FBI is warning people against using public phone-charging stations

Post by OJFord » Wed, Apr 12, 2023, 6:34 PM UTC

marcellus23 wrote: post #201

feoren wrote: post #165

Earlier quoted context omitted.

None of these are necessary, except half of #2. All you'd need is a "middleman" device that is subtle enough to avoid notice by the person plugging in, just like how credit card skimmers work. > 1. The station has to be using USB Ports / Charging cables that are data enabled, not just cables that carry power Doesn't matter, because you're (unwittingly) plugging into the attacker's device, not the station's. > 2. The…

> They'll plug in the phone, unlock it, and browse the internet. iOS devices (maybe Android too, idk) ask you if you want to allow new accessories to access your device. That's why they said you need an exploit.

Post by beefield » Wed, Apr 12, 2023, 6:38 PM UTC

TheNewsIsHere wrote: post #195

cuttysnark wrote: post #107

Earlier quoted context omitted.

> common knowledge to never use public chargers Perhaps here on HN. Most people will plug their smartphone into any accepting receptacle. trains, airplanes, NYC SmartLink, or ask the bartender if they can plug it in behind the bar. I still carry a DIY Altoids charger that takes a 9V battery (pulled down to proper volts for iPhone). In a battery emergency, my phone is simply on life support and I don't have to look fo…

I try to always travel with a “USB data condom”. The one I have is called a “PortaPow”, and it’s red. It was about $10 on Amazon and it’s a great investment for scenarios where I _reasonably_ trust a power-only USB port not to have been tampered with, like the built in ports on aircraft.

Post by genezeta » Wed, Apr 12, 2023, 6:42 PM UTC

IggleSniggle wrote: post #232

pl90087 wrote: post #229

Earlier quoted context omitted.

I lately had trouble convincing some non-tech acquaintances that IoT "cloud-enabled" cameras all over their house (including bedroom) as anti-break-in measure are a bad idea as those devices or the storage in some chinese cloud could be hacked. They ridiculed this as "far fetched". I'll never be able to bring up this risk with USB to those guys. Edit: IoC typo -> IoT

I know IoC as “Indicators of Compromise.” While that’s kinda true here, that’s not how you used it. What is IoC short for in your parlance?

Post by dpc050505 » Wed, Apr 12, 2023, 6:49 PM UTC

thomastjeffery wrote: post #76

londons_explore wrote: post #64

Earlier quoted context omitted.

You could ship the victim malicious USB cables in the mail with amazon branding on the box. Many people would use them, assuming they were just mis-shipped or ordered by their spouse.

...leaving a literal paper trail of package location tracking? Mail fraud is considered serious. Why commit an extra crime?

Post by meling » Wed, Apr 12, 2023, 6:56 PM UTC

_fat_santa wrote: post #142

CharlesW wrote: post #95

I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?

It just doesn't seem like a plausible hack when you take in all the circumstances that have to line up correctly: 1. The station has to be using USB Ports / Charging cables that are data enabled, not just cables that carry power 2. The hacker would need some way of injecting the malware into the charging station ports without being seen, I doubt many charging stations are internet connected so you would have to be at…