v0.1.2
Eleven new observation probes
CableProbe now inspects far more of the host's reaction to an unknown cable.
All probes are observation-only and skip cleanly when the kernel interface
isn't present.
| Probe | Observes |
|---|---|
serial |
TTY / USB-serial devices (CDC-ACM, FTDI, cp210x) — covert command channels |
audio / video |
USB audio-class and UVC camera devices — covert capture |
usb_descriptors |
Per-interface USB descriptors from sysfs; catches composite implants and descriptor morphing |
usb_topology |
USB hub / port tree — hidden hubs stacking interfaces behind one connector |
usbc_pd |
USB-C / Power Delivery roles and alt modes — data-role swaps, DisplayPort/Thunderbolt entry |
kernel_modules |
Gadget drivers auto-loading on connect (rndis_host, cdc_ncm, usb_storage, …) |
mounts |
Automounted removable media |
pci |
PCI + Thunderbolt devices — USB4 PCIe-tunnel / DMA surface |
routing |
Default route and DNS resolvers — gateway / resolver hijack |
listeners |
New TCP listening sockets |
- 17 new detection rules, including critical rules for PCIe tunnelling and route/DNS hijack
- Default probe set expanded from 7 to 18 (all still opt-out via config)
- Project home page: https://www.cableprobe.com
- 83 tests (was 57)
Install / upgrade: pipx install "cableprobe==0.1.2" (or pip install --upgrade cableprobe)