Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

211–220 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#211

Post by gregmac »

marcellus23 wrote: post #201
feoren wrote: post #165

Earlier quoted context omitted.

None of these are necessary, except half of #2. All you'd need is a "middleman" device that is subtle enough to avoid notice by the person plugging in, just like how credit card skimmers work. > 1. The station has to be using USB Ports / Charging cables that are data enabled, not just cables that carry power Doesn't matter, because you're (unwittingly) plugging into the attacker's device, not the station's. > 2. The…

> They'll plug in the phone, unlock it, and browse the internet. iOS devices (maybe Android too, idk) ask you if you want to allow new accessories to access your device. That's why they said you need an exploit.

I don't have an iOS device to test, but just found a video [1] showing someone connecting a USB keyboard and immediately using it with no prompts. Same on Android.

Even better, here's [2] a direct example of this attack using an O.MG cable [3].

[1] https://youtu.be/COndab_rQkE?t=76

[2] https://www.youtube.com/watch?v=7YpJQT55_Y8

[3] https://shop.hak5.org/products/omg-cable

Re: FBI is warning people against using public phone-charging stations

#212

Post by stametseater »

permo-w wrote: post #187
ghaff wrote: post #111

Earlier quoted context omitted.

Many people, including many people on this site (and, yes, including myself) wouldn't think twice about plugging into an available port if they need a charge. Maybe I don't plug into an unlabeled port in some random location where it doesn't look like it belongs, but honestly I wouldn't think twice about charging at a designated area at a conference. (Though, yeah, I'd avoid a lot of "normal" activities if I ever att…

>(Though, yeah, I'd avoid a lot of "normal" activities if I ever attended BlackHat.) I wonder whether you‘d take similar precautions on a site named Hacker News

A website would be hard pressed to emulate a keyboard plugged into my computer.

Re: FBI is warning people against using public phone-charging stations

#213

Post by pageandrew »

jFriedensreich wrote: post #207

pro tip: if absolutely necessary at least only charge your power bank on a public charger and then charge the phone on the power bank but not at the same time.

Is it even theoretically possible to have data passthrough a power bank?

I don’t know much about USB, but I’d imagine that only the power delivery pins are connected to anything, right?

Re: FBI is warning people against using public phone-charging stations

#214

Post by thinkmassive »

CharlesW wrote: post #95

I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?

Thousands of O.MG cables are out in the wild… https://shop.hak5.org/products/omg-cable

Re: FBI is warning people against using public phone-charging stations

#215

Post by permo-w »

Nevermark wrote: post #193
permo-w wrote: post #187

Earlier quoted context omitted.

>(Though, yeah, I'd avoid a lot of "normal" activities if I ever attended BlackHat.) I wonder whether you‘d take similar precautions on a site named Hacker News

So far, web standards don’t support online supply of direct (constant) current, alternating (sine wave) current, they can only provide imaginary (square root of stealing your) current. So you can’t trust any site for power. —- Although teleporting power Via quantum entanglement has been demonstrated as possible given a line of communication. So crazily, “power over data” may happen one day. Perhaps, we can all look f…

then you won’t mind if I mine some crypto on your machine?

Re: FBI is warning people against using public phone-charging stations

#216

Post by brewdad »

permo-w wrote: post #191
ghaff wrote: post #189

Earlier quoted context omitted.

Accessing a known non-sketchy website? No.

hacker news is a link aggregator

If you've spent any time on here you know that no one actually clicks the links to read the article. Users need only trust the pages with an orange header.

Re: FBI is warning people against using public phone-charging stations

#217

Post by stametseater »

tshaddox wrote: post #194
retrocryptid wrote: post #173

Earlier quoted context omitted.

I believe the assertion is "just because you don't know ow how to do it doesn't mean it can't be done." It turns out several generations of USB controllers did "undefined" things when presented with "undefined" behavior on the data pins. Sometimes "undefined" was "just doesn't work", sometimes it was "put data in physical memory, bypassing the MMU and it's data protection features." I've never seen it myself, but I w…

> I believe the assertion is "just because you don't know ow how to do it doesn't mean it can't be done." Okay, but tell me how it can be done if you want me to take the threat seriously. You could also say “always store your phone in a sound-isolating container because attackers can hack your phone with ultrasonics.”

> Okay, but tell me how it can be done if you want me to take the threat seriously.

That is not a precautionary attitude. I don't know how a candle left unattended in the middle of my granite counter island could light anything on fire, there aren't any drapes near it, but I'm not going to leave it unattended so I can find out.

Re: FBI is warning people against using public phone-charging stations

#218

Post by yardstick »

standardUser wrote: post #202
feoren wrote: post #165

Earlier quoted context omitted.

None of these are necessary, except half of #2. All you'd need is a "middleman" device that is subtle enough to avoid notice by the person plugging in, just like how credit card skimmers work. > 1. The station has to be using USB Ports / Charging cables that are data enabled, not just cables that carry power Doesn't matter, because you're (unwittingly) plugging into the attacker's device, not the station's. > 2. The…

I'm confused about #1. If I have a power adapted plugged into the wall, and a USB cable from that power adapted to my phone, how exactly could my phone be compromised?

The scenario was talking about a power bank where you plug a USB cable into, not where you plug your own power adapter into. Lots of people, myself included, don’t carry power adapters or even charging cables on them on a day-to-day basis.

Using your own power adapter and own power cable you will be fine.

Unless someone has tampered with either of them while you were distracted momentarily but that’s too high risk/inconvenient for an attacker for you to worry about.

Re: FBI is warning people against using public phone-charging stations

#219

Post by stametseater »

mancerayder wrote: post #119

Anker batteries come in a zillion sizes, are cheap and are safe to plug into public chargers. With how hungry phones are these days, I don't know how people live without portable batteries.

I usually go a week between charging. But then again I use my phone for checking and sending messages, not for gaming or browsing the net or anything like that.

Re: FBI is warning people against using public phone-charging stations

#220

Post by permo-w »

stametseater wrote: post #212
permo-w wrote: post #187

Earlier quoted context omitted.

>(Though, yeah, I'd avoid a lot of "normal" activities if I ever attended BlackHat.) I wonder whether you‘d take similar precautions on a site named Hacker News

A website would be hard pressed to emulate a keyboard plugged into my computer.

very true. nevertheless, I’m curious if you implicitly trust the security of links on HN?

I know I largely do, but perhaps that’s unwise, especially given the site’s stated target audience

Post reply on HN