6 ms·

Even with some kind of authentication that doesn't change the fact that public USB outlets can still be rigged to fry your machine. The likelihood of it is prob

by warent 8y ago

Even with some kind of authentication that doesn't change the fact that public USB outlets can still be rigged to fry your machine. The likelihood of it is probably incredibly small but I personally still wouldn't use public USB outlets.

marcosdumay 8y ago
I can trust a public outlet to not fry my phone. That is simple, if my phone stays functional I'm good, and if it gets fried I take some real world measures (go to small causes court, make a denounce to some government agency) to get compensation. The real problem on public outlets is with data attacks, not power. If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore.
- karmakaze 8y ago
  Power-only USB cables offer good data protection, or just set your device in such a mode.
  - geofft 8y ago
    No such devices exist with USB Power Delivery support, I believe. (I believe you cannot make a passive adapter as you could for 5V, 2A-or-less plain USB A/B power connections; you have to speak the USB protocol and register as a device before you can switch to more than 5V or draw more than 2A. And plenty of people want more than 10W power.) I also don't believe any OSes offer a mode where they negotiate power delivery and not data, though I'd love to be wrong - that would be 90% of my proposal. It wouldn't let you authenticate individual devices, but it would let you go back to having a single port that's just a charging port.
    - gumby 8y ago
      You can buy type c condoms that do all the negotiation but block data to and from the cable.
      - geofft 8y ago
        Do you have a link to such an item? All I have found is devices that lower you to USB A-style 10 W charging.
    - cesarb 8y ago
      > you have to speak the USB protocol and register as a device before you can switch to more than 5V or draw more than 2A. It depends on which "USB protocol" you're talking about. With USB-C, there are five separate data buses on the plug, each running its own protocol. There is the traditional USB 2.0 bus (half-duplex differential pair), a pair of differential dual simplex buses (normally USB 3.0/3.1/3.2, can also be used for alternate protocols like DisplayPort), a pair of sideband wires (used only by alternate protocols), and the Configuration Channel. All configuration of the other data buses and of the main power bus is done through the Configuration Channel, in simple cases through resistor values, in more complex cases through the USB-PD protocol. So yeah, you have to speak the "USB protocol" to switch to more than 5V or more than 3A, but the "USB protocol" you have to speak is not the traditional USB 2.0 or USB 3.x protocol, but instead the completely separate USB-PD protocol, which runs on its own dedicated set of wires. I doubt you can show up as a pen drive full of malware through the USB-PD protocol, but I don't doubt that cutting the other buses (keeping only the Configuration Channel/VCONN and the main power bus) will still work to deliver power, even at higher voltages and/or currents. The reason this isn't standardized (as far as I know, a "charging-only" plug is only allowed as a captive cable on a non-charger) is for compatibility: if your device doesn't understand USB-PD, it might not charge at a full speed unless it sees a short on the USB 2.0 bus (Battery Charging specification), and doing that short on an adapter would allow a device to draw too much power from a non-charger.
  - anticensor 8y ago
    18V, 5A would be a shock hazard.
    - XMPPwocky 8y ago
      If you stick it in your mouth or something, maybe. Or if you're soaking wet and have a terrible heart. Otherwise, nobody's getting hurt off 18v.
    - gsich 8y ago
      No. Skin resistance is at least around 100k Ohm at that voltage.
    - semi-extrinsic 8y ago
      DC voltages below 50 V are considered "safe" in normal indoor conditions. It's often referred to as "extra low voltage", as opposed to "low voltage" (50 V - 1000 V) and "high voltage" ( > 1000 V). If you want to verify the safety of 18 V: ever touch both poles of a 9V battery with your fingers? You can't feel anything. Go ahead and try two in series, you still won't feel it.
      - naikrovek 8y ago
        Really? I can feel 4 volts between my finger and thumb. Isn't painful or anything, but I can tell when a lipo battery is charged vs. discharged.
        Maskawanian 8y ago
        Yes, here is a good video about this: https://www.youtube.com/watch?v=ZxBF7WC0TQk https://www.youtube.com/watch?v=ZxBF7WC0TQk
        xxs 8y ago
        You can feel lower voltages if you fingers are injured, or if you... lick them. As kids (6-9y) we used to test the voltages of 3R12 (4.5v) by touching the poles with tongue, a sharp bites - the battery was good.
- warent 8y ago
  > That is simple, if my phone stays functional I'm good, and if it gets fried I take some real world measures (go to small causes court, make a denounce to some government agency) to get compensation. This is much easier said than done (in the US at least.) First, you'd be looking at at least a year of going back and forth in small claims court and by the end of it still have no guarantee of winning. Even if you did win, there's no guarantee the judge would award you the full amount to pay for your fried device. It almost certainly would not pay your time at the courthouse though; you can ask the judge for punitive but you cannot include legal expenses in small claims court demands. In the end you would still be out hundreds or thousands of dollars and numerous hours of your time. That's why to me the tiny benefit of using a public USB outlet is just not remotely worth the risk of such a nightmarish hassle.
  - VectorLock 8y ago
    This is the same thing as just plugging into a regular power outlet. You don't know if the thing you're expecting to provide 110v is actually giving you 10,000v. Then again if things were really bad or malicious you could end up losing your life like Sheryl Aldeguer.
- userbinator 8y ago
  The real problem on public outlets is with data attacks, not power. If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore. My old no-name Android phone (not USB C) has such an option, and searching around it seems to be a reasonably common feature, although not present on all devices. It looks similar to this (mine has the same typo, "USB fuctions"): https://farm8.staticflickr.com/7485/16035739946_51d110ea40.jpg https://farm8.staticflickr.com/7485/16035739946_51d110ea40.j... In charge-only mode it doesn't even enumerate as a USB device when plugged into a computer with an active USB controller, so I suspect no attacks (besides physical ones like overvolting as others here have mentioned) are possible in this mode --- the USB controller on the device is completely disabled.
  - geofft 8y ago
    Isn't that the wrong direction? My concern is not so much that my phone will show up to an attacker as a storage device, which can generally be restricted or be set to require pairing - my concern is that the attacker will show up to my phone (or laptop) as an accessory, in particular as a keyboard and mouse and perhaps an external display, at which point they can click through any permission or pairing prompts the OS might try to show.
    - kwhitefoot 8y ago
      Definitely! If my Moto G5+ is locked then it seems that plugging in a keyboard behaves pretty much like plugging a keyboard into a desktop or laptop computer except that it doesn't respond to c-a-del. I can unlock from the external keyboard by pressing the windows key and then typing my pin number but the multimedia keys and print screen on the keyboard work even with the screen locked. I would rather that it didn't do any of that until I give permission on the mobile itself.
  - ardy42 8y ago
    >> If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore. > My old no-name Android phone (not USB C) has such an option, and searching around it seems to be a reasonably common feature, although not present on all devices. I use one of these. The nice thing about the newer versions is that you can verify the impossibility of a data connection through easy physical inspection. https://www.amazon.com/PortaPow-3rd-Data-Blocker-Pack/dp/B00T0DW3F8 https://www.amazon.com/PortaPow-3rd-Data-Blocker-Pack/dp/B00...
geofft 8y ago
Don't we have technologies for that like fuses? In particular, people seem to use untrusted AC power outlets all the time without their devices being fried. The motivations of an attacker who wants to fry devices (mere lulz) and the motivation of an attacker who wants to break into working devices silently are very different; it makes sense to expect more of the latter, and to define the latter and not the former as within your threat model.
- cesarb 8y ago
  A fuse protects against overcurrent. It does nothing against overvoltage, or worse, reverse polarity (which was what fried Benson Leung's device). USB-C has a maximum of 20V, and that's only when negotiated by both devices; many devices will only expect 5V. If an untrusted low-quality power supply fails, it can put the full line voltage (alternating from -110V to 110V or more) into the USB cable. Protecting against that would add a lot of bulk and cost to a device. AC powered devices, on the other hand, already have to deal with the full line voltage (which includes negative voltages) all the time, so there's no extra cost for them.
  - justrobert 8y ago
    The solution I use and many others is to only charge a usb battery in public, and you use that battery to charge your devices. That works well to solve all the issues with public power ports.
- zzzcpan 8y ago
  Fuses and input protection in general can't save your device from a malicious attacker connecting say a powerful taser into a usb port.
  - geofft 8y ago
    I mean, they also can't solve a malicious attacker connecting a powerful taser above a USB port and trying to maim whoever uses the port. What's your threat model again?
JohnFen 8y ago
> that doesn't change the fact that public USB outlets can still be rigged to fry your machine. That is true, but not something that I'm overly fussed about. I'd much rather have my USB port fried than to suffer an intrusion.
TheCoelacanth 8y ago
Why would anyone do that? If you just want to vandalize things and have the physical access necessary to install a USB outlet, there are much easier ways to do that. Data attacks are much more realistic because the attacker can gain something beyond just causing destruction.
Waterluvian 8y ago
Is this a real problem or a razors in apples problem?
- yuubi 8y ago
  A real problem for some is that standardizing power adapters interferes with the sale of original manufacturers' adapters. The authentication mechanism looks to be designed to fix this revenue leak.

by warent 8y ago

marcosdumay 8y ago

I can trust a public outlet to not fry my phone. That is simple, if my phone stays functional I'm good, and if it gets fried I take some real world measures (go to small causes court, make a denounce to some government agency) to get compensation. The real problem on public outlets is with data attacks, not power. If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore.

karmakaze 8y ago
Power-only USB cables offer good data protection, or just set your device in such a mode.
- geofft 8y ago
  No such devices exist with USB Power Delivery support, I believe. (I believe you cannot make a passive adapter as you could for 5V, 2A-or-less plain USB A/B power connections; you have to speak the USB protocol and register as a device before you can switch to more than 5V or draw more than 2A. And plenty of people want more than 10W power.) I also don't believe any OSes offer a mode where they negotiate power delivery and not data, though I'd love to be wrong - that would be 90% of my proposal. It wouldn't let you authenticate individual devices, but it would let you go back to having a single port that's just a charging port.
  - gumby 8y ago
    You can buy type c condoms that do all the negotiation but block data to and from the cable.
    - geofft 8y ago
      Do you have a link to such an item? All I have found is devices that lower you to USB A-style 10 W charging.
  - cesarb 8y ago
    > you have to speak the USB protocol and register as a device before you can switch to more than 5V or draw more than 2A. It depends on which "USB protocol" you're talking about. With USB-C, there are five separate data buses on the plug, each running its own protocol. There is the traditional USB 2.0 bus (half-duplex differential pair), a pair of differential dual simplex buses (normally USB 3.0/3.1/3.2, can also be used for alternate protocols like DisplayPort), a pair of sideband wires (used only by alternate protocols), and the Configuration Channel. All configuration of the other data buses and of the main power bus is done through the Configuration Channel, in simple cases through resistor values, in more complex cases through the USB-PD protocol. So yeah, you have to speak the "USB protocol" to switch to more than 5V or more than 3A, but the "USB protocol" you have to speak is not the traditional USB 2.0 or USB 3.x protocol, but instead the completely separate USB-PD protocol, which runs on its own dedicated set of wires. I doubt you can show up as a pen drive full of malware through the USB-PD protocol, but I don't doubt that cutting the other buses (keeping only the Configuration Channel/VCONN and the main power bus) will still work to deliver power, even at higher voltages and/or currents. The reason this isn't standardized (as far as I know, a "charging-only" plug is only allowed as a captive cable on a non-charger) is for compatibility: if your device doesn't understand USB-PD, it might not charge at a full speed unless it sees a short on the USB 2.0 bus (Battery Charging specification), and doing that short on an adapter would allow a device to draw too much power from a non-charger.
- anticensor 8y ago
  18V, 5A would be a shock hazard.
  - XMPPwocky 8y ago
    If you stick it in your mouth or something, maybe. Or if you're soaking wet and have a terrible heart. Otherwise, nobody's getting hurt off 18v.
  - gsich 8y ago
    No. Skin resistance is at least around 100k Ohm at that voltage.
  - semi-extrinsic 8y ago
    DC voltages below 50 V are considered "safe" in normal indoor conditions. It's often referred to as "extra low voltage", as opposed to "low voltage" (50 V - 1000 V) and "high voltage" ( > 1000 V). If you want to verify the safety of 18 V: ever touch both poles of a 9V battery with your fingers? You can't feel anything. Go ahead and try two in series, you still won't feel it.
    - naikrovek 8y ago
      Really? I can feel 4 volts between my finger and thumb. Isn't painful or anything, but I can tell when a lipo battery is charged vs. discharged.
      - Maskawanian 8y ago
        Yes, here is a good video about this: https://www.youtube.com/watch?v=ZxBF7WC0TQk https://www.youtube.com/watch?v=ZxBF7WC0TQk
      - xxs 8y ago
        You can feel lower voltages if you fingers are injured, or if you... lick them. As kids (6-9y) we used to test the voltages of 3R12 (4.5v) by touching the poles with tongue, a sharp bites - the battery was good.
warent 8y ago
> That is simple, if my phone stays functional I'm good, and if it gets fried I take some real world measures (go to small causes court, make a denounce to some government agency) to get compensation. This is much easier said than done (in the US at least.) First, you'd be looking at at least a year of going back and forth in small claims court and by the end of it still have no guarantee of winning. Even if you did win, there's no guarantee the judge would award you the full amount to pay for your fried device. It almost certainly would not pay your time at the courthouse though; you can ask the judge for punitive but you cannot include legal expenses in small claims court demands. In the end you would still be out hundreds or thousands of dollars and numerous hours of your time. That's why to me the tiny benefit of using a public USB outlet is just not remotely worth the risk of such a nightmarish hassle.
- VectorLock 8y ago
  This is the same thing as just plugging into a regular power outlet. You don't know if the thing you're expecting to provide 110v is actually giving you 10,000v. Then again if things were really bad or malicious you could end up losing your life like Sheryl Aldeguer.
userbinator 8y ago
The real problem on public outlets is with data attacks, not power. If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore. My old no-name Android phone (not USB C) has such an option, and searching around it seems to be a reasonably common feature, although not present on all devices. It looks similar to this (mine has the same typo, "USB fuctions"): https://farm8.staticflickr.com/7485/16035739946_51d110ea40.jpg https://farm8.staticflickr.com/7485/16035739946_51d110ea40.j... In charge-only mode it doesn't even enumerate as a USB device when plugged into a computer with an active USB controller, so I suspect no attacks (besides physical ones like overvolting as others here have mentioned) are possible in this mode --- the USB controller on the device is completely disabled.
- geofft 8y ago
  Isn't that the wrong direction? My concern is not so much that my phone will show up to an attacker as a storage device, which can generally be restricted or be set to require pairing - my concern is that the attacker will show up to my phone (or laptop) as an accessory, in particular as a keyboard and mouse and perhaps an external display, at which point they can click through any permission or pairing prompts the OS might try to show.
  - kwhitefoot 8y ago
    Definitely! If my Moto G5+ is locked then it seems that plugging in a keyboard behaves pretty much like plugging a keyboard into a desktop or laptop computer except that it doesn't respond to c-a-del. I can unlock from the external keyboard by pressing the windows key and then typing my pin number but the multimedia keys and print screen on the keyboard work even with the screen locked. I would rather that it didn't do any of that until I give permission on the mobile itself.
- ardy42 8y ago
  >> If I can set my phone to ignore all the data at the first hardware level, and it is a simple enough level that no attack is viable (that second one being a large "if"), then there is no large problem anymore. > My old no-name Android phone (not USB C) has such an option, and searching around it seems to be a reasonably common feature, although not present on all devices. I use one of these. The nice thing about the newer versions is that you can verify the impossibility of a data connection through easy physical inspection. https://www.amazon.com/PortaPow-3rd-Data-Blocker-Pack/dp/B00T0DW3F8 https://www.amazon.com/PortaPow-3rd-Data-Blocker-Pack/dp/B00...

geofft 8y ago

Don't we have technologies for that like fuses? In particular, people seem to use untrusted AC power outlets all the time without their devices being fried. The motivations of an attacker who wants to fry devices (mere lulz) and the motivation of an attacker who wants to break into working devices silently are very different; it makes sense to expect more of the latter, and to define the latter and not the former as within your threat model.

cesarb 8y ago
A fuse protects against overcurrent. It does nothing against overvoltage, or worse, reverse polarity (which was what fried Benson Leung's device). USB-C has a maximum of 20V, and that's only when negotiated by both devices; many devices will only expect 5V. If an untrusted low-quality power supply fails, it can put the full line voltage (alternating from -110V to 110V or more) into the USB cable. Protecting against that would add a lot of bulk and cost to a device. AC powered devices, on the other hand, already have to deal with the full line voltage (which includes negative voltages) all the time, so there's no extra cost for them.
- justrobert 8y ago
  The solution I use and many others is to only charge a usb battery in public, and you use that battery to charge your devices. That works well to solve all the issues with public power ports.
zzzcpan 8y ago
Fuses and input protection in general can't save your device from a malicious attacker connecting say a powerful taser into a usb port.
- geofft 8y ago
  I mean, they also can't solve a malicious attacker connecting a powerful taser above a USB port and trying to maim whoever uses the port. What's your threat model again?

JohnFen 8y ago

> that doesn't change the fact that public USB outlets can still be rigged to fry your machine. That is true, but not something that I'm overly fussed about. I'd much rather have my USB port fried than to suffer an intrusion.

TheCoelacanth 8y ago

Why would anyone do that? If you just want to vandalize things and have the physical access necessary to install a USB outlet, there are much easier ways to do that. Data attacks are much more realistic because the attacker can gain something beyond just causing destruction.

Waterluvian 8y ago

Is this a real problem or a razors in apples problem?

yuubi 8y ago
A real problem for some is that standardizing power adapters interferes with the sale of original manufacturers' adapters. The authentication mechanism looks to be designed to fix this revenue leak.