Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

Post reply on HN
Print view View original

81–90 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#81

Post by ghostpepper »

bakugo wrote: post #56
shiftpgdn wrote: post #20

If you have a zero day takeover via usb/lightning why would you waste it on public charging infrastructure? That seems ridiculous.

I'm inclined to agree, an exploit this powerful would almost definitely be used for targeted attacks only.

This was the prevailing wisdom for many years but the recent watering-hole attack by China has made me reconsider this position.

https://www.eff.org/deeplinks/2019/09/watering-holes-and-mil...

Re: FBI is warning people against using public phone-charging stations

#82

Post by maerF0x0 »

jve wrote: post #79
hinata08 wrote: post #28

Earlier quoted context omitted.

in 2023 : none sites are protected not only wity TLS but also HSTS and the list goes on. Wi-Fi doesn't include sturdy security mecanisms anyway, so wifi is never safe. Companies that are serious about network security are recommended to use a second factor, like a VPN, especially on their company network (because they always have ressources that lack protection) For customers and individuals like us, sites are safe e…

> sites are protected not only wity TLS but also HSTS and the list goes on. HSTS is just what says for the browser not even try HTTP connection, but directly HTTPS.

and also to report an error if there's a redirect back to HTTP, right?

ie when a MITM is attempting to drop you back to insecure.

Re: FBI is warning people against using public phone-charging stations

#83

Post by Kirby64 »

londons_explore wrote: post #62
slicktux wrote: post #53

I usually drill out the data pins on a USB I plan on using for public charging stations…

Have fun with most devices only charging at 2.5 watts (ie. 6 hours for a full phone charge)...

Some devices don't really operate this way; some of them just try to keep pulling current until they either see voltage start dropping significantly, or they meet the amount of current they need.

Also, you can just put the 'correct' data connections on the phone side (keeping data disconnected on the charger side) and pull up to 5V-3A, no problem assuming the charger can handle it.

Re: FBI is warning people against using public phone-charging stations

#84

Post by yellow_postit »

tastyfreeze wrote: post #39
trinsic2 wrote: post #31

To block usb power connectors from owning your phone: Databloc USB Data Blocker Adapter https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-...

A USB cable without data lines works too.

Except you are stuck with slower charging speeds. Usually in the places you most want fast charging but have the least trust (random public charging spots)

Most users, most of the time, will trade speed for security.

Re: FBI is warning people against using public phone-charging stations

#85

Post by dylan604 »

fnordpiglet wrote: post #52
rlpb wrote: post #46

Earlier quoted context omitted.

When I've done DC rapid charging on my Leaf, I noticed that the charger knew the battery percentage reported by the car. That seems likely to be digital signalling to me, so suddenly there's the risk of buffer overflows and suchlike. I've not seen this on AC, but when I looked into this previously I got the impression that there exists a digital signalling protocol established by modulating something ignored by older…

That’s why I only buy cars written in rust.

brings new meaning to the term "rust bucket"

Re: FBI is warning people against using public phone-charging stations

#86

Post by kevin_thibedeau »

thomastjeffery wrote: post #76
londons_explore wrote: post #64

Earlier quoted context omitted.

You could ship the victim malicious USB cables in the mail with amazon branding on the box. Many people would use them, assuming they were just mis-shipped or ordered by their spouse.

...leaving a literal paper trail of package location tracking? Mail fraud is considered serious. Why commit an extra crime?

You can put a padded envelope into a public mailbox.

Re: FBI is warning people against using public phone-charging stations

#87

Post by maerF0x0 »

paulryanrogers wrote: post #27

Or at least use a USB condom with voltage protection

I mean, if they fry the device I think that's going to both be an acceptable risk (annoying but not breached), and also likely to be detected rapidly -- "Shit my device is fucked, better tell airport staff"

Re: FBI is warning people against using public phone-charging stations

#88

Post by maerF0x0 »

expertentipp wrote: post #17
fouc wrote: post #11

I guess we should also avoid plugging our phone into the USB ports on airplane seats?

The race of media, ad, and other companies for one's attention and data is brutal. Especially when one is stuck in a seat for hours and only has a back of another seat in front of their face.

I've often wondered about this. Is $AIRLINE selling the traffic data? I wonder how much $NSFW is being consumed on planes?

Re: FBI is warning people against using public phone-charging stations

#90

Post by jcl »

layer8 wrote: post #41
trinsic2 wrote: post #31

To block usb power connectors from owning your phone: Databloc USB Data Blocker Adapter https://www.amazon.com/Databloc-Charge-Only-Adapter-syncing-...

Nice. Alas, that will probably also block fast charging on iPhone 15+: https://9to5mac.com/2023/03/20/usb-c-faster-charging-iphone-...

I suspect that someone using a public usb-a charging port isn’t expecting fast charging, but rather counting themselves lucky that it works at all.
Post reply on HN