Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

31–40 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#32

Post by jrochkind1 »

I'm surprised Schneier says "I am unconvinced".

We know (I think?) attackers can apparently easily introduce MitM skimmers to credit card swipers (I _think_ that's how my CC number keeps getting stolen?), possibly even without cooperation of the proprietor? Why not a little invisible injector on a charging port, that seems if anything easier.

Or is the skepticism around something else, I guess? Motivation? Lack of consistency over time of attack vectors around software injection via USB making it hard to commodify the attack? Like, there are only temporary zero days now and then which get patched, so this isn't a "cheap" thing to deploy on a wide scale?

[edit no idea why i'm getting downvoted on this, perhaps I didn't write it right but I'm legit just curious to hear people's takes on this, what reasons he might have been thinking of to not worry about this...]

Re: FBI is warning people against using public phone-charging stations

#33

Post by makeitdouble »

RcouF1uZ4gsC wrote: post #9

This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.

As most phones now have NFC, this would be more of a new vector than a safer procedure IMO.

I am not sure how many places properly accept non authentified (no phone unlock nor biometrics) contactless transaction in the US, but it's a thing at least in Japan.

I'd also assume the non secure area is readable without any unlock either way, but might be wrong.

Re: FBI is warning people against using public phone-charging stations

#36

Post by aaomidi »

TedDoesntTalk wrote: post #34
shiftpgdn wrote: post #20

If you have a zero day takeover via usb/lightning why would you waste it on public charging infrastructure? That seems ridiculous.

What other attack vector would you choose?

You’d use it to attack the targets you care about rather than just the general public.

Re: FBI is warning people against using public phone-charging stations

#37

Post by aaomidi »

croutonwagon wrote: post #23
jve wrote: post #18

I'v been wondering about the implications of free wifis within airports or such - how much that would be of a worry given you connect only to TLS secured services (and hopefully the phone does it too for every service it connects to in background)

Personally...I run a Linode VPN with openvpn on it listening on port 443. Anytime I am on an public wifi or untrusted network (including the occaisonal time at my job with a personal device), i connect to that. Since its 443, its generally not blocked, even through the TLS connection is not "standard" because it uses a 2048 bit PSK to as a pre-cursor to start a connection, then a certificate based auth to establish t…

OpenVPN is a noisy protocol. Every network operator knows you’re on a VPN.

Point is, port 443 isn’t really the best way if you dont want to be blocked.

You may want to consider stunnel if this ever becomes a problem for you.

Re: FBI is warning people against using public phone-charging stations

#38

Post by shlant »

trinsic2 wrote: post #31

To block usb power connectors from owning your phone: Databloc USB Data Blocker Adapter https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-...

could you just tape over the middle 2 connectors on a regular USB connector?

Re: FBI is warning people against using public phone-charging stations

#40

Post by judge2020 »

LinuxBender wrote: post #3
chaorace wrote: post #2

Just FYI: this is referring to USB charging stations, not EV stations. This advice has been standard in cybersecurity training for a long time now and frankly I'm surprised that this is the first time the FBI has felt the need to issue an advisory on the subject.

I have been somewhat curious if/when this will occur with EV stations as well. What controls might one gain over a car from the charging port on the assorted makes/models? Even hacking aside I am curious what PII, telemetry and tracking data could be pulled from the charge port.

The CCS standard has "HLC - High Level Communication", which is available for both AC and DC charging. While i'm not interested in paying $700 for ISO 15118, I imagine clients [cars] are set up to break the current flow if anything out of the ordinary happens or if the input power doesn't match what the station is saying it's sending in an instant.
Post reply on HN