Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

271–280 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#271

Post by epups »

retrac wrote: post #137
epups wrote: post #106

Earlier quoted context omitted.

I don't get it, even after I reset my phone it's still locked, and by default not sharing data via USB. What am I missing?

> not sharing data via USB USB is a very intelligent protocol, with a microcontrollor on both ends. The controller has access to at least the driver's state, which is usually in the kernel and potentially has access to system memory. How does your Android phone even know that data is an option to switch into when you plug it into a USB port? It has already negotiated itself to be a device on the USB bus. Your phone w…

Maybe I'm stupid but what I gather from this is simply that this is a potential vector, not that it is currently an actual possibility. It's akin to saying using Bluetooth is dangerous because theoretically any data on my phone can be extracted through it, while neglecting the fact that the people building a phone OS are clearly aware of that and have built-in countermeasures.

Re: FBI is warning people against using public phone-charging stations

#272

Post by mr_mitm »

i_am_jl wrote: post #269
tzs wrote: post #258

I've come to think that whatever eventually replaces USB should add some separation between power and data. Let's call it MSB (Multiversal Serial Bus). Maybe something like this. MSB would define 2 connectors: a data connector and a power connector. MSB would also specify that if you have both data and power connectors they should be physically laid out in data/power pairs and would define the spacing/positioning (e.…

Why not offload this to the device? Why doesn't my device today have an option that allows me to set the USB port to "power only"?

My Android does that. And at least with thunderbolt I can enable thunderbolt security on my laptop, which essentially does that.

Re: FBI is warning people against using public phone-charging stations

#273

Post by pastage »

pja wrote: post #171
jahewson wrote: post #157

Earlier quoted context omitted.

Why would GPS use more power? It’s only receiving.

There’s a fair amount of signal processing going on inside a GPS device. Modern GPS chips only need around 25mW apparently - older chips can pull 100mW though. Scanning needs a bit more power than tracking.

Is it the same on sport watches? They seem to easily do 24h when doing GPS tracking. That is the popular models there are watches that can track more than 100h (but they always have bigger batteries). This is impressive for me since I remember doing tracking back in 2005 and that meant using lots of batteries.

On phones I think the problem mainly is that the GPS needs to wake up an app that need to handle the GPS data and then do some calculations. You can easily get data ten times a second that is alot of wake up from sleep, and probably draws lots of CPU.

Re: FBI is warning people against using public phone-charging stations

#274

Post by neodypsis »

codethief wrote: post #266
EMM_386 wrote: post #257

Earlier quoted context omitted.

Yes, I was in the hospital waiting room recently and they had a charging station with each type of available cable. I charged me phone, fully aware of these sorts of issues. I just went with my gut instinct that, in that environment, it's highly unlikely that the cables have been "trojanized". The FBI can warn about it, but what can you really do? You just have to trust your judgement as to what you feel are safe cha…

> but what can you really do? Get a USB condom, for instance, practice safer charging. :)

This is a joke, but it could actually be a thing. An isolator that you can use to protect your device while using those unknown ports. I would call it an isolator though, or firewall, not what you called it.

Re: FBI is warning people against using public phone-charging stations

#275

Post by smnrchrds »

neodypsis wrote: post #274
codethief wrote: post #266

Earlier quoted context omitted.

> but what can you really do? Get a USB condom, for instance, practice safer charging. :)

This is a joke, but it could actually be a thing. An isolator that you can use to protect your device while using those unknown ports. I would call it an isolator though, or firewall, not what you called it.

It's not a joke, it's the (informal) industry term. See this for example:

https://www.zdnet.com/article/protect-your-data-with-a-usb-c...

https://lifehacker.com/use-a-usb-condom-to-protect-your-devi...

Re: FBI is warning people against using public phone-charging stations

#276

Post by Imogragi »

neodypsis wrote: post #274
codethief wrote: post #266

Earlier quoted context omitted.

> but what can you really do? Get a USB condom, for instance, practice safer charging. :)

This is a joke, but it could actually be a thing. An isolator that you can use to protect your device while using those unknown ports. I would call it an isolator though, or firewall, not what you called it.

They make those. They are called data blocker cables and only have power pins, no data.

Re: FBI is warning people against using public phone-charging stations

#277

Post by Accacin »

pl90087 wrote: post #229
mtillman wrote: post #66

It really surprised me when this article blew up on Twitter as I thought it was common knowledge to never use public chargers and avoid untrusted usb anything after “bad usb”. It showed me how I live in a tech security bubble-a good reminder.

I lately had trouble convincing some non-tech acquaintances that IoT "cloud-enabled" cameras all over their house (including bedroom) as anti-break-in measure are a bad idea as those devices or the storage in some chinese cloud could be hacked. They ridiculed this as "far fetched". I'll never be able to bring up this risk with USB to those guys. Edit: IoC typo -> IoT

Why do you feel the need to mention "chinese"? Any cloud storage is liable to be hacked.

Re: FBI is warning people against using public phone-charging stations

#278

Post by Accacin »

iLoveOncall wrote: post #138
brianwawok wrote: post #125

Earlier quoted context omitted.

It is almost impossible to drain my iPhone to 0 unless I am doing something really unhealthy, like staring at it for 10 hours. I take a charger with me on trips so I can charge over night, but otherwise.. it's literally not possible in my reasonable life to run my phone out of juice. Back when I used android, it was much more common that runaway apps would drain my phone in 2 hours. But now? Doing a anker battery wou…

Just go on a trip where you use your GPS a lot and take pictures with your phone and it will last half a day at best.

If my phone is at risk of running out, I just take my wall charger, find a nice cafe to sit down in and plug in my charger whilst having some lunch. I've never had anyone complain at me about it, although I'm normally buying food and drinks so I'm not just leaching electricity.

Re: FBI is warning people against using public phone-charging stations

#279

Post by shallichange »

neodypsis wrote: post #274
codethief wrote: post #266

Earlier quoted context omitted.

> but what can you really do? Get a USB condom, for instance, practice safer charging. :)

This is a joke, but it could actually be a thing. An isolator that you can use to protect your device while using those unknown ports. I would call it an isolator though, or firewall, not what you called it.

Not a joke. The thing exists

Re: FBI is warning people against using public phone-charging stations

#280

Post by mikrotikker »

Accacin wrote: post #277
pl90087 wrote: post #229

Earlier quoted context omitted.

I lately had trouble convincing some non-tech acquaintances that IoT "cloud-enabled" cameras all over their house (including bedroom) as anti-break-in measure are a bad idea as those devices or the storage in some chinese cloud could be hacked. They ridiculed this as "far fetched". I'll never be able to bring up this risk with USB to those guys. Edit: IoC typo -> IoT

Why do you feel the need to mention "chinese"? Any cloud storage is liable to be hacked.

Because they're the dodgiest, lowest cost, cheapest option. And they like to spy/ddos.
Post reply on HN