141–150 of 328 posts
USB-C uses data to negotiate charging. A dumb USB type-A cable with no data wires would be safe against bad data.
I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?
1. The station has to be using USB Ports / Charging cables that are data enabled, not just cables that carry power
2. The hacker would need some way of injecting the malware into the charging station ports without being seen, I doubt many charging stations are internet connected so you would have to be at the device.
3. You need to have an active exploit for iOS or Android (or both) that will compromise the device and steal it's data.
It just seems like alot of work for something that in all likelyhood would not work.
Earlier quoted context omitted.
It is almost impossible to drain my iPhone to 0 unless I am doing something really unhealthy, like staring at it for 10 hours. I take a charger with me on trips so I can charge over night, but otherwise.. it's literally not possible in my reasonable life to run my phone out of juice. Back when I used android, it was much more common that runaway apps would drain my phone in 2 hours. But now? Doing a anker battery wou…
Just go on a trip where you use your GPS a lot and take pictures with your phone and it will last half a day at best.
I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?
You phone can only figure out if it’s connected to a known device (your car, your speaker, etc) by asking the data pins. A charge-only mode would “break” usability of the USB port for most users.
Earlier quoted context omitted.
You could ship the victim malicious USB cables in the mail with amazon branding on the box. Many people would use them, assuming they were just mis-shipped or ordered by their spouse.
This would totally work on me. My wife is always buying USB cables from amazon, IDK what we do with them all.
Earlier quoted context omitted.
> sites are protected not only wity TLS but also HSTS and the list goes on. HSTS is just what says for the browser not even try HTTP connection, but directly HTTPS.
and also to report an error if there's a redirect back to HTTP, right? ie when a MITM is attempting to drop you back to insecure.
if HSTS is implemented properly, it won't just report an error, but it will also forbid any connection.
For example, on Firefox, you can't bypass an HSTS error. The browser won't let you add an exception to connect to the site. (you have to purge your data to connect again 'for the first time' on the site)
Earlier quoted context omitted.
It's not really. Supposed a nefarious group wants to get ahold of an executives phone who always flies out of LAX or goes to a certain mall and uses a public charger. It would be smart to zero day one of those and if a few extra people are exploited, maybe some bonus bank info.
This is typical hacker movie nonsense. In real life, if they want something from said executive they just kidnap him, threaten violence, and he gives them what they want instantly. Or just knock him out cold from behind, take his shit, and crack into it themselves.
If you're just passively collecting data and hoping to land 'a' executive or someone else in business with access to power and/or money, or can be used to pivot to someone else, I think it'd be an effective tool.
Anker batteries come in a zillion sizes, are cheap and are safe to plug into public chargers. With how hungry phones are these days, I don't know how people live without portable batteries.
Has there been any kind of attack actually detected that goes through this vector? This has been infosec lore for as long as USB charging and smart phones have been a thing but I've never really heard of it actually being used.