6 ms·

>We found that in some cases the "charge-only" USB mode may also fail to block AT commands. wow that is embarrassing. This needs to be added to CTS like 5 year

>We found that in some cases the "charge-only" USB mode may also fail to block AT commands. wow that is embarrassing. This needs to be added to CTS like 5 years ago ..

Avamander 8y ago
This allows KDE/modemmanager to unlock the SIM card of my phone by just plugging it in though. I like it. I know my phone isn't top-notch on security but thankfully I know it isn't and take precautions outside.
- p4bl0 8y ago
  Yep, when using an untrusted USB power source, you can use what is called a "USB condom": either an adapter or a USB cable with the data wires cut letting only power go through. You can search the web for tutorial on which wires to cut in your USB cable, or for already made USB condoms to buy for less than $10 a piece.
  - noja 8y ago
    You need to buy good ones otherwise the power negotiation doesn't happen and you get a slow charge.
    - Immortalin 8y ago
      Any way to sandbox or proxy the power negotiation through the sheath? Laptop's USB controller chip could be vulnerable.
      - simcop2387 8y ago
        Not sure of any that do that, but I've seen quite a few that support most of the charging standards and negotiate the highest current available (still at 5V) so that the phone can usually charge reasonably fast.
      - Avamander 8y ago
        There are chips you can buy that do power negotiation. You could design your own PCB that does the job.
  - driverdan 8y ago
    > when using an untrusted USB power source... Don't do that. Ever. Always use your own charger and cable, preferably the ones that came with the phone. If not make sure you're sourcing them from a reputable company and not an anonymous Chinese importer.
blattimwind 8y ago
You can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it. > We found that in some cases the "charge-only" USB mode may also fail to block AT commands.
- ForHackernews 8y ago
  This is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?
  - kageurufu 8y ago
    USB-C has separate lines for the "Configuration Channel", that is used to negotiate voltage and amperage. I'm unaware if the specification allows for cables without data lines, but I don't believe they would be required. It would only work on USB-C host devices as well though, USB-A would still revert to either 500mA as long as the data lines are tied with a resistor
  - joezydeco 8y ago
    There's the USB Condom: https://int3.cc/products/usbcondoms https://int3.cc/products/usbcondoms http://syncstop.com/ http://syncstop.com/
    - digi_owl 8y ago
      While not at guaranteed, killing the data wires (or shorting them) makes the device think it is dealing with a charge only port. Thus various companies have made devices that conditionally apply said short. Here is one example: https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-Fast-Charging-Adapter~USB2CHADP https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-F...
      - joezydeco 8y ago
        The USB condom is more for situations where you are in public and wish to charge your device from an unknown and possibly hostile USB-A receptacle.

>We found that in some cases the "charge-only" USB mode may also fail to block AT commands. wow that is embarrassing. This needs to be added to CTS like 5 years ago ..

Avamander 8y ago

This allows KDE/modemmanager to unlock the SIM card of my phone by just plugging it in though. I like it. I know my phone isn't top-notch on security but thankfully I know it isn't and take precautions outside.

p4bl0 8y ago
Yep, when using an untrusted USB power source, you can use what is called a "USB condom": either an adapter or a USB cable with the data wires cut letting only power go through. You can search the web for tutorial on which wires to cut in your USB cable, or for already made USB condoms to buy for less than $10 a piece.
- noja 8y ago
  You need to buy good ones otherwise the power negotiation doesn't happen and you get a slow charge.
  - Immortalin 8y ago
    Any way to sandbox or proxy the power negotiation through the sheath? Laptop's USB controller chip could be vulnerable.
    - simcop2387 8y ago
      Not sure of any that do that, but I've seen quite a few that support most of the charging standards and negotiate the highest current available (still at 5V) so that the phone can usually charge reasonably fast.
    - Avamander 8y ago
      There are chips you can buy that do power negotiation. You could design your own PCB that does the job.
- driverdan 8y ago
  > when using an untrusted USB power source... Don't do that. Ever. Always use your own charger and cable, preferably the ones that came with the phone. If not make sure you're sourcing them from a reputable company and not an anonymous Chinese importer.

blattimwind 8y ago

You can never trust software to block data flows. There is no such thing as "charge-only" as long as the cable still has data wires in it. > We found that in some cases the "charge-only" USB mode may also fail to block AT commands.

ForHackernews 8y ago
This is a good point. I wonder if there's a market for "power-only" USB cables without data? Or would those fail to negotiate the right wattage?
- kageurufu 8y ago
  USB-C has separate lines for the "Configuration Channel", that is used to negotiate voltage and amperage. I'm unaware if the specification allows for cables without data lines, but I don't believe they would be required. It would only work on USB-C host devices as well though, USB-A would still revert to either 500mA as long as the data lines are tied with a resistor
- joezydeco 8y ago
  There's the USB Condom: https://int3.cc/products/usbcondoms https://int3.cc/products/usbcondoms http://syncstop.com/ http://syncstop.com/
  - digi_owl 8y ago
    While not at guaranteed, killing the data wires (or shorting them) makes the device think it is dealing with a charge only port. Thus various companies have made devices that conditionally apply said short. Here is one example: https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-Fast-Charging-Adapter~USB2CHADP https://www.startech.com/Cables/USB-2.0/USB-Adapters/USB-2-F...
    - joezydeco 8y ago
      The USB condom is more for situations where you are in public and wish to charge your device from an unknown and possibly hostile USB-A receptacle.