Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

111–120 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#111

Post by ghaff »

mtillman wrote: post #66

It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.

Many people, including many people on this site (and, yes, including myself) wouldn't think twice about plugging into an available port if they need a charge. Maybe I don't plug into an unlabeled port in some random location where it doesn't look like it belongs, but honestly I wouldn't think twice about charging at a designated area at a conference.

(Though, yeah, I'd avoid a lot of "normal" activities if I ever attended BlackHat.)

Re: FBI is warning people against using public phone-charging stations

#112

Post by nso »

pluralistic wrote: post #108

how much data can be transfered using usb cable? real usage per second, per minute, not theoretical can the charging stations resume data transfer if i unplug and replug at random times ? i dunno, when i want to dump gb of data from my phone, it takes hours ... so yeah maybe i should stay at a random charging station for hours to ensure all data transfered :D

Maybe you would stay connected that lone at say, a business lounge waiting for a plane.

Re: FBI is warning people against using public phone-charging stations

#113

Post by hibbelig »

SketchySeaBeast wrote: post #8
manishsharan wrote: post #7

There are USB "condom" cables available which do not have data wire. https://www.zdnet.com/article/protect-your-data-with-a-usb-c... I don't have those; I just charge my portable battery first and then charge my devices from the battery.

But then your phone will have been with every port your battery pack has been with! An alternative is also a power only USB cable, just because I feel like I'm less likely to lose a whole cable than a "condom".

> But then your phone will have been with every port your battery pack has been with!

It's unclear to me what this means. I thought it works like this:

- Connect battery pack to USB port - USB port tries to hack the battery pack, but it's too dumb, so the attempt goes nowhere. The charge flows nicely, though. - Disconnect battery pack from USB port - Connect device to battery pack

Re: FBI is warning people against using public phone-charging stations

#114

Post by SketchySeaBeast »

hibbelig wrote: post #113
SketchySeaBeast wrote: post #8

Earlier quoted context omitted.

But then your phone will have been with every port your battery pack has been with! An alternative is also a power only USB cable, just because I feel like I'm less likely to lose a whole cable than a "condom".

> But then your phone will have been with every port your battery pack has been with! It's unclear to me what this means. I thought it works like this: - Connect battery pack to USB port - USB port tries to hack the battery pack, but it's too dumb, so the attempt goes nowhere. The charge flows nicely, though. - Disconnect battery pack from USB port - Connect device to battery pack

Oh, it was strictly a joke that was stretching the condom/STI metaphor.

Re: FBI is warning people against using public phone-charging stations

#115

Post by tshaddox »

mtillman wrote: post #66

It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.

I probably would have guessed that software vulnerabilities were rare for just plugging your smartphone into a USB port (without some additional user approval on the device). Obviously a port could probably be easily configured to just fry your jack/device but that’s not a big part of my threat model anyway.

Re: FBI is warning people against using public phone-charging stations

#116

Post by tshaddox »

HeavyFeather wrote: post #51
imdoor wrote: post #49

I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?

If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough. If you want data safety, you must skip the data pins. If you want current safety, you must skip public chargers.

If it’s “just a reset” I still wouldn’t be too worried plugging into an otherwise normally placed public charger. It would obviously suck to have my device reset, especially when traveling, but of course a port could also just fry your device anyway.

Re: FBI is warning people against using public phone-charging stations

#117

Post by StrangeATractor »

epups wrote: post #106
HeavyFeather wrote: post #51

Earlier quoted context omitted.

If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough. If you want data safety, you must skip the data pins. If you want current safety, you must skip public chargers.

I don't get it, even after I reset my phone it's still locked, and by default not sharing data via USB. What am I missing?

https://en.wikipedia.org/wiki/BadUSB

Re: FBI is warning people against using public phone-charging stations

#118

Post by enguinq123 »

CharlesW wrote: post #95

I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?

Anecdotally, I have had a previous iphone infected by using a public charging station at SFO a few years ago.
Post reply on HN