Also remember to check your Halloween candy for razor blades.
FBI is warning people against using public phone-charging stations
131–140 of 328 posts
Re: FBI is warning people against using public phone-charging stations
#132Earlier quoted context omitted.
This is typical hacker movie nonsense. In real life, if they want something from said executive they just kidnap him, threaten violence, and he gives them what they want instantly. Or just knock him out cold from behind, take his shit, and crack into it themselves.
After Stuxnet, I wouldn't discard that possibility.
Exactly what I was thinking of when I wrote this. They left USBs on the ground hoping the right person would pick it up.
Re: FBI is warning people against using public phone-charging stations
#133I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?
I think I recall such a thing happening at DEFCON. It was either that or USB sticks being handed out.
Re: FBI is warning people against using public phone-charging stations
#134There are small adapters which disconnect the data lines. I use one of those to connect my phone to my car so that it only charges but avoids my car to want to add it as an external storage for the entertainment system.
That isn't sufficient to protect you on a charger you don't control: https://www.usenix.org/conference/usenixsecurity21/presentat...
Re: FBI is warning people against using public phone-charging stations
#135This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.
Firstly, I believe the QI scheme includes a process for communication, mostly restricted to "how much power should I send" for now, but it's obvious this will be expanded to more functionality as people basically replicate NFC over it. Second, I'm still waiting to see a QI charger than just pumps 100W of power straight through any piece of metal above it. Don't know what would happen, but I naively imagine forced ind…
Hard disagree. If physical proximity was all it took to compromise a phone everyone would immediately protest.
USB requires an active action. Blaming the user is still wrong, it really should be safe to charge in a mall or get a file from your friends usb stick. But it's less obvious so here we are.
Re: FBI is warning people against using public phone-charging stations
#136USB-C uses data to negotiate charging. A dumb USB type-A cable with no data wires would be safe against bad data.
Re: FBI is warning people against using public phone-charging stations
#137Earlier quoted context omitted.
If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough. If you want data safety, you must skip the data pins. If you want current safety, you must skip public chargers.
I don't get it, even after I reset my phone it's still locked, and by default not sharing data via USB. What am I missing?
> not sharing data via USB
USB is a very intelligent protocol, with a microcontrollor on both ends. The controller has access to at least the driver's state, which is usually in the kernel and potentially has access to system memory.
How does your Android phone even know that data is an option to switch into when you plug it into a USB port? It has already negotiated itself to be a device on the USB bus. Your phone will probably show up in lsusb on Linux even in charging mode. (Mine does.) When you switch the phone to data mode, it changes its USB device profile, and becomes a more sophisticated attached device, from the host's perspective.
Many (most?) phones made in recent years can be USB hosts, too. This lets you connect a USB mouse and keyboard to a tablet, for example. That would open you up to all kinds of pretty simple but often quite effective attacks, like simulating a virtual keyboard and mouse and just manipulating the UI that way.
I don't know if any of these particular attacks are possible with Android right now, but many variations on these themes have been shown over the years on many platforms. USB wasn't really designed with adversarial peripherals in mind.
Re: FBI is warning people against using public phone-charging stations
#138Anker batteries come in a zillion sizes, are cheap and are safe to plug into public chargers. With how hungry phones are these days, I don't know how people live without portable batteries.
It is almost impossible to drain my iPhone to 0 unless I am doing something really unhealthy, like staring at it for 10 hours. I take a charger with me on trips so I can charge over night, but otherwise.. it's literally not possible in my reasonable life to run my phone out of juice. Back when I used android, it was much more common that runaway apps would drain my phone in 2 hours. But now? Doing a anker battery wou…
Just go on a trip where you use your GPS a lot and take pictures with your phone and it will last half a day at best.
Re: FBI is warning people against using public phone-charging stations
#139I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?
You phone can only figure out if it’s connected to a known device (your car, your speaker, etc) by asking the data pins. A charge-only mode would “break” usability of the USB port for most users.
My phone asks me if I am connected to a trusted device and want to share data, asking me rather than asking the device if it is trusted seems to be an effective model.
Re: FBI is warning people against using public phone-charging stations
#140It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.
To be fair I also didn't know for a long time that HDMI is not a trustworthy port and can be used to spread malware [0]. And I'm usually not thinking about that when plugging my laptop to a projector. Maybe with USB you could get away by using a cable without data pins, but I'm not sure whether that may influence charging speed given USB-C is pretty flexible. [0] https://news.ycombinator.com/item?id=31828193
USB defaults to 5v if there is no negotiation, and it is said that many devices will draw 1a under these circumstances (even though technically the spec says they should expect less) -- it's the standard low speed charging that you'd get plugging your device into a dollar store charger.