Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

121–130 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#121

Post by bbarn »

xeromal wrote: post #61
shiftpgdn wrote: post #20

If you have a zero day takeover via usb/lightning why would you waste it on public charging infrastructure? That seems ridiculous.

It's not really. Supposed a nefarious group wants to get ahold of an executives phone who always flies out of LAX or goes to a certain mall and uses a public charger. It would be smart to zero day one of those and if a few extra people are exploited, maybe some bonus bank info.

This is typical hacker movie nonsense. In real life, if they want something from said executive they just kidnap him, threaten violence, and he gives them what they want instantly. Or just knock him out cold from behind, take his shit, and crack into it themselves.

Re: FBI is warning people against using public phone-charging stations

#122

Post by alpaca128 »

mtillman wrote: post #66

It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.

To be fair I also didn't know for a long time that HDMI is not a trustworthy port and can be used to spread malware [0]. And I'm usually not thinking about that when plugging my laptop to a projector.

Maybe with USB you could get away by using a cable without data pins, but I'm not sure whether that may influence charging speed given USB-C is pretty flexible.

[0] https://news.ycombinator.com/item?id=31828193

Re: FBI is warning people against using public phone-charging stations

#123

Post by ghostpepper »

enguinq123 wrote: post #118
CharlesW wrote: post #95

I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?

Anecdotally, I have had a previous iphone infected by using a public charging station at SFO a few years ago.

Can you elaborate on this? What kind of phone? Android or iOS? Fully patched? What kind of infection? How did you discover it? How did you get rid of it?

Re: FBI is warning people against using public phone-charging stations

#124

Post by slig »

bbarn wrote: post #121
xeromal wrote: post #61

Earlier quoted context omitted.

It's not really. Supposed a nefarious group wants to get ahold of an executives phone who always flies out of LAX or goes to a certain mall and uses a public charger. It would be smart to zero day one of those and if a few extra people are exploited, maybe some bonus bank info.

This is typical hacker movie nonsense. In real life, if they want something from said executive they just kidnap him, threaten violence, and he gives them what they want instantly. Or just knock him out cold from behind, take his shit, and crack into it themselves.

After Stuxnet, I wouldn't discard that possibility.

Re: FBI is warning people against using public phone-charging stations

#125

Post by brianwawok »

mancerayder wrote: post #119

Anker batteries come in a zillion sizes, are cheap and are safe to plug into public chargers. With how hungry phones are these days, I don't know how people live without portable batteries.

It is almost impossible to drain my iPhone to 0 unless I am doing something really unhealthy, like staring at it for 10 hours. I take a charger with me on trips so I can charge over night, but otherwise.. it's literally not possible in my reasonable life to run my phone out of juice.

Back when I used android, it was much more common that runaway apps would drain my phone in 2 hours. But now? Doing a anker battery would be lugging around a bunch of dead weight.

Re: FBI is warning people against using public phone-charging stations

#126

Post by onemoresoop »

yonaguska wrote: post #71
slicktux wrote: post #53

I usually drill out the data pins on a USB I plan on using for public charging stations…

I just carry a portable battery when travelling. Seems like way less work with the added convenience of being able to charge on the move.

And as a bonus you can charge the battery at a public station.

Re: FBI is warning people against using public phone-charging stations

#127

Post by djmips »

trinsic2 wrote: post #31

To block usb power connectors from owning your phone: Databloc USB Data Blocker Adapter https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-...

Do you trust that the one coming in the mail isn't going to hack your phone! haha.

Re: FBI is warning people against using public phone-charging stations

#129

Post by rhplus »

imdoor wrote: post #49

I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?

You phone can only figure out if it’s connected to a known device (your car, your speaker, etc) by asking the data pins. A charge-only mode would “break” usability of the USB port for most users.
Post reply on HN