Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

281–290 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#281

Post by TheNewsIsHere »

fortuna86 wrote: post #265
TheNewsIsHere wrote: post #195

Earlier quoted context omitted.

I try to always travel with a “USB data condom”. The one I have is called a “PortaPow”, and it’s red. It was about $10 on Amazon and it’s a great investment for scenarios where I _reasonably_ trust a power-only USB port not to have been tampered with, like the built in ports on aircraft.

Can you be reasonably certain they work?

The one I have is designed to allow you to visually inspect the connector terminals. So at least regarding my (USB-A) ones, I can confirm only the power lanes exist.

Re: FBI is warning people against using public phone-charging stations

#283

Post by neodypsis »

smnrchrds wrote: post #275
neodypsis wrote: post #274

Earlier quoted context omitted.

This is a joke, but it could actually be a thing. An isolator that you can use to protect your device while using those unknown ports. I would call it an isolator though, or firewall, not what you called it.

It's not a joke, it's the (informal) industry term. See this for example: https://www.zdnet.com/article/protect-your-data-with-a-usb-c... https://lifehacker.com/use-a-usb-condom-to-protect-your-devi...

Cool, didn't know they exist.

Re: FBI is warning people against using public phone-charging stations

#284

Post by jstarfish »

lanstin wrote: post #200
wongarsu wrote: post #179

Earlier quoted context omitted.

I've had booths on cyber security trade fairs hand out USB flash drives as prizes for spinning a wheel, with no awareness how that might seem odd. I guess people would be reluctant to accept them at BlackHat, but everywhere else people are very trusting towards USB stuff.

I once worked at a place where the security team had a USB stick delivered to all the desktops with some digital brochure about not trusting strangers or some such. Not the cyber security team, but still.

We send staged phishing emails internally to see who takes the bait.

Leaving USB sticks lying around with some sort of callback to see who plugs them in is a really clever idea. We could probably catch the serial number range in Defender ATP.

Re: FBI is warning people against using public phone-charging stations

#285

Post by jstarfish »

Imogragi wrote: post #276
neodypsis wrote: post #274

Earlier quoted context omitted.

This is a joke, but it could actually be a thing. An isolator that you can use to protect your device while using those unknown ports. I would call it an isolator though, or firewall, not what you called it.

They make those. They are called data blocker cables and only have power pins, no data.

...which are really annoying when you do need to transfer data to your phone, but all you have in your bag are data-blockers ;)

Re: FBI is warning people against using public phone-charging stations

#286

Post by Tommstein »

i_am_jl wrote: post #269
tzs wrote: post #258

I've come to think that whatever eventually replaces USB should add some separation between power and data. Let's call it MSB (Multiversal Serial Bus). Maybe something like this. MSB would define 2 connectors: a data connector and a power connector. MSB would also specify that if you have both data and power connectors they should be physically laid out in data/power pairs and would define the spacing/positioning (e.…

Why not offload this to the device? Why doesn't my device today have an option that allows me to set the USB port to "power only"?

Because you don't have an Android? I don't remember the last one I had that didn't have that setting, if ever.

Re: FBI is warning people against using public phone-charging stations

#287

Post by jstarfish »

pid-1 wrote: post #230
ajsnigrutin wrote: post #158

But how? Most devices are charge-only by default, most users have USB debugging disabled, and those who know how to enable it, won't allow the adb server to connect to the phone (you have to explicitly give it permission).

I can picture a malicious actor convincing less tech savvy folks into enabling USB debugging to "unlock wifi speed" or some similar BS.

Heh. Reminds me of the warez days.

"Can't install this shady pirated software you got from a malware-adjacent site? Try disabling your antivirus!"

Re: FBI is warning people against using public phone-charging stations

#288

Post by jstarfish »

ghaff wrote: post #143
iLoveOncall wrote: post #138

Earlier quoted context omitted.

Just go on a trip where you use your GPS a lot and take pictures with your phone and it will last half a day at best.

Especially if your phone isn't new and doesn't hold quite as much charge any longer. I've definitely ended up plugging my phone into a portable battery when traveling. But usually if I'm out and about and using GPS and camera a lot, I'll have some sort of small bag with me for water, snack, additional clothing, etc. anyway so easy to throw a battery and cable in.

Some of them are solar-equipped or have hand-cranks for emergency charging. Usually a built-in flashlight too.

Re: FBI is warning people against using public phone-charging stations

#289

Post by ghaff »

permo-w wrote: post #221
brewdad wrote: post #216

Earlier quoted context omitted.

If you've spent any time on here you know that no one actually clicks the links to read the article. Users need only trust the pages with an orange header.

I know I don’t but surely some people do perhaps hacker news is merely a conversation prompt aggregator

I mean the upstream comment is basically saying don't trust clicking any links on the Internet--even on a site that presumably weeds out really dodgy stuff quickly. Indeed, not using the Internet is a solid, if rather extreme, security process to follow.

Re: FBI is warning people against using public phone-charging stations

#290

Post by ghaff »

dotancohen wrote: post #264
tablespoon wrote: post #234

Earlier quoted context omitted.

> Many people, including many people on this site (and, yes, including myself) wouldn't think twice about plugging into an available port if they need a charge. Maybe I don't plug into an unlabeled port in some random location where it doesn't look like it belongs, but honestly I wouldn't think twice about charging at a designated area at a conference. This is the solution to that problem: https://www.amazon.com/Port…

If you're already committed to carrying Yet Another Accessory, then why not just carry a small portable charging battery. Some models are not much larger than that USB connector, and could charge the phone more than sitting babysitting a charging phone for an hour.

Yeah, I normally carry bigger portable batteries but I've got a bunch of small ones that I've typically been given by vendors which are probably good for at least getting a phone off life support.
Post reply on HN