AUGUST 12, 2022
Today we are announcing a 3rd tier to the O.MG lineup: the O.MG Elite tier. It introduces some new features with advanced users in mind.
We were planning on releasing it in 2023, but it sucks to buy hardware only to have a new version released a week later. So instead, you can buy next year’s hardware today! If you’d like to help us test those features while we finish development, we would love it. You can also use the latest stable firmware that doesn’t have the new features yet.
The new O.MG Elite cables are priced at $20 over the previous tier. If you didn't get them at DEFCON, you can now find them on our new O.MG Cable page via Hak5.
The hardware is final, and we have small batches of it available. The new features are in development and we are hoping to finish them in 2023. Our beta firmware branch is where we will be releasing the new features. See below for the current status of each feature. These cables are also able to fully utilize the latest stable firmware, which has all functionality except the new features.
We have fought and won against the chip shortage… for now. A small batch of final hardware is now available. We initially made these for sale at DEFCON, but you can now purchase them from Hak5's Online Store. If stock is already gone, you will be able to automatically place a backorder (check the message in your cart during checkout!). We will have a few small batches delivering over the coming weeks to fill these backorders on a first come first serve basis.
Covert Air Gap Exfil + Air Gap Host Comms
Description: A “low and slow” method of covert comms meant to provide alternate pentesting pathways beyond using the target host’s network interfaces or mass storage (both of which have many detection opportunities already proven out).
We are working on a covert method of communicating between the target host and the O.MG Cable. This method will allow data exfil back to the O.MG’s flash storage. Additionally, this will allow the O.MG Cable to act as a proxy between the target host and another device talking to the O.MG Device’s wifi interface. This will allow for exfil directly out the O.MG’s wifi, and even a bi-directional comms channel. This is heavily inspired by some of the work Rogan Dawes has done in this space. In fact, Rogan Dawes is actively helping us with the design and testing!
Initial proof of concept has been demonstrated with a 300-400Bps sustained comms tunnel between target host > usb > O.MG > wifi > connected device. A full shell on the target host has been demonstrated by using this comms tunnel. Target hosts running both Windows and MacOS have been verified. There are remaining optimizations and bug fixes to be done on the O.MG tunnel mechanism. The toolchain required for communicating across this tunnel needs more expansion and cleanup. This toolchain will serve as an example for how you can implement your own comms over this tunnel.
An initial test version of the tunneling toolchain is now available for beta testers using our v2.6 beta firmware. Initial release allows for non-interactive shell execution and relaying the output to the server.
Description: Control your O.MG Devices from anywhere. Control a fleet of them if you need!
The latest Web UI on O.MG Devices have proven to be extremely powerful while also being very easy to use. But it requires that you connect your controlling device to the O.MG Device’s webserver. (either over an Access Point created by the O.MG Device, or on an existing wifi network where the O.MG Device is connected to). With C2, the O.MG Device can be configured to connect out to a C2 server. Your controlling device will then communicate directly with the C2 server, allowing you to control your O.MG Device from anywhere.
Status: An initial proof of concept has been created for development. We will continue work on this after finishing our current dev cycle on the covert exfil feature. Once complete, we will have this integrated into Hak5 Cloud C² as well.
Extended Payload Storage
Description: Custom file system partitioning allowing hundreds of payload slots, and variable payload slot sizes. There is about 15x more available internal storage, so we are working on a custom filesystem that allows you to choose how to divide that up between payloads and loot. Even the Plus models will receive this update!
Status: An initial test has been released in our v2.6 beta firmware that allows 30 payload slots to be provisioned.
When will the Elite features be finished?
We have a very loose goal for the end of this year. When doing low level development of this nature that pushes the limits of the hardware, there can be surprises that add a couple months that you didn’t plan for.
What does Early Access mean?
Scroll up to the “early access” section ;)
What about existing cables?
We will continue to sell and provide updates to the original O.MG Cable and the O.MG Keylogger Cable. They are being renamed to O.MG Basic and O.MG Plus, respectively.
I have one, how do I help test?
Just install the latest beta from the webflasher. Join the #beta-firmware-testing channel on discord to keep updated on firmware status.