O.MG Cables and BadUSB: How a Charging Cord Becomes an Attack Tool

A cable left on a desk looks like the most harmless object in the office. Someone borrows it to charge a phone, plugs it into a laptop, and nothing seems to happen. That is the point of an O.MG cable, and it is why IT teams treat unknown USB cables and devices as a security question.

What Is an O.MG Cable?

An O.MG cable is a USB cable with a tiny computer and a Wi-Fi radio hidden inside the connector. It charges and syncs like any other cable. Plugged into a computer, it can also present itself as a keyboard and type commands, controlled from a nearby phone or laptop over Wi-Fi.

It was built by security researcher Mike Grover and is sold through Hak5 as a red team tool. The maker's own site describes it as a way for red teams to emulate attacks "previously only capable with $20,000 cables." Hak5's product page lists what the Elite model adds: a hardware keylogger, geofencing, a self-destruct option, and the ability to copy the USB identifiers of another device.

The name "NSA OMG cable" comes from a different, older story. The NSA ANT catalog, published by Der Spiegel in December 2013, listed COTTONMOUTH-I, an implant hidden in a USB connector. The O.MG cable brought that idea down to a price and size that anyone can buy.

BadUSB, Rubber Ducky and O.MG: One Idea, Three Forms

These three names get used interchangeably, but they describe different things.

• BadUSB is the original research. Karsten Nohl, Sascha Krißler and Jakob Lell of SRLabs showed at Black Hat 2014 that the firmware inside an ordinary USB controller could be rewritten so a flash drive behaves like a keyboard.
• USB Rubber Ducky is a Hak5 device that looks like a flash drive and types prewritten keystrokes the moment it is plugged in.
• O.MG cable puts the same keystroke injection inside a working cable and adds remote control over Wi-Fi, so the attacker can decide when to act.

The shared trick is keystroke injection. None of them need to exploit a bug in the operating system. They rely on something the computer is designed to do.

Why the Attack Works: Computers Trust Keyboards

USB devices announce what they are when they connect. A flash drive says it is storage. A keyboard says it is a human interface device, or HID. Operating systems load a generic driver for keyboards and accept their input straight away, because nobody wants to approve a keyboard before they can type.

That trust is the whole attack. A device that says "I am a keyboard" gets to type, and anything typed runs with the rights of whoever is logged in. It can open a terminal, run a command, or visit a web page faster than a person can react.

Two things limit the damage. First, the device has the same permissions as the user, so a standard account without local admin rights stops a large share of what an injected script can do. Our guide to role-based access control covers how to scope those rights. Second, a locked screen gives the injected keystrokes nothing to act on.

How Much Risk Does a Business Face?

For a typical business, a malicious cable is a targeted attack. It needs physical access or a person willing to plug something in. That still happens.

In January 2022, the FBI warned that the FIN7 group had been mailing USB devices to US businesses in transportation, insurance and defense since August 2021, as reported by The Record. The packages impersonated Amazon or the US Department of Health and Human Services. Once plugged in, the devices registered as keyboards and typed commands that led to backdoors and, in some cases, BlackMatter and REvil ransomware.

The pattern is a delivery method for ordinary malware. The same goes for cables handed out at events, left in meeting rooms, or bought cheaply online. Phones face a related risk at public charging ports, which is why "juice jacking" warnings keep coming back.

Sysadmins disagree on how far to go. In this r/sysadmin thread, a company blocked all new input devices, including staff's own keyboards and mice, and the replies split between "excessive" and "sensible":

One reply names the Rubber Ducky and O.MG cable as the reason input devices count as a risk. Another points out that a determined attacker can copy the vendor and product IDs of an approved keyboard. Both are right, which is why controls work best in layers.

Signs a Cable or USB Device Is Malicious

Looking at the cable won't tell you much. O.MG cables are built to look and feel like standard ones. iFixit has published a guide to spotting differences on one cable model, but that isn't a check you can run across an office.

Better signals come from what the computer and the network see:

• A keyboard appears when nobody plugged one in. A charging cable that shows up as a HID device is a red flag. On Windows, enable Audit PNP Activity so event 6416 ("A new external device was recognized") lands in the Security log.
• A second keyboard next to the real one. Some devices register as both a keyboard and something else. Two keyboards on a laptop with no dock is worth a look.
• A new Wi-Fi network nearby. O.MG cables can create their own access point. Wireless monitoring that flags unknown access points can catch one while it is powered.
• Windows opening by themselves. A command prompt or Run box that flashes open when a device is connected is the classic sign of injected keystrokes.

Security firm Bastille, which studies these devices, notes that endpoint tools can only see a cable once it acts. A cable that sits quietly in a drawer shows nothing until it is plugged in and used.

Controls That Stop Malicious USB Devices

No single control closes this. Stack a few cheap ones and the attack gets much harder.

Restrict device installation. On Windows, Group Policy has a set of Device Installation Restrictions under Computer Configuration > Administrative Templates > System > Device Installation. The strictest setup enables "Prevent installation of devices not described by other policy settings" and then allows known devices with "Allow installation of devices that match any of these device instance IDs." Microsoft's documentation notes that Prevent policies take precedence over Allow policies by default. In Intune, the same settings sit in the settings catalog under Administrative Templates > System > Device Installation. Test on a pilot group first, because a new keyboard, dock or headset will stop working until it is approved.

Know the limit of allowlists. Hardware IDs can be spoofed, and Hak5 advertises exactly that feature. Instance IDs are harder to fake but need more upkeep. The r/sysadmin thread below, started by an admin whose cyber insurer asked them to block unknown HID devices, lands on the same conclusion:

One of the top replies argues that removing local admin rights and blocking removable storage do more than HID blocking alone.

Remove local admin rights. Injected keystrokes run as the user. If the user can't install software or change security settings, neither can the cable.

Lock screens fast. A short idle timeout and a habit of locking the screen when stepping away take away the unattended window a remote-triggered cable needs.

Control the cable supply. Issue cables and chargers from a known source and tell staff not to use found or gifted ones. A USB data blocker helps when charging from a public port, but only buy one from a trusted supplier. O.MG's maker also sells an "UnBlocker" that looks like a data blocker and injects keystrokes.

Close unused ports where it matters. For kiosks, reception PCs and shared machines, disable unused USB ports in the BIOS or UEFI, set a firmware password, and use physical port locks.

Train for it. Add found USB devices and free cables to security awareness training. The rule is simple: if you didn't get it from IT, don't plug it in.

These controls also shrink your attack surface against people inside the building, which is where this topic meets insider threats.

What to Do If You Find a Suspicious Cable or USB Device

The instinct is to plug it in and see what it does. Don't.

1. Leave it unplugged. Put it in a labeled bag and note where and when it was found. Some O.MG models can self-destruct or wipe their payload, so the device may tell you less than you hope.
2. Ask who else has one. Mailed devices and conference giveaways rarely arrive alone. Check whether other staff received the same package.
3. Check whether it was already used. If someone plugged it in, look at device installation events and recent process activity on that machine, and treat it as a possible compromise.
4. Escalate. A device that was used moves into your incident response plan: isolate the machine, reset the user's credentials, and look for persistence.
5. Hand it to someone equipped to analyze it. A security firm or law enforcement can examine the device safely. Mailed devices can also be reported to the FBI's Internet Crime Complaint Center.

For teams that manage many machines, the useful move is to check every endpoint at once. In OpenFrame, you can run a script across a client's devices to list recently connected USB devices and collect the output in one place.

This short explainer from LIFARS walks through how BadUSB attacks work and why they are hard to spot:

A malicious cable is a physical way to deliver the same attacks IT already defends against. Limit what a new keyboard can do, limit what the user can do, and keep a clear rule about where cables come from.