161: mg

Episode Summary

Executive Summary: This episode profiles MG, the creator of the stealthy OMG cable, tracing his path from DIY childhood and game modding to hardware hacking, DEF CON culture, and commercializing a covert USB device used for penetration testing. The conversation explores innovation, miniaturization, dual-use risk, supply-chain challenges, and the ethics of building tools that can both secure and compromise systems.

Main Topics: MG’s DIY upbringing and early curiosity (Priority: 5/5): MG grew up around hands-on engineering, medicine, and homebuilding, which shaped a lifelong belief in learning by making, breaking, and experimenting with tools and systems. From gaming to hacking and hardware experimentation (Priority: 5/5): Exposure to Quake, modding, overclocking, and water cooling led MG from biology toward computers, electronics, and a mindset of exploring how systems work by pushing them past intended limits. DEF CON, counterculture, and hacker-community influence (Priority: 4/5): DEF CON is presented as the social and creative ecosystem that connected MG to peers, mentors, and the broader hacker scene, reinforcing a culture of building clever, provocative tools. Evolution of the OMG cable (Priority: 5/5): MG describes iterating from an exploding USB thumb drive to a tiny malicious USB cable, then adding Wi-Fi, keystroke injection, logging, stealth, geofencing, and self-destruct features. Manufacturing, scaling, and quality-control problems (Priority: 4/5): The transition from hand-built prototypes to outsourced production introduced defects, microscopic cracks, lost boxes, and a need for rigorous QA and supply-chain refinement. Dual-use ethics, legality, and harm reduction (Priority: 5/5): The episode wrestles with how tools designed for red teaming can be misused, and why MG emphasizes customer vetting, restrictive sales policies, and reducing harm beyond minimum legal compliance. Real-world operational use cases and intelligence implications (Priority: 5/5): Stories from red teams and security professionals show the cable being used for long-term persistence, air-gap bypass, evidence-system compromise, and stealthy footholds in controlled environments.

Key Arguments: Hands-on tinkering is one of the best ways to learn how technology really works; MG’s entire trajectory came from experimentation rather than formal textbooks alone. Miniaturization of electronics made offensive hardware more feasible and affordable, turning an NSA-style capability into something a small builder could produce. DEF CON and the hacker community function as an incubator for ideas, techniques, and relationships that can accelerate innovation. A malicious-looking tool can still be used ethically when restricted to authorized red-team and assessment work. The real risk is not just the existence of dual-use tools, but whether they are controlled, disclosed, and used with accountability. Manufacturing at scale requires as much engineering rigor in QA and supply chains as in the original design. Legal compliance alone is insufficient; responsible creators should actively reduce harm through product design, user vetting, and community norms. Once a capability becomes public and commoditized, the monopoly shifts from state actors to the broader world, changing the balance of power.

Data Points: Exploding thumb drive PCB size: 8 x 12 millimeters - MG miniaturized the Mr. Self-Destruct USB payload device to fit inside a thumb drive. Ducky typing speed: 150–200 keystrokes per second - Described as the keystroke injection speed of a USB Rubber Ducky. Later keystroke speed: nearly 1,000 keystrokes per second - MG says newer OMG cable versions increased keystroke injection speed. Prototype failure rate: 50% - Half of early hand-built cables failed during fabrication and testing. Build time per viable cable: 16 hours - Derived from roughly 8 hours per unit with a 50% failure rate. First public sales date: January 1, 2020 - MG shipped the first outsourced batch and began online sales then. Initial manufacturing iteration period: about five months - Time spent teaching the shop to produce the required hardware correctly. Deployment duration in one red-team op: six months - An OMG cable remained in play during a DOD red-team engagement without detection. Evidence-drive imaging window: six days - A 4TB drive was intentionally imaged slowly over USB 2 while the cable stayed attached. Loss from incomplete batch: over half the cables discarded - Microscopic cracks in power-supply components caused major product loss. Cable box loss: around 100 cables - One manufacturer lost a box of cables that may have reached customers. Custom offer refused: $30,000 - MG declined a large cash offer because of ethical and future-risk concerns. Export-control categories: 3 categories - Allowed countries, disallowed countries, and neither-listed countries were described for sales policy.

Pivotal Quotes: "This is exactly the story that I was wanting someone to do this with: stick it in a place, have it be there forever." — MG: Responding to the idea of persistent, stealthy operational use of the cable in a target environment. "Legal is not the same thing as ethical." — MG: Explaining why he goes beyond minimum compliance in how he designs, sells, and supports the product. "Once released, change the power dynamics of the world." — Narration/host framing MG's view: Summarizing MG’s philosophy about technologies like 3D printing, Bitcoin, and malicious hardware.

Implications: The episode shows how accessible hardware can democratize offensive capability, making stealthy intrusions cheaper and more widespread. It also highlights that responsible dual-use development requires stricter ethics, vetting, and product design than law alone demands.