Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

101–110 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#101
post #73

“Dear citizens, please be wary of attacks on your devices designed to compromise your privacy and personal information. It would be unfortunate if we had competition in the game.”

It's always been a competing priorities inside the government between groups improving security so that commerce and secrets stay secret and safe and other groups who's priorities are more generalized security that would love to snoop into everyone all the time.

Re: FBI is warning people against using public phone-charging stations

#102

Earlier quoted context omitted.

...leaving a literal paper trail of package location tracking? Mail fraud is considered serious. Why commit an extra crime?

Less serious than tampering with fixtures in a secure area at an American international airport?

Exactly, and you'll be on video.

You can buy stamps from a vending machine with cash.

Re: FBI is warning people against using public phone-charging stations

#103
post #93

When I see this I wonder, is the FBI warning us about something the CIA or NSA are doing?

The FBI investigates industrial cybercrime. They are more likely reporting on what they see in the wild. And it's probably coincidence if the other TLAs are using the techniques.

Re: FBI is warning people against using public phone-charging stations

#104
post #26

This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.

Or just replace them with electrical outlets. Why we are using high-risk systems in public infrastructures when low-tech, low-risk systems exist is beyond me.

You can provide a lot more USB outlets than it's feasible to provide regular AC outlets. If they're USB A outlets you know they're only ever going to draw 7.5W give or take max so you can slap many more of them on a single circuit than you can AC outlets where people could plug in a bunch of 60+W laptops or USB-C PD chargers.

Re: FBI is warning people against using public phone-charging stations

#105

Or at least use a USB condom with voltage protection

I mean, if they fry the device I think that's going to both be an acceptable risk (annoying but not breached), and also likely to be detected rapidly -- "Shit my device is fucked, better tell airport staff"

> likely to be detected rapidly -- "Shit my device is fucked, better tell airport staff"

It's not charging - but maybe it was just a problem with that port on your laptop. Better try the charger in every one of your laptop's USB-C ports, just in case....

Re: FBI is warning people against using public phone-charging stations

#106
post #49

I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?

If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough. If you want data safety, you must skip the data pins. If you want current safety, you must skip public chargers.

I don't get it, even after I reset my phone it's still locked, and by default not sharing data via USB. What am I missing?

Re: FBI is warning people against using public phone-charging stations

#107

It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.

> common knowledge to never use public chargers

Perhaps here on HN. Most people will plug their smartphone into any accepting receptacle. trains, airplanes, NYC SmartLink, or ask the bartender if they can plug it in behind the bar.

I still carry a DIY Altoids charger that takes a 9V battery (pulled down to proper volts for iPhone). In a battery emergency, my phone is simply on life support and I don't have to look for outlets that might also include a zero-day.

Re: FBI is warning people against using public phone-charging stations

#108
how much data can be transfered using usb cable?

real usage per second, per minute, not theoretical

can the charging stations resume data transfer if i unplug and replug at random times ?

i dunno, when i want to dump gb of data from my phone, it takes hours ... so yeah maybe i should stay at a random charging station for hours to ensure all data transfered :D

Re: FBI is warning people against using public phone-charging stations

#109
post #49

I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?

If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough. If you want data safety, you must skip the data pins. If you want current safety, you must skip public chargers.

I would still prefer a “never trust” mode, even if it meant I had to go to an Apple store to do a reset (something I have never needed to do)
Post reply on HN