Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

251–260 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#251

Post by rsync »

TheNewsIsHere wrote: post #195
cuttysnark wrote: post #107

Earlier quoted context omitted.

> common knowledge to never use public chargers Perhaps here on HN. Most people will plug their smartphone into any accepting receptacle. trains, airplanes, NYC SmartLink, or ask the bartender if they can plug it in behind the bar. I still carry a DIY Altoids charger that takes a 9V battery (pulled down to proper volts for iPhone). In a battery emergency, my phone is simply on life support and I don't have to look fo…

I try to always travel with a “USB data condom”. The one I have is called a “PortaPow”, and it’s red. It was about $10 on Amazon and it’s a great investment for scenarios where I _reasonably_ trust a power-only USB port not to have been tampered with, like the built in ports on aircraft.

I have long used usb condoms - even on my own, trusted ports.

Sometimes I just want to charge my phone from my laptop without triggering all kinds of finder and iTunes and photos interactions.

Same with a car - just power, please.

Re: FBI is warning people against using public phone-charging stations

#252

Post by rsync »

enguinq123 wrote: post #118
CharlesW wrote: post #95

I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?

Anecdotally, I have had a previous iphone infected by using a public charging station at SFO a few years ago.

You’re going to need to elaborate here … that’s genuinely interesting if true …

More details?

Re: FBI is warning people against using public phone-charging stations

#253

Post by amelius »

wongarsu wrote: post #174
dataflow wrote: post #162

Earlier quoted context omitted.

I don't know how this is done, but not everything USB connected is assumed to be a charger. For example the 2FA hardware tokens aren't assumed to be chargers by default. So I imagine this might be done by faking a different device.

The malicious charger can pretend to be keyboard, mouse and screen, and just remote control the phone. Or just a keyboard, if you want to an easier implementation. At least Android phones are completely usable this way, with universal keyboard/mouse support and widespread USB-C display support. Without any confirmation steps.

If this is true, then just use a charging cable with only the two power wires in it.

Re: FBI is warning people against using public phone-charging stations

#254

Post by rtkwe »

provenance wrote: post #150
rtkwe wrote: post #149

Has there been any kind of attack actually detected that goes through this vector? This has been infosec lore for as long as USB charging and smart phones have been a thing but I've never really heard of it actually being used.

There is indeed a cheap product that does exactly this: https://o.mg.lol/

I mean as an actual attack not a product that could execute a similar attack. IE an instance where a public charger has been detected or caught attempting to infect phones.

Re: FBI is warning people against using public phone-charging stations

#255

Post by imp0cat »

RcouF1uZ4gsC wrote: post #9

This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.

Couldn't you just plug the wireless charger to the public charging port and then charge your phone wirelessly off of that? An airgapped solution. :)

Re: FBI is warning people against using public phone-charging stations

#257

Post by EMM_386 »

ghaff wrote: post #111
mtillman wrote: post #66

It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.

Many people, including many people on this site (and, yes, including myself) wouldn't think twice about plugging into an available port if they need a charge. Maybe I don't plug into an unlabeled port in some random location where it doesn't look like it belongs, but honestly I wouldn't think twice about charging at a designated area at a conference. (Though, yeah, I'd avoid a lot of "normal" activities if I ever att…

Yes, I was in the hospital waiting room recently and they had a charging station with each type of available cable.

I charged me phone, fully aware of these sorts of issues. I just went with my gut instinct that, in that environment, it's highly unlikely that the cables have been "trojanized".

The FBI can warn about it, but what can you really do? You just have to trust your judgement as to what you feel are safe charging stations, and which may not be.

Re: FBI is warning people against using public phone-charging stations

#258

Post by tzs »

I've come to think that whatever eventually replaces USB should add some separation between power and data. Let's call it MSB (Multiversal Serial Bus). Maybe something like this.

MSB would define 2 connectors: a data connector and a power connector.

MSB would also specify that if you have both data and power connectors they should be physically laid out in data/power pairs and would define the spacing/positioning (e.g., the power connector should be parallel to the data connector 2 mm apart with the power connector above the data connector).

The idea behind the layout specification is that for applications that need both the power and data connectors you could make cables that include both, with the housing at the ends holding the two connectors fixed so they can treated as a unit when it comes to plugging into things.

The power port would include data line, but they are just used for power negotiation.

The data port would include power, but just a fixed voltage and max current, comparable to pre-high power USB, so for low power peripherals you would just need to use a data port. I.e., for low power peripherals it is pretty much just like USB.

Re: FBI is warning people against using public phone-charging stations

#259

Post by marcosdumay »

tonyarkles wrote: post #245
marcosdumay wrote: post #199

Earlier quoted context omitted.

We do know of shady companies that sell "own this phone" USB devices to governments, but AFAIK they only sell to governments and the details aren't available to the public. I have never heard about a non-government sponsored attacker doing that kind of thing. If this is relevant or not to you, it's a matter of your threat model. If I were a journalist, I would be very weary. Personally, I don't plug my phone on rando…

Heh, if I'm remembering right, a couple of years ago there was a public charging station at DEFCON that was sponsored by the NSA. I did not plug my phone into it :D

That one became famous. It said something like "Powered by the NSA. You know you want to do it."

(And no, I've never been to DEFCON. It really became famous.)

Re: FBI is warning people against using public phone-charging stations

#260

Post by kotaKat »

ajsnigrutin wrote: post #158

But how? Most devices are charge-only by default, most users have USB debugging disabled, and those who know how to enable it, won't allow the adb server to connect to the phone (you have to explicitly give it permission).

Lightning does more than just USB depending on how you signal the pins, including factory debug and diagnostics connections.

See also: the Bonobo JTAG/SWD debugging cable over Lightning. https://shop.lambdaconcept.com/home/37-bonobo-debug-cable.ht...

(While this 'technically' requires extra device flags, it's still the fact that Lightning has lots of hidden modes underneath its multiplexer.)

Post reply on HN