5 ms·

How is the regular guy supposed to figure out if a USB device is OK or not? I guess the easy answer is to say "Don't use an unknown device" but I don't think th

How is the regular guy supposed to figure out if a USB device is OK or not? I guess the easy answer is to say "Don't use an unknown device" but I don't think this is practical especially in the case of a charger. It's like the constant battle with our IT department to get and keep admin privileges on our machines. Yes, this can cause a problem but we need admin rights to do our job.

DaiPlusPlus 8y ago
Make “USB Condoms” that only have the power pins, no data. Educate users to see if these no-data devices have data pins.
- seanp2k2 8y ago
  Within the context of USB Power Delivery , it needs more than simple power and ground to actually work. While it’s theoretically possible to make such a device that would determine which device is the source and sink, determine voltages and charge rates, then smartly select one and begin charging without the devices directly communicating, no such off-the-shelf device currently exists as far as I’m aware. You basically want a USB PD firewall that would only allow commands relevant to changing through, or have it generate synthetic responses that would e.g. never allow it to expose things like a mass storage interface. You might also need drivers depending on how you implement it. It would be a cool project / crowdsupply / Kickstarter though. More info: http://www.usb.org/developers/powerdelivery/ http://www.usb.org/developers/powerdelivery/ Right now, USB-C is only just starting to get past the “which cables will physically harm my device with a given charger even though they plug in correctly” phase.
floatingatoll 8y ago
In the case of a charger, you must always use a charge-stop adapter if you’re charging from a public charger. They’re cheap and a couple offer bulk discounts to companies.
- mimimihaha 8y ago
  Now thinking about it, if you made a malicious USB charging block that looks like the iPhone‘s and offered it to me, id probably fall for it.
- rbanffy 8y ago
  You can always learn how to make a UBB power-only cable out of a regular one.
- Steltek 8y ago
  Recommendations for a USB-C compatible one? USB-C significantly complicates a simple idea, unfortunately.
  - floatingatoll 8y ago
    Which aspect of USB-C do you require to remain unaffected in transit?
rbanffy 8y ago
> How is the regular guy supposed to figure out if a USB device is OK or not? If you are not absolutely sure it's OK, then it's not. Pack your own chargers, use a "USB condom" or a power-only cable. If the charger has a cable that can't be removed, use it to charge a trusted battery, then charge your phone from it. Don't trust any smart battery, BTW. Journalist covering summits like this are not regular guys and should receive opsec training before any such assignment. When working on the Brazilian electronic ballot, I had two computers: one that was connected to the corporate network where I could read and write e-mails, and another I could manage (so I could run Visual Studio's debugger), that was on a completely different network, in front and behind some of the most aggressive firewalls I've ever seen.
- tomp 8y ago
  Why can't it infect (the microcontroller on) the battery, and then infect your device later?
  - troncjb 8y ago
    Ostensibly you're using that aforementioned power-only cable from battery -> device.
    - tomp 8y ago
      But then you can just skip the battery anyways...
      - rbanffy 8y ago
        If the untrusted charger has a USB socket, then yes. If you have an untrusted charger with non-detachable cable, then no.
  - rbanffy 8y ago
    There are dumb batteries that only use the power connections. Those can't be infected.
rsync 8y ago
"How is the regular guy supposed to figure out if a USB device is OK or not? I guess the easy answer is to say "Don't use an unknown device" but I don't think this is practical especially in the case of a charger." I use a "USB Condom". My current USB Condom is this one: https://www.amazon.com/PortaPow-Data-Blocker-Adaptor-SmartCharge/dp/B00T0DW3F8/ https://www.amazon.com/PortaPow-Data-Blocker-Adaptor-SmartCh... In fact, I sometimes even use it with my own, trusted, devices. For instance, I don't want my macbook itunes to know about my iphone so when I charge from my own laptop, I use the "condom". I'm sure these exist for USB-C...
- lostlogin 8y ago
  And another dongle.
- maxxxxx 8y ago
  Makes me wonder why manufacturers don't have a USB permission scheme like they have for apps. It would be nice to give a USB device only certain permissions like charging.
  - bigato 8y ago
    Because anything software is hackable by definition
  - ksk 8y ago
    The USB device itself tells the machine what its "unique" identifier is. If you use it for permissions, then it could just lie.
  - untog 8y ago
    Anything software based would still be vulnerable. The only surefire way is to disconnect the pins, as these USB condoms do.
    - astrodust 8y ago
      It must be hardware based. Like the USB bus can negotiate with your system and then upgrade the connection if the device passes. Of course this would require cryptography to do properly so it'll never, ever happen.
ksk 8y ago
One easy answer is to give people an "appliance"/task-specific computer instead of a general purpose computer. So the computer is essentially just a hypervisor that loads the appropriate appliance which only allows them to do specific tasks - one for banking, one for email, one for writing documents, one for browsing, one for gaming, etc.

DaiPlusPlus 8y ago

Make “USB Condoms” that only have the power pins, no data. Educate users to see if these no-data devices have data pins.

seanp2k2 8y ago
Within the context of USB Power Delivery , it needs more than simple power and ground to actually work. While it’s theoretically possible to make such a device that would determine which device is the source and sink, determine voltages and charge rates, then smartly select one and begin charging without the devices directly communicating, no such off-the-shelf device currently exists as far as I’m aware. You basically want a USB PD firewall that would only allow commands relevant to changing through, or have it generate synthetic responses that would e.g. never allow it to expose things like a mass storage interface. You might also need drivers depending on how you implement it. It would be a cool project / crowdsupply / Kickstarter though. More info: http://www.usb.org/developers/powerdelivery/ http://www.usb.org/developers/powerdelivery/ Right now, USB-C is only just starting to get past the “which cables will physically harm my device with a given charger even though they plug in correctly” phase.

floatingatoll 8y ago

In the case of a charger, you must always use a charge-stop adapter if you’re charging from a public charger. They’re cheap and a couple offer bulk discounts to companies.

mimimihaha 8y ago
Now thinking about it, if you made a malicious USB charging block that looks like the iPhone‘s and offered it to me, id probably fall for it.
rbanffy 8y ago
You can always learn how to make a UBB power-only cable out of a regular one.
Steltek 8y ago
Recommendations for a USB-C compatible one? USB-C significantly complicates a simple idea, unfortunately.
- floatingatoll 8y ago
  Which aspect of USB-C do you require to remain unaffected in transit?

rbanffy 8y ago

> How is the regular guy supposed to figure out if a USB device is OK or not? If you are not absolutely sure it's OK, then it's not. Pack your own chargers, use a "USB condom" or a power-only cable. If the charger has a cable that can't be removed, use it to charge a trusted battery, then charge your phone from it. Don't trust any smart battery, BTW. Journalist covering summits like this are not regular guys and should receive opsec training before any such assignment. When working on the Brazilian electronic ballot, I had two computers: one that was connected to the corporate network where I could read and write e-mails, and another I could manage (so I could run Visual Studio's debugger), that was on a completely different network, in front and behind some of the most aggressive firewalls I've ever seen.

tomp 8y ago
Why can't it infect (the microcontroller on) the battery, and then infect your device later?
- troncjb 8y ago
  Ostensibly you're using that aforementioned power-only cable from battery -> device.
  - tomp 8y ago
    But then you can just skip the battery anyways...
    - rbanffy 8y ago
      If the untrusted charger has a USB socket, then yes. If you have an untrusted charger with non-detachable cable, then no.
- rbanffy 8y ago
  There are dumb batteries that only use the power connections. Those can't be infected.

rsync 8y ago

"How is the regular guy supposed to figure out if a USB device is OK or not? I guess the easy answer is to say "Don't use an unknown device" but I don't think this is practical especially in the case of a charger." I use a "USB Condom". My current USB Condom is this one: https://www.amazon.com/PortaPow-Data-Blocker-Adaptor-SmartCharge/dp/B00T0DW3F8/ https://www.amazon.com/PortaPow-Data-Blocker-Adaptor-SmartCh... In fact, I sometimes even use it with my own, trusted, devices. For instance, I don't want my macbook itunes to know about my iphone so when I charge from my own laptop, I use the "condom". I'm sure these exist for USB-C...

lostlogin 8y ago
And another dongle.
maxxxxx 8y ago
Makes me wonder why manufacturers don't have a USB permission scheme like they have for apps. It would be nice to give a USB device only certain permissions like charging.
- bigato 8y ago
  Because anything software is hackable by definition
- ksk 8y ago
  The USB device itself tells the machine what its "unique" identifier is. If you use it for permissions, then it could just lie.
- untog 8y ago
  Anything software based would still be vulnerable. The only surefire way is to disconnect the pins, as these USB condoms do.
  - astrodust 8y ago
    It must be hardware based. Like the USB bus can negotiate with your system and then upgrade the connection if the device passes. Of course this would require cryptography to do properly so it'll never, ever happen.

ksk 8y ago

One easy answer is to give people an "appliance"/task-specific computer instead of a general purpose computer. So the computer is essentially just a hypervisor that loads the appropriate appliance which only allows them to do specific tasks - one for banking, one for email, one for writing documents, one for browsing, one for gaming, etc.