91–100 of 328 posts
Earlier quoted context omitted.
You could ship the victim malicious USB cables in the mail with amazon branding on the box. Many people would use them, assuming they were just mis-shipped or ordered by their spouse.
...leaving a literal paper trail of package location tracking? Mail fraud is considered serious. Why commit an extra crime?
Earlier quoted context omitted.
What other attack vector would you choose?
You’d use it to attack the targets you care about rather than just the general public.
The sibling comment above is an excellent example of why you might specifically target public infrastructure if you only really care about one person.
Isn't that what those charge-only cables that don't do data are for?
Most people don't have those because USB-C Power Delivery requires data pins to negotiate fast charging. I think it's required to get anything beyond the basic 5V .5A power out of a USB socket these days.
Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?
Earlier quoted context omitted.
When I've done DC rapid charging on my Leaf, I noticed that the charger knew the battery percentage reported by the car. That seems likely to be digital signalling to me, so suddenly there's the risk of buffer overflows and suchlike. I've not seen this on AC, but when I looked into this previously I got the impression that there exists a digital signalling protocol established by modulating something ignored by older…
That’s why I only buy cars written in rust.
badUSB is what, nearly 20 years old now? i distinctly remember making usb condoms a long time ago, anyway, and have never trusted public usb slots anyway.
Another fun toy is the USB Gadget Kernel module. I've been running yolo + mouse/keyboard emulation on a raspberry pi to make horrible aim bots.
I'm seeing a lot of hysteria in response to this random tweet by the Denver FBI's social media person. Do we know of a single real-world use of this hypothetical exploit? Do we know that iOS's (and presumably Android's) protection against untrusted device access isn't enough?