB drivers)

Anyways, I think it's clever for peripherals to help you bootstrap, and having the drivers baked into the device makes things a little easier instead of trying to find a canonical download source.

  • Suppafly 11 hours ago

    >I actually really appreciate USB devices that masquerade as a storage device to provide their own drivers.

    I appreciate the ones that don't need their own drivers in the first places. Sure something needs special drivers but things like usb sticks and mice should just work using the default ones and let you get the updates from the internet if you want them.

  • necovek 11 hours ago

    I appreciate them working out-of-the-box on Linux even more. And they mostly do, with Linux being the best PnP (Plug'n'Play — remember that with Windows 95? :) OS today.

    But multiple modes of operation really made it harder for to configure devices like those 4G/LTE USB dongles: they will either present as USB storage, or one type of serial device or a CDC-ACM modem device (or something of the sort), requiring a combination of the tools + vendor-specific AT commands to switch it into the right mode. Ugh, just get me back those simple devices that do the right thing OOB.

    • ChocolateGod 7 hours ago

      > with Linux being the best PnP

      as long as it isn't wireless or bluetooth

      • ruszki an hour ago

        or large high DPI monitor

    • dylan604 11 hours ago

      > (Plug'n'Play — remember that

      I remember it as Plug-n-Pray

      • teaearlgraycold 8 hours ago

        I only know that phrase thanks to the Computer Man song that I’ve seen on YouTube.

  • qwezxcrty 11 hours ago

    In this specific case it makes a bit more sense, as when you need to install a RJ45 dongle is likely when you don't have a network connection.

bisrig 12 hours ago

I'm not sure what the current state of the art is, but for the longest time it was pretty common for USB peripheral ICs to have small flash devices attached to them in order to be able to store VID/PID and other USB config information, so that the device is enumerated correctly when it's plugged in and can be associated with the correct driver etc. And depending on when the device was designed, 512kB might have been the smallest size that was readily available via supply chain. It would not have been strange to use a device like that to store 10s of bytes!

The ISO thing is a little bit weird, but to be honest it's a creative way to try to evade corporate IT security policies restricting mass storage USB devices. I think optical drives use a different device class that probably evades most restrictions, so if you enumerate as a complex device that's a combo optical drive/network adapter, you might be able to install your own driver even on computers where "USB drives" have been locked out!

  • extraduder_ire 11 hours ago

    For a time, windows would more readily run an autorun from a disc than from a usb stick. Even if that disc was in an emulated usb disk drive.

    • stavros 11 hours ago

      That's because there was malware that spread via autorun, which is rather harder to do with read-only media, even if it's emulated.

    • myself248 11 hours ago

      And the "u3" flash drives that did this were a hot commodity for a little while!

      Then came the iODD and the IsoStick...

baq 12 hours ago

RJ45 nazi here: these should be called 8P8C

I’ll show myself out

  • polpo 11 hours ago

    I don't mind calling the connector an RJ45, but calling this thing an "RJ45 dongle" makes my eye twitch. It's an Ethernet dongle - RJ45 can be used for a lot of other things. For example I've seen "RJ45 dongles" that convert USB to RS232 serial for the console ports on a lot of networking equipment.

    • sgerenser 9 hours ago

      At least they didn’t call it a wired WiFi dongle.

      • RyJones 6 hours ago

        I did wired WiFi for CES one year. Made having our iot devices on WiFi on the floor much better than other vendors. It’s a long boring story but it was a fun hack.

        • upvota an hour ago

          I’m actually really interested: I have a piece of stage lighting, that has a 2.4 GHz Wi-Fi controller. I’d love to convert this to wired Wi-Fi. Can you share what is necessary to achieve this hack? Can I “just” run antenna cable between router and controller? Or what kind of radio physics needs to be understood?

  • geerlingguy 11 hours ago

    Heh I think anyone who studies for the Network+ ends up debating every time RJ45 is mentioned whether to make this comment or not haha

  • daneel_w 10 hours ago

    Don't show yourself out. Stay and remind people. It's important, since these two aren't interchangeable in both directions.

  • SAI_Peregrinus 9 hours ago

    Or RJ31X or RJ38X, both of which did use the 8P8C modular connector in its unkeyed configuration.

  • leptons 12 hours ago

    TIL. After maybe 25 years of using this connector, I've never heard it called 8P8C. I knew Ethernet has used other physical layers including coax, which I used to run between Amigas way back in the day. But, today I finally learned about 8P8C.

    • SAI_Peregrinus 11 hours ago

      RJ45 isn't even actually the same connector, at least not in the original FCC naming. That was an 8P8C keyed modular connector. RJ45 connectors had only two of the positions connected to wires (one phone line) an internal resistor between two of the other positions, and a keying bar that stuck out of the plug so they wouldn't even go into the unkeyed 8P8C jacks we use for Ethernet.

      So I'll still call them RJ45 connectors. Because nobody has time to say "8P8C unkeyed modular connector" every time!

      • necovek 11 hours ago

        Weren't phone lines something like RJ11 or RJ12?

        FWIW, TIL about 8P8C.

        • SAI_Peregrinus 9 hours ago

          Yes, and RJ45. It used to be defined by the US FCC[1] in 47 CFR Part 68 Subpart F. Along with others, like RJ31X, RJ38, etc. The "RJxxy" numbers were the Universal Service Order Codes (USOCs), the `y` value described the use (e.g. W for wall-mounted jacks). Pages 143 & 144 of the PDF (403 & 404 of the print version) have the electrical connection diagram and the USOCs, pages 125-129 (385 -389 print) have the mechanical drawings. The unkeyed 8p8c connector we use today is also in there (pdf pgs 103-113), but the RJ45 series used the keyed connector! It's RJ31X & RJ38X that used the unkeyed 8-position series jack & 8-position plug we call RJ45 today (pdf pages 137-138).

          [1] https://web.archive.org/web/20170705131407/http://www.tscm.c...

          • necovek 2 hours ago

            Thanks, it's funny how these things happen with language!

      • Brian_K_White 7 hours ago

        Similarly, it's DE9 not DB9

        • SAI_Peregrinus 6 hours ago

          Yep, and these days ribbon cables are rare, instead we have Flexible Flat Cables or Flexible Printed Circuits. Ribbon cables are the old cables like IDE hard drives used, with insulation displacement connectors, while FFCs and FPCs are much thinner and use integral connection schemes (tinned pads on the cable itself get clamped by some sort of connector on a PCB).

FuriouslyAdrift 12 hours ago

Are there "evil" USB ethernet dongles? Of course there are...(just not this one)

https://hak5.org/products/lan-turtle

  • gruez 12 hours ago

    The article admits this explicitly:

    >Malicious hardware has plenty of precedent: it’s been used by intelligence agencies and private pentesters alike. Heck, a bit over a decade ago, I built an evil plasma globe for work. Still, we weren’t here to debate whether a malicious RJ45-to-USB adapter could be made. The important question was whether in this particular instance — as the poster put it — “the Chinese were at it again”.

sephamorr 3 hours ago

What's so odd about this is that they add the flash ($), but skip the magnetics! It just has series capacitors and I don't think the jack has integrated magnetics since it's small and it wouldn't make sense to have a series cap as well.

YaBa 9 hours ago

Embedded storage was actually very common some decades ago, remember seeing it in a lot of devices, mostly 3G USB Modems, there was even a AT command to enable/disable it.

Seems that the origin of the "chinese hack" theory can be just resumed to: younger people not being used to this kind of old stuff.

JKCalhoun 8 hours ago

"It is already possible for an assassin to send someone an e-mail with an innocent-looking attachment. When the receiver downloads the attachment, the electrical current and molecular structure of the central processing unit is altered, causing it to blast apart like a large hand grenade.”

I feel like that might have been what took out a neighbor down the street.

Sorry, I got distracted by the newspaper clipping in the article and had to laugh.

dlcarrier 11 hours ago

A harmful connection to the Ethernet port would be extremely difficult. A harmful connection to a USB port is extremely easy. Call it what it is: an "Evil" USB dongle that happens to also have an Ethernet socket.

Fokamul 10 hours ago

Brought to you by Epcyber CEO. All their trainings are OSINT on China. Of course this company is full of clickers, using just automated tools.

walrus01 12 hours ago

On the general topic of USB to 1000BASE-T (and now 2.5 GBaseT) dongles, for people who care about performance, it's good to know about the distinction between those that are USB devices and those that are PCI-Express devices.

Basically, what do you get if you hotplug it into a laptop running a current linux kernel and do "sudo lsusb -v" vs "sudo lspci -v"?

The ones that are native PCIE devices offer much better performance, up to 2.5 GBASET line rate, and will communicate with the host over the implementation of thunderbolt over USB.

The ones that are USB only might work okay, but there's a reason they're cheap.

Of course a cheaper laptop also won't have any implementation of thunderbolt on it, so that's something to consider as well.

  • comex 7 hours ago

    Not only 2.5GBaseT. I have a 10GBase-T Thunderbolt dongle (from [1]). Okay, it's a little bigger than a normal dongle, and it has a USB-C female port instead of a builtin cable, and it gets warm. But it's basically a dongle, and I can get 9.4Gbit/s through it with iperf3 on my Mac.

    Unsurprisingly, it shows up as a PCIe device.

    [1] https://www.amazon.com/gp/product/B0DHSWSSBY

  • Tijdreiziger 12 hours ago

    Could you elaborate on why the USB ones are worse?

    Per Wikipedia, USB 3.0 (from 2008) can reach 5 Gbit/s, so (naively?) one would expect them to reach 2.5 GbE line rate easily, right?

    • d_k_f 12 hours ago

      I've only got superficial knowledge in this regard, so please take it with a grain of salt, but: the way I understand it is that PCIE has full direct memory access, so devices connected through it can use zero copy and similar techniques to access and process data much faster, especially with lower latencies than over regular USB. Using USB might/will require copying the data to transfer/read from and to different buffers, between user/kernel space, etc.

    • ComputerGuru 12 hours ago

      USB doesn’t provide any DMA (until USB 4) and requires more host cpu resources to meet the same bandwidth. It also has less consistent performance by virtue of the USB protocol itself.

      • mianos 11 hours ago

        I am confused by this, I worked on a Linux USB driver that used DMA in 2003.

        • ComputerGuru 11 hours ago

          DMA from device to host directly rather than from host USB controller to host memory.

          • mianos 11 hours ago

            When I worked on it, the USB controller was just a pci bus device that once set up, the incoming data, from a USB ADC, streamed the data in blocks directly to memory. Maybe they took all that back out.

            • rasz an hour ago

              They didnt remove anything. Did the USB Controller DMA Master support DMA chaining or command lists?

              Ethernet controller being a dma master means it can continually plop packets where it wants without CPU intervention. Infamously Realtek RTL8139 10/100M chip was the first Realtek with DMA mastering support, but it was brain dead implementation https://people.freebsd.org/~wpaul/RealTek/3.0/if_rl.c:

              >"The RealTek 8139 PCI NIC redefines the meaning of 'low end.' This is probably the worst PCI ethernet controller ever made, with the possible exception of the FEAST chip made by SMC. The 8139 supports bus-master DMA, but it has a terrible interface that nullifies any performance gains that bus-master DMA usually offers.

              For transmission, the chip offers a series of four TX descriptor registers. Each transmit frame must be in a contiguous buffer, aligned on a longword (32-bit) boundary. This means we almost always have to do mbuf copies in order to transmit a frame, except in the unlikely case where a) the packet fits into a single mbuf, and b) the packet is 32-bit aligned within the mbuf's data area. The presence of only four descriptor registers means that we can never have more than four packets queued for transmission at any one time.

              Reception is not much better. The driver has to allocate a single large buffer area (up to 64K in size) into which the chip will DMA received frames. Because we don't know where within this region received packets will begin or end, we have no choice but to copy data from the buffer area into mbufs in order to pass the packets up to the higher protocol levels.

              It's impossible given this rotten design to really achieve decent performance at 100Mbps, unless you happen to have a 400Mhz PII or some equally overmuscled CPU to drive it."

              Afaik 10 years later 1Gbit RTL8111B required alignment on 256 byte boundaries so not much better.

  • kiririn 9 hours ago

    Realtek RTL8156 (USB 2.5G ethernet) is fast and rock solid, even for server use cases. I’d take it over an i225 any day

  • toast0 12 hours ago

    I'm guessing if I accidentally got a pci-e one, it wouldn't work in any of the USB ports I would connect it to (as, to my knowledge, I only have USB ports), or do they generally fall back to working as a USB device?

Reason077 12 hours ago

All USB-to-Ethernet adapters are pretty evil in my experience. Always terrible performance, often slower than WiFi.

  • robocat 11 hours ago

    USB-to-Ethernet adapters are life savers when you need to:

    (A) replace your WiFi adapter - download drivers from internet

    (B) configure a router or other equipment (hard to configure WiFi without WiFi).

    (C) stand up your Linux install on your laptop (easiest way to futz around until you get WiFi adapter working - but check chipset on adapter is compatible which the cheapest usually are)

    You don't usually care about the performance. Just keep a cheap one in your box of shit - I need mine often enough. If you need high performance, then buy a high performance adapter.

    • Reason077 11 hours ago

      Not saying they're not useful for specific purposes. But anyone buying them hoping to improve performance compared to their WiFi, often comes away very disappointed.

      In my case A) and B) are irrelevant because I only really own or deal with laptops now days, and they invariably have built in WiFi, but usually not built-in Ethernet!

      • II2II 10 hours ago

        I have a 2.5 GB/s USB to ethernet adapter. While I cannot say whether the performance matches that of built-in ethernet, transfer rates are fairly close to 2.5 GB/s. That is certainly faster than WiFi.

        Oddly enough, point (A) is likely more relevant in the current world of laptops. At least if you use Windows. Plugging in a supported network adapter, may that be WiFi or Ethernet, may be the only way to get through the installation process, without jumping through hurdles, then install drivers for the built-in WiFi adapter, without jumping through another set of hurdles. (I own such a laptop, though I use Linux on said laptop so the WiFi just works.)

      • robocat 10 hours ago

        Your point makes no sense to me. A cable is often useful when WiFi isn't.

        Case (A) is common for laptops. I've had plenty of WiFi modules (M.2?) go intermittent connection on friend's Windows laptops over time (maybe component drift?). For Linux on laptops I usually replace the manufacturers WiFi module so I get something better supported (high reliability - used to be Intel). Some people upgrade their module e.g. to get higher spec WiFi.

        For (B), configuring WiFi routers is often easier with an Ethernet cable and sometimes necessary (depending on circumstances), and you need a cable to configure many other devices e.g. point-to-point links or whatever.

        The fact you have a WiFi laptop is exactly why an adapter is really useful.

        • Reason077 9 hours ago

          In my case, if I want ethernet it's because I want faster performance (reliably/continuously high bandwidth, and reduced latency and jitter) than my WiFi network can provide. But I've only been able to get that with a thunderbolt-connected ethernet adapter. Every USB one I've tried has been a disappointment.

          I don't disagree that the uses you describe make them helpful in those circumstances, but I can't recall ever needing to do any of that myself. I'm happy with the built-in Wifi adapter and its drivers, and all modern routers can be configured/set up over WiFi, can't they? They create a default network when first turned on, or if you factory-reset them using the physical reset button.

  • daveoc64 7 hours ago

    This is not my experience.

    I have used many 1000BASE-T dongles and they work exactly as advertised - capable of transferring at ~950Mbps.

    I have also used 2.5GBASE-T dongles and speeds are in the 2Gbps+ range.

    WisdPi are even offering dongles with 5GBASE-T support (RTL8157 chipset):

    https://www.wisdpi.com/products/wisdpi-usb-3-2-5g-ethernet-a...

  • batrat 12 hours ago

    Old custom software, old hardware, vendor wants all the $ for an upgrade, we refuse to pay. I took 10 desktop pc's($500 each) replaced servers ($20k each), one usb to ethernet dongle in every pc b/c we needed 2 network ports and we had this laying around, USB3 to GB, slap virtualization with USB passthrough. They work for 5+ years, gigabit speed, 24/7 with no problems.

    People should have more faith in dongles. Not all are bad.

  • kalleboo 7 hours ago

    It will depends on your USB ports.

    I use 2.5 GbE USB adapters and they work great... as long as they're in the right port.

    Half of the ports on my Thunderbolt dock are provided by a shaky ASMedia USB chipset and it drops or lags after an hour or so. The other half of the ports use a more solid Fresco Logic chipset and I left an iperf + ping running overnight and it was a solid 2.3 Gbit 0.x ms the whole time. The built-in Apple ports are also solid.

  • daneel_w 10 hours ago

    In my experience they always held up the 100 Mbit/sec claim for lower-end variants, and an acceptable 350-ish Mbit/sec on USB2-backed GbE devices. I have no experience with GbE USB3 dongles.

  • formerly_proven 12 hours ago

    RTL8156B does line-rate 2.5 Gbit/s no problem, most USB-C docks with network have a RTL8153B in them and that does line rate as well. Even mildly dodgy first-generation stuff like AX88179 generally works.

    I.M.H.O. these USB dongles are actually preferable to the much more expensive Thunderbolt dongles praised below, because a) they work on regular USB ports as well b) they do not require Thunderbolt c) they use less power and d) they don't force a highly ventilated cooling mode on certain host systems. And, fwiw, at least some Thunderbolt docks actually used USB NICs connected to the internal USB controller, which was hooked up over PCIe.

    • radicality 11 hours ago

      I don’t remember the exact issues, but I remember seeing years ago my old Intel MacBook had noticeably higher cpu usage when connected to and using a Pluggable dock which had a Realtek Ethernet chipset. Switching to WiFi reduced cpu usage. AFAIK had something to do with bad and/or lack of hardware processing in the Realtek chipset so it had to do it on the cpu.

      Now I never trust anything with Realtek in it, and if buying anything with an Ethernet port, I try to make sure it’s not Realtek. Is this still valid concern, or is Realtek better now?

      • kalleboo 7 hours ago

        I remember in the Intel days, the Apple Thunderbolt 1 GbE adapter would have high CPU usage when you were transferring at the full 1 Gbps.

        I've had good luck with the Realtek 2.5 GbE adapters, no CPU usage issues.

        And these days even with a 10 GbE Thunderbolt adapter the CPU use is negligible, so things have improved across the board I think.

      • daneel_w 10 hours ago

        I've used tons of Realtek stuff since the early 2000s and have had only one single device misbehave - the infamous RTL8139 Fast Ethernet which had many bad batches unleashed onto the world. I have both bad and good versions of this chip. It burned a lot of people back then, many of whom to this day stubbornly refuse to grow up from their trauma, and keep saying that everything Realtek is bad and can never be trusted.

throeurir 12 hours ago

So many wtf here. If anything this proves it is backdoored network card

1) downloading Windows exe files from Chinese forums

2) the USB storage provided by network card can still contain malware,

3) or can be accidentally booted from

4) it has universal USB controller, so can become any HID device: keyboard, mouse...

  • avidiax 12 hours ago

    It proves it might be possible to backdoor it. Maybe.

    I don't know of any modern systems that will execute anything on a newly inserted drive, nor boot from an external drive in the default configuration.

    So we are missing a couple of things. First, a vulnerability in the OS/system. Second, an implementation of that vulnerability in a device like this.

    Should this design be phased out? Perhaps. There is relatively little difference between not populating the flash memory part of the board and a proper network-only implementation.

  • SpecialistK 7 hours ago

    1) China is a country, and in that country people use Windows and make /stuff/ that runs on Windows. A flash tool, which was only intended to be distributed to OEMs, only being found on obscure forums is in line with what I've experienced with similar NAND or BIOS flashers.

    2) Any USB storage can contain malware. The driver that this one stores is digitally signed by Microsoft as mentioned in the article.

    3) If there was a MBR boot block or EFI file, sure. But there isn't. See 2. And that would still require the user to have Secure Boot disabled and USB as the first boot option.

    4) So any device with a universal USB controller is "prove[d] backdoored"?

  • nothacking_ 7 hours ago

    > 1) downloading Windows exe files from Chinese forums

    VMs exist. I highly doubt the author daily drives windows XP.

    > 2) the USB storage provided by network card can still contain malware

    Well yes, but so can any other drivers. Downloading from the manufactures website isn't any more secure. Even signed drivers have been caught doing nasty stuff.

    > 3) or can be accidentally booted from

    True, but again this is quite a convoluted, noticeable, and unreliable way to compromize a system. Just injecting a handful of keystrokes will do it, and once the dead is done, the device can hide all evidence of malicious intent.

    > 4) it has universal USB controller, so can become any HID device: keyboard, mouse...

    This isn't wtf: a lot of devices nowadays are just microcontrollers hooked up to a USB connector. Quite a few normal USB drives can be reprogrammed to act as keyboards, and be used to get up to all sorts of shenanigans, including ones made outside of China.