Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

311–320 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#311

Post by thinkmassive »

CharlesW wrote: post #225
thinkmassive wrote: post #214

Earlier quoted context omitted.

Thousands of O.MG cables are out in the wild… https://shop.hak5.org/products/omg-cable

Wouldn't this be considered the same attack? Users would connect the cable, unlock their phone, and then would need to explicitly "Trust" the external device attempting to connect to their phone via USB. I suppose the difference is that people may be using the cable to connect to a device where that prompt is expected, in contrast to the "charging port in an airport" scenario where it would seem appropriately alarmin…

If the phone is unlocked, a badUSB-type device can do anything a keyboard can do, so it’s far from completely harmless.

Re: FBI is warning people against using public phone-charging stations

#312

Post by vGPU »

wongarsu wrote: post #179
ghaff wrote: post #111

Earlier quoted context omitted.

Many people, including many people on this site (and, yes, including myself) wouldn't think twice about plugging into an available port if they need a charge. Maybe I don't plug into an unlabeled port in some random location where it doesn't look like it belongs, but honestly I wouldn't think twice about charging at a designated area at a conference. (Though, yeah, I'd avoid a lot of "normal" activities if I ever att…

I've had booths on cyber security trade fairs hand out USB flash drives as prizes for spinning a wheel, with no awareness how that might seem odd. I guess people would be reluctant to accept them at BlackHat, but everywhere else people are very trusting towards USB stuff.

I take free USB drives any day. I always test them on the pc that belongs to the coworker that nobody likes first though ;)

In all seriousness though - 128gb usb 3.0 drives can be picked up for $10 on sale all day long. Absolutely no reason to trust some $0.25 random 4gb that a stranger gave you aside from running R-studio on it for fun or something.

Re: FBI is warning people against using public phone-charging stations

#313

Post by vGPU »

TillE wrote: post #228
permo-w wrote: post #220

Earlier quoted context omitted.

very true. nevertheless, I’m curious if you implicitly trust the security of links on HN? I know I largely do, but perhaps that’s unwise, especially given the site’s stated target audience

Serious browser exploits are extremely rare these days. Like, the worst you get is cryptocurrency mining while you're on the page.

I still get the occasional popup that gets past AdGuard on my phone and tries to add spam to my calendar on my iPhone but it’s definitely a lot better than it used to be. I got one a few months ago that had instructions on installing a custom management profile, now that cracked me up.

Re: FBI is warning people against using public phone-charging stations

#314

Post by i_am_jl »

Tommstein wrote: post #286
i_am_jl wrote: post #269

Earlier quoted context omitted.

Why not offload this to the device? Why doesn't my device today have an option that allows me to set the USB port to "power only"?

Because you don't have an Android? I don't remember the last one I had that didn't have that setting, if ever.

Try plugging a keyboard into your phone.

That setting does not work the way you think it does.

Re: FBI is warning people against using public phone-charging stations

#315

Post by worthless-trash »

erik_seaberg wrote: post #301
worthless-trash wrote: post #295

Earlier quoted context omitted.

If you attack the right part of the USB stack, the prompt and its answer dont matter.

If a malformed packet can trigger RCE in the USB stack, there wouldn’t be a prompt, right?

Thats how i'm seeing it.

Re: FBI is warning people against using public phone-charging stations

#316

Post by ghostpepper »

Alupis wrote: post #242
kevviiinn wrote: post #226

Earlier quoted context omitted.

I bet their iphone was running android

There have been many jailbreaks available that only required plugging the phone in and running some program on the other end of the cable. There's been jailbreaks where all you needed to do was visit a website... Apple's security isn't as bullet-proof as some make it out to be. So, is it plausible a malicious charging station could gain root and sideload something nefarious on an iPhone? Absolutely. Particularly for…

It’s been many years since I rooted (or even owned) an android phone but is there really no interaction from the user required beyond plugging it in? On iOS there’s a pop up asking if you want to trust the computer, and that’s after you’ve unlocked the screen

Re: FBI is warning people against using public phone-charging stations

#317

Post by yencabulator »

HeavyFeather wrote: post #51
imdoor wrote: post #49

I'm curious, shouldn't the "charge only" mode, that's the default, when connecting usb stuff to Android phones, be enough to protect users? Is it really that difficult to implement a "don't read data pins, only charge" mode on a phone and not have vulnerabilities in it?

If you can connect your turned off phone to your computer and start a reset, then that’s never going to be enough. If you want data safety, you must skip the data pins. If you want current safety, you must skip public chargers.

If it's just a USB-initiated factory reset, that's much less worrying, just DoS not infiltration. Exploiting that at a busy airport would be a huge nuisance, but not a huge security risk. Just like wiring 110VAC into the USB wires would be a DoS...

Re: FBI is warning people against using public phone-charging stations

#318

Post by yencabulator »

i_am_jl wrote: post #314
Tommstein wrote: post #286

Earlier quoted context omitted.

Because you don't have an Android? I don't remember the last one I had that didn't have that setting, if ever.

Try plugging a keyboard into your phone. That setting does not work the way you think it does.

(Apart from very low level USB firmware stack attacks:)

That's a purely software issue, though, and actually easier to solve on phones (with built-in display+input) than on PCs (how to trust a keyboard/mouse without having keyboard/mouse to input approval with?).

https://usbguard.github.io/

Re: FBI is warning people against using public phone-charging stations

#319

Post by yencabulator »

xeromal wrote: post #132
slig wrote: post #124

Earlier quoted context omitted.

After Stuxnet, I wouldn't discard that possibility.

Exactly what I was thinking of when I wrote this. They left USBs on the ground hoping the right person would pick it up.

It's worth noting that Stuxnet was very careful not to even reveal its capabilities if it happened to infect a non-target host. It was still a very targeted attack, and not "everyone had their bank accounts hacked" risk.

(It still infected untargeted PCs, and might have caused them to misbehave, but not intentionally. Stuxnet was designed for stealth, not for mass exploitation. You the average PC owner has very little to fear from such targeted attacks, you're not worth the 0days.)

Re: FBI is warning people against using public phone-charging stations

#320

Post by yencabulator »

onemoresoop wrote: post #126
yonaguska wrote: post #71

Earlier quoted context omitted.

I just carry a portable battery when travelling. Seems like way less work with the added convenience of being able to charge on the move.

And as a bonus you can charge the battery at a public station.

For the true paranoids, your battery bank also runs firmware...

But realistically, a battery bank seems like an even better solution than a dedicated "USB condom"; it'll even protect you from "USB killer" attacks that inject high voltage to the ports, by frying just the power bank not the real device.

It's more bulky than just a dedicated cable, though.

Post reply on HN